Login Request a demo
Critical severity · published Dec 29, 2025
CVE-2025-15196
code-projects Assessment Management login.php sql injection
9.8
CVSS
0.4%
EPSS
No
On KEV
Description
A vulnerability was identified in code-projects Assessment Management 1.0. This affects an unknown part of the file login.php. Such manipulation of the argument userid leads to sql injection. The attack can be launched remotely. The exploit is publicly available and might be used.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.4% · higher than 37% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
AM
Assessment Management · code-projects
1.0 · source: vendor, NVD
Affected product
AM
Assessment Management
code-projects
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2025-15196
CVE.org
https://www.cve.org/CVERecord?id=CVE-2025-15196
Product
https://code-projects.org/
Exploit
https://github.com/Limingqian123/CVE/issues/4
Permissions Required
https://vuldb.com/?ctiid.338583
Third Party Advisory
https://vuldb.com/?id.338583
Third Party Advisory
https://vuldb.com/?submit.724718
More from Assessment Management
9.8
CVE-2025-15195
code-projects Assessment Management add-module.php sql injection
7.3
CVE-2026-76762
code-projects Assessment Management welcome.php sql injection
6.3
CVE-2026-14658
code-projects Assessment Management marking-scheme.php sql injection
6.3
CVE-2026-14657
code-projects Assessment Management Database Query marking-scheme.php sql injection
4.3
CVE-2026-14656
code-projects Assessment Management remove-user.php cross site scripting