CVE-2025-8271

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

A vulnerability was found in code-projects Exam Form Submission 1.0. It has been declared as critical. This vulnerability affects unknown code of the file /admin/delete_s3.php. The manipulation of the argument ID leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-74 CWE-89

Affected software

Vendor	Product	Versions
code-projects	Exam Form Submission	1.0

References

https://code-projects.org/Product
https://github.com/mynlxx/CVE-ZhuChengQing/issues/7Exploit, Third Party Advisory
https://vuldb.com/?ctiid.317860Permissions Required
https://vuldb.com/?id.317860Third Party Advisory, VDB Entry
https://vuldb.com/?submit.622551Third Party Advisory, VDB Entry

Timeline

Published: Jul 28, 2025
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2025

CVE-2025-82729.8A vulnerability was found in code-projects Exam Form Submission 1.0. It has been rated as critical. This issue affects some unknown processi CVE-2025-82739.8A vulnerability classified as critical has been found in code-projects Exam Form Submission 1.0. Affected is an unknown function of the file CVE-2025-82749.8A vulnerability classified as critical was found in Campcodes Online Recruitment Management System 1.0. Affected by this vulnerability is an CVE-2025-82755.3A vulnerability, which was classified as problematic, has been found in bsc Peru Cocktails App 1.0.0 on Android. Affected by this issue is s CVE-2025-82764.3Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting'), Improper Encoding or Escaping of Output, Improp CVE-2025-82773.1A flaw was found in libssh's handling of key exchange (KEX) processes when a client repeatedly sends incorrect KEX guesses. The library fail CVE-2025-82799.8Insufficient input validation within GitLab Language Server 7.6.0 and later before 7.30.0 allows arbitrary GraphQL query execution CVE-2025-82805.8The Contact Form 7 reCAPTCHA WordPress plugin through 1.2.0 does not escape the $_SERVER['REQUEST_URI'] parameter before outputting it back CVE-2025-82817.1The WP Talroo WordPress plugin through 2.4 does not sanitise and escape a parameter before outputting it back in the page, leading to a Refl CVE-2025-82823.5The SureForms WordPress plugin before 1.9.1 does not sanitise and escape some parameters when outputing them in the page, which could allow CVE-2025-82833.7A vulnerability was found in the netavark package, a network stack for containers used with Podman. Due to dns.podman search domain being re CVE-2025-82849.8By default, the Packet Power Monitoring and Control Web Interface do not enforce authentication mechanisms. This vulnerability could allow