CVE-2025-4940

HighCVSS 7.3/10Last modified Jun 17, 2026

Description

A vulnerability, which was classified as critical, has been found in 1000 Projects Daily College Class Work Report Book 1.0. This issue affects some unknown processing of the file /admin_info.php. The manipulation of the argument batch leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used.

Metrics

CVSS 3.1 7.3/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

Weakness enumeration

CWE-74 CWE-89

Affected software

Vendor	Product	Versions
1000 Projects	Daily College Class Work Report Book	1.0

References

https://1000projects.org/Product
https://github.com/ubfbuz3/cve/issues/15Exploit
https://vuldb.com/?ctiid.309503Permissions Required, VDB Entry
https://vuldb.com/?id.309503Third Party Advisory, VDB Entry
https://vuldb.com/?submit.580161Exploit, Third Party Advisory, VDB Entry
https://github.com/ubfbuz3/cve/issues/15Exploit

Timeline

Published: May 19, 2025
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2025

CVE-2025-494009.8Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in osama.esh WP Visitor Statistics (Real CVE-2025-494019.8Incorrect Privilege Assignment vulnerability in axiomthemes smart SEO smartSEO allows Privilege Escalation.This issue affects smart SEO: fro CVE-2025-494028.5Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in scriptsbundle Exertio Framework exerti CVE-2025-494037.5Unauthenticated Arbitrary File Download in Premium Age Verification / Restriction for WordPress <= 3.0.2 versions.CVE-2025-494048.5Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in purethemes Listeo Core listeo-core all CVE-2025-494054.3Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Favethemes Houzez a CVE-2025-494068.5Missing Authorization vulnerability in favethemes Houzez allows Accessing Functionality Not Properly Constrained by ACLs. This issue affects CVE-2025-494078.8Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in favethemes Houzez allows Reflected XSS CVE-2025-4940810.0Insertion of Sensitive Information Into Sent Data vulnerability in WPDeveloper Templately allows Retrieve Embedded Sensitive Data. This issu CVE-2025-494099.8Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in brewlabs SensorPress allows Stored XSS CVE-2025-49419.8A vulnerability, which was classified as critical, was found in PHPGurukul Credit Card Application Management System 1.0. Affected is an unk CVE-2025-4941010.0Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Imran Emu TC Testimonials allows Store