CVE-2025-65134

A SQL injection vulnerability was found in School-Management-System (sumiie24) in the file parent_Login.php of the Public Search Feature via manipulation of the email argument. The attack can be performed remotely, and the exploit has been published and may be used. The product uses a rolling release model, so version information is not disclosed, and the vendor did not respond to the disclosure.

SQL injection vulnerability in itsourcecode School Management System 1.0, affecting an unknown function in User_Login.php. Manipulating the email argument leads to SQL injection. The attack can be executed remotely, and the exploit is public.

The ProjectsAndPrograms school-management-system uses predictable credentials by generating student's and teacher's passwords solely from the user’s date of birth (e.g., 12072000 for 12 July 2000). The application does not require or prompt users to change the password upon first login. This behavior allows attackers to easily guess or derive valid credentials, leading to unauthorized account access.

ProjectsAndPrograms school-management-system is vulnerable to Stored Cross‑Site Scripting (XSS) in multiple attributes of students and teachers objects. An authorized attacker can inject malicious JavaScript that is subsequently executed in other users’ browsers. When chained with CVE‑2025‑11661, it can be exploited remotely without privileges.

A reflected Cross-Site Scripting (XSS) vulnerability was found in the School Management System by mahmoudai1. An unauthenticated remote attacker can execute arbitrary JavaScript in a victim's browser via the unsanitized type parameter in register.php.

In manikandan580 School-management-system 1.0, a reflected XSS vulnerability exists in /studentms/admin/contact-us.php via the pagedes POST parameter. The vulnerability allows reflection of malicious script in the server response.

An XSS vulnerability in School Management System (rolling release) exists in /student-view.php in the Edit Student Info Page component. Manipulation of the First Name argument causes XSS. Remote attack is possible, exploit is public.

School Management System 1.0 is vulnerable to Cross Site Scripting (XSS) via the formuser and formpassword parameters in /adminLogin.php. An attacker can inject malicious JavaScript that executes in the user's browser.

ProjectsAndPrograms School Management System 1.0 has an SQL injection vulnerability in owner_panel/fetch-data/select-students.php. Manipulating the select argument allows remote attacks. The exploit has been published.