Critical severity · published Feb 10, 2025
CVE-2025-1160
SourceCodester Employee Management System index.php default credentials
9.8
CVSS
0.9%
EPSS
No
On KEV
Description
A vulnerability was found in SourceCodester Employee Management System 1.0. It has been rated as critical. Affected by this issue is some unknown functionality of the file index.php. The manipulation of the argument username/password leads to use of default credentials. The attack may be launched remotely. The exploit has been disclosed to the public and may be used.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.9% · higher than 61% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
EM
Employee Management System · SourceCodester
1.0 · source: vendor, NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2025-1160
CVE.org
https://www.cve.org/CVERecord?id=CVE-2025-1160
Exploit
https://gist.github.com/jmx0hxq/0e9cde14b6e9190a7451cd72d7b23bfd
Permissions Required
https://vuldb.com/?ctiid.295064
Third Party Advisory
https://vuldb.com/?id.295064
Third Party Advisory
https://vuldb.com/?submit.493860
Product
https://www.sourcecodester.com/
More from Employee Management System
9.8
CVE-2024-2394
SourceCodester Employee Management System add-admin.php unrestricted upload
9.8
CVE-2024-25239
SQL Injection vulnerability in Sourcecodester Employee Management System v1.0 allows attackers to run arbitrary SQL commands via crafted POST request to…
9.8
CVE-2024-1876
SourceCodester Employee Management System psubmit.php sql injection
9.8
CVE-2024-1833
SourceCodester Employee Management System login.php sql injection
9.8
CVE-2024-1009
SourceCodester Employee Management System login.php sql injection