{"id":"CVE-2025-9664","state":"PUBLISHED","title":"code-projects Simple Grading System Admin Panel add_student_grade.php sql injection","description":"A security flaw has been discovered in code-projects Simple Grading System 1.0. Affected is an unknown function of the file /add_student_grade.php of the component Admin Panel. The manipulation of the argument Add results in sql injection. It is possible to launch the attack remotely. The exploit has been released to the public and may be exploited.","publishedAt":"2025-08-29T17:02:14.440Z","updatedAt":"2025-08-29T17:16:45.400Z","severity":{"score":5.3,"label":"Medium","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P","source":"VulDB"},"assigner":"VulDB","products":["code-projects Simple Grading System"],"affected":[{"vendor":"code-projects","product":"Simple Grading System","versions":[{"version":"1.0","status":"affected"}],"modules":["Admin Panel"]}],"references":["https://vuldb.com/?id.321871","https://vuldb.com/?ctiid.321871","https://vuldb.com/?submit.637255","https://www.yuque.com/yuqueyonghuexlgkz/zepczx/hg9oefolxkpyof4l?singleDoc","https://code-projects.org/"],"weaknesses":["CWE-89","CWE-74"],"ingestedAt":"2026-10-29T20:10:13.529Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2025/9xxx/CVE-2025-9664.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.1","cveMetadata":{"cveId":"CVE-2025-9664","state":"PUBLISHED","datePublished":"2025-08-29T17:02:14.440Z","dateUpdated":"2025-08-29T17:16:45.400Z","assignerShortName":"VulDB","assignerOrgId":"1af790b2-7ee1-4545-860a-a788eba489b5","dateReserved":"2025-08-29T07:30:26.407Z"},"containers":{"cna":{"title":"code-projects Simple Grading System Admin Panel add_student_grade.php sql injection","descriptions":[{"lang":"en","value":"A security flaw has been discovered in code-projects Simple Grading System 1.0. Affected is an unknown function of the file /add_student_grade.php of the component Admin Panel. The manipulation of the argument Add results in sql injection. It is possible to launch the attack remotely. The exploit has been released to the public and may be exploited."},{"lang":"de","value":"In code-projects Simple Grading System 1.0 ist eine Schwachstelle entdeckt worden. Dabei geht es um eine nicht genauer bekannte Funktion der Datei /add_student_grade.php der Komponente Admin Panel. Die Manipulation des Arguments Add führt zu sql injection. Der Angriff lässt sich über das Netzwerk starten. Der Exploit wurde der Öffentlichkeit bekannt gemacht und könnte verwendet werden."}],"affected":[{"vendor":"code-projects","product":"Simple Grading System","versions":[{"version":"1.0","status":"affected"}],"modules":["Admin Panel"]}],"references":[{"url":"https://vuldb.com/?id.321871","name":"VDB-321871 | code-projects Simple Grading System Admin Panel add_student_grade.php sql injection","tags":["vdb-entry","technical-description"]},{"url":"https://vuldb.com/?ctiid.321871","name":"VDB-321871 | CTI Indicators (IOB, IOC, TTP, IOA)","tags":["signature","permissions-required"]},{"url":"https://vuldb.com/?submit.637255","name":"Submit #637255 | https://code-projects.org/ simple-grading-system-in-php-with-source-code 1.0 SQL Injection","tags":["third-party-advisory"]},{"url":"https://www.yuque.com/yuqueyonghuexlgkz/zepczx/hg9oefolxkpyof4l?singleDoc","tags":["exploit"]},{"url":"https://code-projects.org/","tags":["product"]}],"metrics":[{"cvssV4_0":{"version":"4.0","baseScore":5.3,"vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P","baseSeverity":"MEDIUM"}},{"cvssV3_1":{"version":"3.1","baseScore":6.3,"vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R","baseSeverity":"MEDIUM"}},{"cvssV3_0":{"version":"3.0","baseScore":6.3,"vectorString":"CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R","baseSeverity":"MEDIUM"}},{"cvssV2_0":{"version":"2.0","baseScore":6.5,"vectorString":"AV:N/AC:L/Au:S/C:P/I:P/A:P/E:POC/RL:ND/RC:UR"}}],"problemTypes":[{"descriptions":[{"cweId":"CWE-89","type":"CWE","lang":"en","description":"SQL Injection"}]},{"descriptions":[{"cweId":"CWE-74","type":"CWE","lang":"en","description":"Injection"}]}],"providerMetadata":{"shortName":"VulDB","orgId":"1af790b2-7ee1-4545-860a-a788eba489b5","dateUpdated":"2025-08-29T17:02:14.440Z"},"timeline":[{"time":"2025-08-29T00:00:00.000Z","lang":"en","value":"Advisory disclosed"},{"time":"2025-08-29T02:00:00.000Z","lang":"en","value":"VulDB entry created"},{"time":"2025-08-29T09:35:42.000Z","lang":"en","value":"VulDB entry last update"}],"credits":[{"lang":"en","value":"liule (VulDB User)","type":"reporter"}],"tags":["x_freeware"]},"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"timestamp":"2025-08-29T17:16:26.273191Z","id":"CVE-2025-9664","options":[{"Exploitation":"poc"},{"Automatable":"no"},{"Technical Impact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2025-08-29T17:16:45.400Z"}}]}}}