ByteOS Network

NVD Vulnerability Details :

CVE-2025-70152

Analyzed

Source-cve@mitre.org

Published At-18 Feb, 2026 | 18:24

Updated At-23 Feb, 2026 | 17:54

code-projects Community Project Scholars Tracking System 1.0 is vulnerable to SQL Injection in the admin user management endpoints /admin/save_user.php and /admin/update_user.php. These endpoints lack authentication checks and directly concatenate user-supplied POST parameters (firstname, lastname, username, password, user_id) into SQL queries without validation or parameterization.

Date Added	Due Date	Vulnerability Name	Required Action
	N/A

Metrics

Type	Version	Base score	Base severity	Vector
Secondary	3.1	9.8	CRITICAL	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Type: Secondary

Version: 3.1

Base score: 9.8

Base severity: CRITICAL

Vector:

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CPE Matches

Fabian Ros

>>scholars_tracking_system>>1.0

cpe:2.3:a:fabian:scholars_tracking_system:1.0:*:*:*:*:*:*:*

Weaknesses

CWE ID	Type	Source
CWE-89	Secondary	134c704f-9b21-4f2e-91b3-4a467353bcc0

CWE ID: CWE-89

Type: Secondary

Source: 134c704f-9b21-4f2e-91b3-4a467353bcc0

References

Hyperlink	Source	Resource
https://code-projects.org/scholars-tracking-system-in-php-with-source-code/	cve@mitre.org	Product
https://youngkevinn.github.io/posts/CVE-2025-70152-Scholars-SQLi-Missing-Auth/	cve@mitre.org	Exploit Third Party Advisory Mitigation

Hyperlink: https://code-projects.org/scholars-tracking-system-in-php-with-source-code/

Source: cve@mitre.org

Resource:

Product

Hyperlink: https://youngkevinn.github.io/posts/CVE-2025-70152-Scholars-SQLi-Missing-Auth/

Source: cve@mitre.org

Resource:

Exploit

Third Party Advisory

Mitigation

CISA Catalog

Metrics

CPE Matches

Weaknesses

Evaluator Description

Evaluator Impact

Evaluator Solution

Vendor Statements

References

Change History