Critical severity9.8NVD Advisory· Published Feb 18, 2026· Updated Jun 17, 2026
CVE-2025-70152
CVE-2025-70152
Description
code-projects Community Project Scholars Tracking System 1.0 is vulnerable to SQL Injection in the admin user management endpoints /admin/save_user.php and /admin/update_user.php. These endpoints lack authentication checks and directly concatenate user-supplied POST parameters (firstname, lastname, username, password, user_id) into SQL queries without validation or parameterization.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected products
3- cpe:2.3:a:fabian:scholars_tracking_system:1.0:*:*:*:*:*:*:*
(expand)+ 1 more
- (no CPE)
- (no CPE)range: = 1.0
Patches
Vulnerability mechanics
References
2- youngkevinn.github.io/posts/CVE-2025-70152-Scholars-SQLi-Missing-Auth/nvdExploitMitigationThird Party Advisory
- code-projects.org/scholars-tracking-system-in-php-with-source-code/nvdProduct
News mentions
0No linked articles in our index yet.