{"id":"CVE-2025-13468","state":"PUBLISHED","title":"SourceCodester Alumni Management System Delete admin_class.php delete_event authorization","description":"A weakness has been identified in SourceCodester Alumni Management System 1.0. This issue affects the function delete_forum/delete_career/delete_comment/delete_gallery/delete_event of the file admin/admin_class.php of the component Delete Handler. Executing manipulation of the argument ID can lead to missing authorization. It is possible to launch the attack remotely. The exploit has been made available to the public and could be exploited.","publishedAt":"2025-11-20T13:32:08.236Z","updatedAt":"2025-11-20T18:33:51.514Z","severity":{"score":5.3,"label":"Medium","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:P","source":"VulDB"},"assigner":"VulDB","products":["SourceCodester Alumni Management System"],"affected":[{"vendor":"SourceCodester","product":"Alumni Management System","versions":[{"version":"1.0","status":"affected"}],"modules":["Delete Handler"]}],"references":["https://vuldb.com/?id.333041","https://vuldb.com/?ctiid.333041","https://vuldb.com/?submit.694826","https://hackmd.io/@mlgzackfly/SourceCodester","https://www.sourcecodester.com/"],"weaknesses":["CWE-862","CWE-863"],"ingestedAt":"2026-10-29T20:08:31.050Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2025/13xxx/CVE-2025-13468.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2025-13468","state":"PUBLISHED","datePublished":"2025-11-20T13:32:08.236Z","dateUpdated":"2025-11-20T18:33:51.514Z","assignerShortName":"VulDB","assignerOrgId":"1af790b2-7ee1-4545-860a-a788eba489b5","dateReserved":"2025-11-20T06:58:09.831Z"},"containers":{"cna":{"title":"SourceCodester Alumni Management System Delete admin_class.php delete_event authorization","descriptions":[{"lang":"en","value":"A weakness has been identified in SourceCodester Alumni Management System 1.0. This issue affects the function delete_forum/delete_career/delete_comment/delete_gallery/delete_event of the file admin/admin_class.php of the component Delete Handler. Executing manipulation of the argument ID can lead to missing authorization. It is possible to launch the attack remotely. The exploit has been made available to the public and could be exploited."}],"affected":[{"vendor":"SourceCodester","product":"Alumni Management System","versions":[{"version":"1.0","status":"affected"}],"modules":["Delete Handler"]}],"references":[{"url":"https://vuldb.com/?id.333041","name":"VDB-333041 | SourceCodester Alumni Management System Delete admin_class.php delete_event authorization","tags":["vdb-entry","technical-description"]},{"url":"https://vuldb.com/?ctiid.333041","name":"VDB-333041 | CTI Indicators (IOB, IOC, IOA)","tags":["signature","permissions-required"]},{"url":"https://vuldb.com/?submit.694826","name":"Submit #694826 | SourceCodester Alumni Management System 1.0 Missing Authorization","tags":["third-party-advisory"]},{"url":"https://hackmd.io/@mlgzackfly/SourceCodester","tags":["exploit"]},{"url":"https://www.sourcecodester.com/","tags":["product"]}],"metrics":[{"cvssV4_0":{"version":"4.0","baseScore":5.3,"vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:P","baseSeverity":"MEDIUM"}},{"cvssV3_1":{"version":"3.1","baseScore":5.4,"vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L/E:P/RL:X/RC:R","baseSeverity":"MEDIUM"}},{"cvssV3_0":{"version":"3.0","baseScore":5.4,"vectorString":"CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L/E:P/RL:X/RC:R","baseSeverity":"MEDIUM"}},{"cvssV2_0":{"version":"2.0","baseScore":5.5,"vectorString":"AV:N/AC:L/Au:S/C:N/I:P/A:P/E:POC/RL:ND/RC:UR"}}],"problemTypes":[{"descriptions":[{"cweId":"CWE-862","type":"CWE","lang":"en","description":"Missing Authorization"}]},{"descriptions":[{"cweId":"CWE-863","type":"CWE","lang":"en","description":"Incorrect Authorization"}]}],"providerMetadata":{"shortName":"VulDB","orgId":"1af790b2-7ee1-4545-860a-a788eba489b5","dateUpdated":"2025-11-20T13:32:08.236Z"},"timeline":[{"time":"2025-11-20T00:00:00.000Z","lang":"en","value":"Advisory disclosed"},{"time":"2025-11-20T01:00:00.000Z","lang":"en","value":"VulDB entry created"},{"time":"2025-11-20T08:03:14.000Z","lang":"en","value":"VulDB entry last update"}],"credits":[{"lang":"en","value":"mlgzackfly (VulDB User)","type":"reporter"}],"tags":["x_freeware"]},"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"timestamp":"2025-11-20T18:33:38.444540Z","id":"CVE-2025-13468","options":[{"Exploitation":"poc"},{"Automatable":"no"},{"Technical Impact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2025-11-20T18:33:51.514Z"}}]}}}