CVE-2025-50867

MediumCVSS 6.5/10Last modified Jun 17, 2026

Description

A SQL Injection vulnerability exists in the takeassessment2.php endpoint of the CloudClassroom-PHP-Project 1.0, where the Q5 POST parameter is directly embedded in SQL statements without sanitization.

Metrics

CVSS 3.1 6.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

Weakness enumeration

CWE-89

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

https://github.com/SacX-7/CVE-2025-50867Third Party Advisory

Timeline

Published: Jul 31, 2025
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2025

CVE-2025-508686.5A SQL Injection vulnerability exists in the takeassessment2.php file of CloudClassroom-PHP-Project 1.0. The Q4 POST parameter is not properl CVE-2025-508696.1A stored Cross-Site Scripting (XSS) vulnerability exists in the qureydetails.php page of Institute-of-Current-Students 1.0, where the input CVE-2025-50876.0Kaleris NAVIS N4 ULC (Ultra Light Client) communicates insecurely using zlib-compressed data over HTTP. An attacker capable of observing net CVE-2025-508709.8Institute-of-Current-Students 1.0 is vulnerable to Incorrect Access Control in the mydetailsstudent.php endpoint. The myds GET parameter acc CVE-2025-50888.3An authenticated Redis session could be used to obtain full root access to all servers in the CVX cluster. Note that this would require an a CVE-2025-508818.8The `flow/admin/moniteur.php` script in Use It Flow administration website before 10.0.0 is vulnerable to Remote Code Execution. When handli CVE-2025-50896.5In a CVX cluster, an EOS switch connected to a CVX server is not resilient to certain malformed messages received from the connected CVX ser CVE-2025-508917.2The server-side backend for Adform Site Tracking before 2025-08-28 allows attackers to inject HTML or execute arbitrary code via cookie hija CVE-2025-508927.8The eudskacs.sys driver version 20250328 shipped with EaseUs Todo Backup 1.2.0.1 fails to properly validate privileges for I/O requests (IRP CVE-2025-508974.3A vulnerability exists in riscv-boom SonicBOOM 1.2 (BOOMv1.2) processor implementation, where valid virtual-to-physical address translations CVE-2025-50906.5CVX is not resilient to unexpected messages from a connected switch. This leads to agent crashes on CVX causing instability in the CVX clust CVE-2025-509009.8An issue was discovered in getrebuild/rebuild 4.0.4. The affected source code class is com.rebuild.web.RebuildWebInterceptor, and the affect