CVE-2025-3536

MediumCVSS 6.5/10Last modified Jun 17, 2026

Description

A vulnerability was found in Tutorials-Website Employee Management System 1.0 and classified as critical. Affected by this issue is some unknown functionality of the file /admin/delete-user.php. The manipulation of the argument ID leads to improper authorization. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

Metrics

CVSS 3.1 6.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L

Weakness enumeration

CWE-266 CWE-285 CWE-639

Affected software

Vendor	Product	Versions
Tutorials-Website	Employee Management System	1.0

References

https://vuldb.com/?ctiid.304574VDB Entry
https://vuldb.com/?id.304574VDB Entry
https://vuldb.com/?submit.545810VDB Entry
https://www.websecurityinsights.my.id/2025/03/tutorials-website-employee-management.htmlExploit, Third Party Advisory

Timeline

Published: Apr 13, 2025
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2025

CVE-2025-35375.3A vulnerability was found in Tutorials-Website Employee Management System 1.0. It has been classified as critical. This affects an unknown p CVE-2025-35388.8A vulnerability was found in D-Link DI-8100 16.07.26A1. It has been rated as critical. This issue affects the function auth_asp of the file CVE-2025-35398.0A vulnerability classified as critical has been found in H3C Magic NX15, Magic NX30 Pro, Magic NX400, Magic R3010 and Magic BE18000 up to V1 CVE-2025-35408.0A vulnerability classified as critical was found in H3C Magic NX15, Magic NX30 Pro, Magic NX400 and Magic R3010 up to V100R014. Affected by CVE-2025-35418.0A vulnerability, which was classified as critical, has been found in H3C Magic NX15, Magic NX30 Pro, Magic NX400 and Magic R3010 up to V100R CVE-2025-35428.0A vulnerability, which was classified as critical, was found in H3C Magic NX15, Magic NX400 and Magic R3010 up to V100R014. This affects the CVE-2025-35438.0A vulnerability has been found in H3C Magic NX15, Magic NX30 Pro, Magic NX400 and Magic R3010 up to V100R014 and classified as critical. Thi CVE-2025-354306.5CISA Thorium does not adequately validate the paths of downloaded files via 'download_ephemeral' and 'download_children'. A remote, authenti CVE-2025-354315.4CISA Thorium does not escape user controlled strings used in LDAP queries. An authenticated remote attacker can modify LDAP authorization da CVE-2025-354327.5CISA Thorium does not rate limit requests to send account verification email messages. A remote unauthenticated attacker can send unlimited CVE-2025-354338.8CISA Thorium does not properly invalidate previously used tokens when resetting passwords. An attacker that possesses a previously used toke CVE-2025-354349.8CISA Thorium does not validate TLS certificates when connecting to Elasticsearch. An unauthenticated attacker with access to a Thorium clust