Critical severity · published Dec 19, 2025
CVE-2025-14950
code-projects Scholars Tracking System delete_post.php sql injection
9.8
CVSS
0.4%
EPSS
No
On KEV
Description
A weakness has been identified in code-projects Scholars Tracking System 1.0. The affected element is an unknown function of the file /delete_post.php. This manipulation of the argument ID causes sql injection. Remote exploitation of the attack is possible. The exploit has been made available to the public and could be used for attacks.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.4% · higher than 33% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
ST
Scholars Tracking System · code-projects
1.0 · source: vendor, NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2025-14950
CVE.org
https://www.cve.org/CVERecord?id=CVE-2025-14950
Product
https://code-projects.org/
Exploit
https://github.com/gx922/CVE/issues/2
Permissions Required
https://vuldb.com/?ctiid.337586
Third Party Advisory
https://vuldb.com/?id.337586
Third Party Advisory
https://vuldb.com/?submit.716123
More from Scholars Tracking System
9.8
CVE-2025-14951
code-projects Scholars Tracking System home.php sql injection
9.8
CVE-2025-14940
code-projects Scholars Tracking System delete_user.php sql injection
9.8
CVE-2024-24101
Code-projects Scholars Tracking System 1.0 is vulnerable to SQL Injection under Eligibility Information Update
9.8
CVE-2024-24093
SQL Injection vulnerability in Code-projects Scholars Tracking System 1.0 allows attackers to run arbitrary code via Personal Information Update information
7.8
CVE-2024-24092
SQL Injection vulnerability in Code-projects.org Scholars Tracking System 1.0 allows attackers to run arbitrary code via login.php