CVE-2025-0625

A vulnerability, which was classified as problematic, was found in CampCodes School Management Software 1.0. This affects an unknown part of the component Attachment Handler. The manipulation leads to improper control of resource identifiers. It is possible to initiate the attack remotely. The complexity of an attack is rather high. The exploitability is told to be difficult. The exploit has been disclosed to the public and may be used.

• CWE-99

• https://github.com/KhukuriRimal/Vulnerabilities/blob/main/Insecure%20Direct%20Object%20Reference%20(IDOR)%20-%20All%20Student%20Homework%20Downloadable.pdfExploit, Third Party Advisory
• https://vuldb.com/?ctiid.292737Permissions Required, VDB Entry
• https://vuldb.com/?id.292737Third Party Advisory, VDB Entry
• https://vuldb.com/?submit.484917Third Party Advisory, VDB Entry
• https://www.campcodes.com/Product
• https://github.com/KhukuriRimal/Vulnerabilities/blob/main/Insecure%20Direct%20Object%20Reference%20(IDOR)%20-%20All%20Student%20Homework%20Downloadable.pdfExploit, Third Party Advisory

Published

Jan 22, 2025

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2025-0618A malicious third party could invoke a persistent denial of …6.5
• CVE-2025-0619Unsafe password recovery from configuration in M-Files Serve…4.9
• CVE-2025-0620A flaw was found in Samba. The smbd service daemon does not …4.9
• CVE-2025-0622A flaw was found in command/gpg. In some scenarios, hooks cr…6.4
• CVE-2025-0623Rejected reason: This CVE ID has been rejected or withdrawn …
• CVE-2025-0624A flaw was found in grub2. During the network boot process, …7.6
• CVE-2025-0626The "monitor" binary in the firmware of the affected product…7.7
• CVE-2025-0627The WordPress Tag, Category, and Taxonomy Manager WordPress…3.5
• CVE-2025-0628An improper authorization vulnerability exists in the main-l…8.1
• CVE-2025-0629The Coronavirus (COVID-19) Notice Message WordPress plugin t…4.8
• CVE-2025-0630Multiple Western Telematic (WTI) products contain a web inte…6.5
• CVE-2025-0631A Credential Exposure Vulnerability exists in the above-ment…8.7