CVE-2025-15196

A vulnerability was identified in code-projects Assessment Management 1.0. This affects an unknown part of the file login.php. Such manipulation of the argument userid leads to sql injection. The attack can be launched remotely. The exploit is publicly available and might be used.

CVSS 4.0

5.5CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P

CVSS 3.1

9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS

0.4% chance of exploitation in the next 30 days; higher than 36% of CVEs (scores of 2026-10-25)

CWEs

CWE-74, CWE-89

Published

2025-12-29

Modified

2026-10-07

Record from

the NVD, synced 2026-10-19

Affected

• code-projects:assessment_management

References

• https://code-projects.org/
• https://github.com/Limingqian123/CVE/issues/4
• https://vuldb.com/?ctiid.338583
• https://vuldb.com/?id.338583
• https://vuldb.com/?submit.724718

Check your stackJSON