CVE-2025-13349
LowCVSS 3.5Exploitation Probability (EPSS)
Low risk19th percentile - higher than 19% of all known CVEs
Summary
A cross-site scripting vulnerability was found in SourceCodester Student Grades Management System 1.0 in /grades.php on the Add New Grade Page (Remarks argument). Remote exploitation is possible and the exploit has been publicly disclosed.
Risk Assessment
An attacker could execute malicious script in a user's browser, potentially hijacking sessions or altering grade data. Public exploit availability increases risk.
Recommendation
Update the application to a non-vulnerable version or implement validation and encoding of the Remarks argument in /grades.php. Until patched, restrict access to the system.
Other vulnerabilities in Student Grades Management System
See all- CVE-2026-9484Medium
In SourceCodester Student Grades Management System 1.0, an improper authorization vulnerability exists in the getClassroomStudents/removeStudentFromClassroom function of classroom.php. Manipulating the classroom_id argument leads to authorization bypass. The attack can be performed remotely, and the exploit is publicly available.
- CVE-2026-9483Medium
SourceCodester Student Grades Management System 1.0 has a vulnerability in grades.php where manipulation of the student_id argument leads to improper authorization. The attack can be performed remotely and the exploit is public.
- CVE-2025-11485Low
A vulnerability in SourceCodester Student Grades Management System 1.0 affects the add_user function in /admin.php of the Manage Users Page component. Manipulation of first_name/last_name arguments causes cross site scripting. The attack can be initiated remotely. The exploit has been publicly disclosed.
Original NVD description (English source)
A vulnerability has been found in SourceCodester Student Grades Management System 1.0. This issue affects some unknown processing of the file /grades.php of the component Add New Grade Page. The manipulation of the argument Remarks leads to cross site scripting. Remote exploitation of the attack is possible. The exploit has been disclosed to the public and may be used.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS