CVE-2025-13583

A weakness has been identified in code-projects Question Paper Generator 1.0. This affects an unknown part of the file /signupscript.php of the component POST Parameter Handler. Executing manipulation of the argument Fname can lead to sql injection. The attack can be executed remotely. The exploit has been made available to the public and could be exploited.

CVSS 4.0

5.5CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P

CVSS 3.1

9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS

0.4% chance of exploitation in the next 30 days; higher than 36% of CVEs (scores of 2026-10-25)

CWEs

CWE-89, CWE-74

Published

2025-11-24

Modified

2026-10-08

Record from

the NVD, synced 2026-10-19

Affected

• carmelo:question_paper_generator

References

• https://code-projects.org/
• https://github.com/rassec2/dbcve/issues/6
• https://vuldb.com/?ctiid.333347
• https://vuldb.com/?id.333347
• https://vuldb.com/?submit.699591

Check your stackJSON