CVE-2025-14663

MediumCVSS 4.8/10Last modified Oct 7, 2026

Description

A vulnerability was determined in code-projects Student File Management System 1.0. This vulnerability affects unknown code of the file /admin/update_student.php. Executing manipulation can lead to cross site scripting. The attack may be launched remotely. The exploit has been publicly disclosed and may be utilized.

Metrics

CVSS 3.1 4.8/10CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79 CWE-94

Affected software

Vendor	Product	Versions
code-projects	Student File Management System	1.0

References

https://code-projects.org/Product
https://github.com/jjjjj-zr/jjjjjzr16/issues/1Exploit, Issue Tracking, Third Party Advisory
https://vuldb.com/?ctiid.336395Permissions Required, VDB Entry
https://vuldb.com/?id.336395Third Party Advisory, VDB Entry
https://vuldb.com/?submit.714018Third Party Advisory, VDB Entry

Timeline

Published: Dec 14, 2025
Last modified: Oct 7, 2026
NVD status: Analyzed

Related CVEs from 2025

CVE-2025-146649.8A vulnerability was identified in Campcodes Supplier Management System 1.0. This issue affects some unknown processing of the file /admin/vi CVE-2025-146659.8A security flaw has been discovered in Tenda WH450 1.0.0.18. Impacted is an unknown function of the file /goform/DhcpListClient of the compo CVE-2025-146669.8A weakness has been identified in itsourcecode COVID Tracking System 1.0. The affected element is an unknown function of the file /admin/?pa CVE-2025-146679.8A security vulnerability has been detected in itsourcecode COVID Tracking System 1.0. The impacted element is an unknown function of the fil CVE-2025-146689.8A vulnerability was detected in campcodes Advanced Online Examination System 1.0. This affects an unknown function of the file /query/loginE CVE-2025-14676.1Versions of the package tarteaucitronjs before 1.17.0 are vulnerable to Cross-site Scripting (XSS) via the getElemWidth() and getElemHeight(CVE-2025-146729.8A flaw has been found in gmg137 snap7-rs up to 1.142.1. This impacts the function TSnap7MicroClient::opWriteArea of the file s7_micro_client CVE-2025-146739.8A vulnerability has been found in gmg137 snap7-rs up to 1.142.1. Affected is the function snap7_rs::client::S7Client::as_ct_write of the fil CVE-2025-146746.3A vulnerability was found in aizuda snail-job up to 1.6.0. Affected by this vulnerability is the function QLExpressEngine.doEval of the file CVE-2025-146757.2The Meta Box plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the 'ajax_delete_file CVE-2025-14687.5An unauthenticated remote attacker can gain access to sensitive information including authentication information when using CODESYS OPC UA S CVE-2025-146843.3IBM Maximo Application Suite - Monitor Component 9.1, 9.0, 8.11, and 8.10 could allow an unauthorized user to inject data into log messages