Signal is active with 2 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
code-projects Community Project Scholars Tracking System 1.0 is vulnerable to SQL Injection in the admin user management endpoints /admin/save_user.php and /admin/update_user.php. These endpoints lack authentication checks and directly concatenate user-supplied POST parameters (firstname, lastname, username, password, user_id) into SQL queries without validation or parameterization.
Priority
LOW
Exploitation
NONE
PoC
YES
Patch
NONE
Momentum
NONE
If you run products in this scope, you should treat this CVE as relevant to your environment.
1 version affected across 1 product
CVE-2025-70152 code-projects Community Project Scholars Tracking System 1.0 is vulnerable to SQL Injection in the admin user management endpoints /admin/save_user.php and /admin/upd… https://www.cve.org/CVERecord?id=CVE-2025-70152
Post summary
The post announces that Scholars Tracking System 1.0 is vulnerable to SQL Injection in specific admin endpoints, but does not provide any PoC, exploit code, patch, or evidence of active exploitation.
🚨 CVE-2025-70152: n/a (CVSS: 9.8)... Unauthenticated SQLi in Scholars Tracking System exposes admin endpoints with direct parameter concatenation—textbook c... https://zerodaysignal.com/vulnerability/CVE-2025-70152 #netsec #vulnerability #CVE #sysadmin #zeroday
Post summary
The tweet announces the CVE-2025-70152 vulnerability, describing it as an unauthenticated SQL injection in a Scholars Tracking System, but provides no proof of concept, exploit code, or mitigation details.
1 of 1 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| App | fabian | scholars_tracking_system | 1.0 | - | - |