CVE-2025-15075

CriticalCVSS 9.8/10Last modified Oct 7, 2026

Description

A security flaw has been discovered in itsourcecode Student Management System 1.0. This issue affects some unknown processing of the file /student_p.php. Performing manipulation of the argument ID results in sql injection. The attack can be initiated remotely. The exploit has been released to the public and may be exploited.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-74 CWE-89

Affected software

Vendor	Product	Versions
itsourcecode	Student Management System	1.0

References

https://github.com/ltranquility/CVE/issues/30Exploit, Issue Tracking
https://itsourcecode.com/Product
https://vuldb.com/?ctiid.338332Permissions Required, VDB Entry
https://vuldb.com/?id.338332Third Party Advisory, VDB Entry
https://vuldb.com/?submit.721406Third Party Advisory, VDB Entry

Timeline

Published: Dec 25, 2025
Last modified: Oct 7, 2026
NVD status: Analyzed

Related CVEs from 2025

CVE-2025-150767.3A weakness has been identified in Tenda CH22 1.0.0.1. Impacted is an unknown function of the file /public/. Executing a manipulation can lea CVE-2025-150779.8A security vulnerability has been detected in itsourcecode Student Management System 1.0. The affected element is an unknown function of the CVE-2025-150789.8A vulnerability was detected in itsourcecode Student Management System 1.0. The impacted element is an unknown function of the file /list_re CVE-2025-150795.3When doing SSH-based transfers using either SCP or SFTP, and setting the known_hosts file, libcurl could still mistakenly accept connecting CVE-2025-15085.3The WP Crowdfunding plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the download_data CVE-2025-150808.8Improper Validation of Specified Quantity in Input vulnerability in Mitsubishi Electric MELSEC iQ-R Series R08PCPU, R16PCPU, R32PCPU, and R1 CVE-2025-150816.3A vulnerability has been found in JD Cloud BE6500 4.4.1.r4308. This issue affects the function sub_4780 of the file /jdcapi. Such manipulati CVE-2025-150827.5A vulnerability was found in TOZED ZLT M30s up to 1.47. Impacted is an unknown function of the file /reqproc/proc_post of the component Web CVE-2025-150834.6A vulnerability was determined in TOZED ZLT M30s up to 1.47. The affected element is an unknown function of the component UART Interface. Ex CVE-2025-150843.1A vulnerability was identified in youlaitech youlai-mall 1.0.0/2.0.0. The impacted element is the function orderService.payOrder of the file CVE-2025-150858.1A security flaw has been discovered in youlaitech youlai-mall 1.0.0/2.0.0. This affects the function deductBalance of the file mall-ums/ums-CVE-2025-150864.3A weakness has been identified in youlaitech youlai-mall 1.0.0/2.0.0. This impacts the function getMemberByMobile of the file mall-ums/ums-b