CVE-2025-9306

SourceCodester Advanced School Management System 1.0 contains a Stored XSS in /index.php/notice/addNotice effected by the noticeSubject parameter. The root cause is improper sanitization/escaping of user input, allowing an attacker to inject script that executes in other users’ browsers. The vuln...

CVE-2025-9689

The CVE-2025-9689 entry concerns SourceCodester Advanced School Management System 1.0. The vulnerability is located in an unknown function of the file /index.php/stock/item_select, where manipulation of the q parameter results in SQL injection. It is exploitable remotely and exploits are publicly...

CVE-2025-9690

CVE-2025-9690 concerns SourceCodester Advanced School Management System 1.0. The vulnerability is a SQL injection in the file /index.php/stock/vendordetails where manipulating the ID parameter enables remote exploitation. Multiple sources confirm the issue and indicate an exploitable condition wi...