CVE-2025-9839

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

A security flaw has been discovered in itsourcecode Student Information Management System 1.0. The affected element is an unknown function of the file /admin/modules/course/index.php. Performing manipulation of the argument ID results in sql injection. Remote exploitation of the attack is possible. The exploit has been released to the public and may be exploited.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-74 CWE-89

Affected software

Vendor	Product	Versions
itsourcecode	Student Information Management System	1.0

References

https://github.com/mybonn/CVE/issues/3Exploit, Issue Tracking, Third Party Advisory
https://itsourcecode.com/Product
https://vuldb.com/?ctiid.322186Permissions Required, VDB Entry
https://vuldb.com/?id.322186Third Party Advisory, VDB Entry
https://vuldb.com/?submit.645384Third Party Advisory, VDB Entry

Timeline

Published: Sep 2, 2025
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2025

CVE-2025-98409.8A weakness has been identified in itsourcecode Sports Management System 1.0. The impacted element is an unknown function of the file /Admin/CVE-2025-98418.8A security vulnerability has been detected in code-projects Mobile Shop Management System 1.0. This affects an unknown function of the file CVE-2025-98427.5A vulnerability was detected in Das Parking Management System 停车场管理系统 6.2.0. This impacts an unknown function of the file /Operator/Search. CVE-2025-98437.5A flaw has been found in Das Parking Management System 停车场管理系统 6.2.0. Affected is an unknown function of the file /Operator/FindAll. This ma CVE-2025-98448.8Uncontrolled Search Path Element vulnerability in Salesforce Salesforce CLI on Windows allows Replace Trusted Executable.This issue affects CVE-2025-98455.4A vulnerability has been found in code-projects Fruit Shop Management System 1.0. Affected by this vulnerability is an unknown functionality CVE-2025-984610.0Unrestricted Upload of File with Dangerous Type vulnerability in TalentSys Consulting Information Technology Industry Inc. Inka.Net allows C CVE-2025-98479.8A weakness has been identified in ScriptAndTools Real Estate Management System 1.0. Impacted is an unknown function of the file register.php CVE-2025-98487.5A security vulnerability has been detected in ScriptAndTools Real Estate Management System 1.0. The affected element is an unknown function CVE-2025-98496.4The Html Social share buttons plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'zm_sh_btn' shortcode in al CVE-2025-98506.4The Evenium plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'evenium_single_event' shortcode in all versi CVE-2025-98516.4The Appointmind plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'appointmind_calendar' shortcode in all v