Fabian Scholars Tracking System vulnerabilities

🔔 Create alert RSS Version checker

Published CVEs affecting Fabian Scholars Tracking System: 5 record(s), with affected versions and fixes.
cpe:2.3:a:fabian:scholars_tracking_system

CVE-2025-70152 Critical · 9.8 CWE-89 Feb 18, 2026

SQL Injection in Fabian Scholars Tracking System

code-projects Community Project Scholars Tracking System 1.0 is vulnerable to SQL Injection in the admin user management endpoints /admin/save_user.php and /admin/update_user.php. These endpoints lack authentication checks and directly concatenate user-supplied POST parameters (firstname, lastname, username, password, user_id) into SQL queries without validation or parameterization.

CVE-2025-70151 High · 8.8 CWE-434 Feb 18, 2026

Unrestricted Upload of File with Dangerous Type in Fabian Scholars Tracking System

code-projects Scholars Tracking System 1.0 allows an authenticated attacker to achieve remote code execution via unrestricted file upload. The endpoints update_profile_picture.php and upload_picture.php store uploaded files in a web-accessible uploads/ directory using the original, user-supplied filename without validating the file type or extension. By uploading a PHP file and then requesting it from /uploads/, an attacker can execute arbitrary PHP code as the web server user.

CVE-2025-14951 Critical · 9.8 CWE-74 Dec 19, 2025

code-projects Scholars Tracking System home.php sql injection

A security vulnerability has been detected in code-projects Scholars Tracking System 1.0. The impacted element is an unknown function of the file /home.php. Such manipulation of the argument post_content leads to sql injection. The attack can be executed remotely. The exploit has been disclosed publicly and may be used.

CVE-2025-14950 Critical · 9.8 CWE-74 Dec 19, 2025

code-projects Scholars Tracking System delete_post.php sql injection

A weakness has been identified in code-projects Scholars Tracking System 1.0. The affected element is an unknown function of the file /delete_post.php. This manipulation of the argument ID causes sql injection. Remote exploitation of the attack is possible. The exploit has been made available to the public and could be used for attacks.

CVE-2025-14940 Critical · 9.8 CWE-74 Dec 19, 2025

code-projects Scholars Tracking System delete_user.php sql injection

A vulnerability was determined in code-projects Scholars Tracking System 1.0. The affected element is an unknown function of the file /admin/delete_user.php. This manipulation of the argument ID causes sql injection. It is possible to initiate the attack remotely. The exploit has been publicly disclosed and may be utilized.