9.8Critical
CVE-2025-70152
Description
code-projects Community Project Scholars Tracking System 1.0 is vulnerable to SQL Injection in the admin user management endpoints /admin/save_user.php and /admin/update_user.php. These endpoints lack authentication checks and directly concatenate user-supplied POST parameters (firstname, lastname, username, password, user_id) into SQL queries without validation or parameterization.
Weakness (CWE):
CWE-89
Data: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Published as the sources state it, in English.
Affected products and versions
| Vendor | Product | Versions | |
|---|---|---|---|
| fabian | scholars tracking system | 1.0 |
References and patches
CPE matches (NVD) (1)
cpe:2.3:a:fabian:scholars_tracking_system:1.0:*:*:*:*:*:*:*