CVE-2025-5649

MediumCVSS 6.5/10Last modified Jun 17, 2026

Description

A vulnerability classified as critical has been found in SourceCodester Student Result Management System 1.0. This affects an unknown part of the file /admin/core/new_user of the component Register Interface. The manipulation leads to improper access controls. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.

Metrics

CVSS 3.1 6.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

Weakness enumeration

CWE-266 CWE-284

Affected software

Vendor	Product	Versions
SourceCodester	Student Result Management System	1.0

References

https://github.com/Watskip/GeneralResearch/blob/main/Exploits/SRMS/Unauthorized%20privileged%20user%20creation.mdExploit, Third Party Advisory
https://vuldb.com/?ctiid.311139Permissions Required, VDB Entry
https://vuldb.com/?id.311139Third Party Advisory, VDB Entry
https://vuldb.com/?submit.589458Third Party Advisory, VDB Entry
https://www.sourcecodester.com/Product
https://github.com/Watskip/GeneralResearch/blob/main/Exploits/SRMS/Unauthorized%20privileged%20user%20creation.mdExploit, Third Party Advisory

Timeline

Published: Jun 5, 2025
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2025

CVE-2025-564985.3An OS command injection vulnerability exists in PLDT WiFi Router's Prolink PGN6401V Firmware 8.1.2 web management interface. The ping6.asp p CVE-2025-564996.5Incorrect access control in mihomo v1.19.11 allows authenticated attackers with low-level privileges to read arbitrary files with elevated p CVE-2025-56509.8A vulnerability classified as critical was found in 1000projects Online Notice Board 1.0. This vulnerability affects unknown code of the fil CVE-2025-565036.5An issue in Sublime HQ Pty Ltd Sublime Text 4 4200 allows authenticated attackers with low-level privileges to escalate privileges to Admini CVE-2025-56515.4A vulnerability, which was classified as problematic, has been found in code-projects Traffic Offense Reporting System 1.0. This issue affec CVE-2025-565139.8NiceHash QuickMiner 6.12.0 perform software updates over HTTP without validating digital signatures or hash checks. An attacker capable of i CVE-2025-565145.4Cross Site Scripting (XSS) vulnerability in Fiora chat application 1.0.0 allows executes arbitrary JavaScript when malicious SVG files are r CVE-2025-565158.8File upload vulnerability in Fiora chat application 1.0.0 through user avatar upload functionality. The application fails to validate SVG fi CVE-2025-56528.8A vulnerability, which was classified as critical, was found in PHPGurukul Complaint Management System 2.0. Affected is an unknown function CVE-2025-565205.3Dify v1.6.0 was discovered to contain a Server-Side Request Forgery (SSRF) via the component controllers.console.remote_files.RemoteFileUplo CVE-2025-565266.1Cross site scripting (XSS) vulnerability in Kotaemon 0.11.0 allowing attackers to execute arbitrary code via a crafted PDF.CVE-2025-565277.5Plaintext password storage in Kotaemon 0.11.0 in the client's localStorage.