Medium severity · published Dec 14, 2025
CVE-2025-14662
code-projects Student File Management System Update User update_user.php cross site scripting
5.4
CVSS
0.2%
EPSS
No
On KEV
Description
A vulnerability was found in code-projects Student File Management System 1.0. This affects an unknown part of the file /admin/update_user.php of the component Update User Page. Performing manipulation results in cross site scripting. The attack may be initiated remotely. The exploit has been made public and could be used.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
Required
Confidentiality
Low
Integrity
Low
Availability
None
Scope
Changed
Exploitation
Is it being used?
Exploit prediction (EPSS)0.2% · higher than 14% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
SF
Student File Management System · code-projects
1.0 · source: vendor, NVD
Affected product
SF
Student File Management System
code-projects
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2025-14662
CVE.org
https://www.cve.org/CVERecord?id=CVE-2025-14662
Product
https://code-projects.org/
Exploit
https://github.com/jjjjj-zr/jjjjjzr15/issues/1
Permissions Required
https://vuldb.com/?ctiid.336394
Third Party Advisory
https://vuldb.com/?id.336394
Third Party Advisory
https://vuldb.com/?submit.713873
More from Student File Management System
9.8
CVE-2025-14646
code-projects Student File Management System delete_student.php sql injection
9.8
CVE-2025-14645
code-projects Student File Management System delete_user.php sql injection
9.8
CVE-2025-14640
code-projects Student File Management System save_student.php sql injection
9.8
CVE-2025-14623
code-projects Student File Management System update_student.php sql injection
9.8
CVE-2025-14622
code-projects Student File Management System save_user.php sql injection