CVE-2025-14620

CriticalCVSS 9.8/10Last modified Oct 7, 2026

Description

A vulnerability was determined in code-projects Student File Management System 1.0. Affected by this issue is some unknown functionality of the file /admin/login_query.php. Executing manipulation of the argument Username can lead to sql injection. The attack may be launched remotely. The exploit has been publicly disclosed and may be utilized.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-74 CWE-89

Affected software

Vendor	Product	Versions
code-projects	Student File Management System	1.0

References

https://code-projects.org/Product
https://github.com/jjjjj-zr/jjjjjzr3/issues/1Exploit, Issue Tracking, Third Party Advisory
https://vuldb.com/?ctiid.336305Permissions Required, VDB Entry
https://vuldb.com/?id.336305Third Party Advisory, VDB Entry
https://vuldb.com/?submit.707109Third Party Advisory, VDB Entry
https://vuldb.com/?submit.709074Third Party Advisory, VDB Entry

Timeline

Published: Dec 13, 2025
Last modified: Oct 7, 2026
NVD status: Analyzed

Related CVEs from 2025

CVE-2025-146219.8A vulnerability was identified in code-projects Student File Management System 1.0. This affects an unknown part of the file /admin/update_u CVE-2025-146229.8A security flaw has been discovered in code-projects Student File Management System 1.0. This vulnerability affects unknown code of the file CVE-2025-146239.8A weakness has been identified in code-projects Student File Management System 1.0. This issue affects some unknown processing of the file /CVE-2025-146256.7Uncontrolled Search Path Element vulnerability in Altera Quartus Prime Standard on Windows (Nios II Command Shell modules), Altera Quartus P CVE-2025-146266.4The QR Code for WooCommerce order emails, PDF invoices, packing slips plugin for WordPress is vulnerable to Stored Cross-Site Scripting via CVE-2025-146276.4The WP Import – Ultimate CSV XML Importer for WordPress plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up CVE-2025-146295.3The Alchemist Ajax Upload plugin for WordPress is vulnerable to unauthorized media file deletion due to a missing capability check on the 'd CVE-2025-14634.3The Spreadsheet Integration plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 3.8.2. Th CVE-2025-146304.3The AdminQuickbar plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.9.3. This is due CVE-2025-146316.5A NULL Pointer Dereference vulnerability in TP-Link Archer BE400 V1(802.11 modules) allows an adjacent attacker to cause a denial-of-servi CVE-2025-146324.4The Filr – Secure document library plugin for WordPress is vulnerable to Stored Cross-Site Scripting via unrestricted file upload in all ver CVE-2025-146335.3The F70 Lead Document Download plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the 'f