CVE-2025-4720

A vulnerability was found in SourceCodester Student Result Management System 1.0. It has been declared as critical. This vulnerability affects unknown code of the file academic/core/drop_student.php. The manipulation of the argument img leads to path traversal. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.

• CWE-22

• https://github.com/Xiaoyi-ing/CVE/issues/4Exploit, Issue Tracking, Third Party Advisory
• https://vuldb.com/?ctiid.309022Permissions Required, VDB Entry
• https://vuldb.com/?id.309022Third Party Advisory, VDB Entry
• https://vuldb.com/?submit.569855Third Party Advisory, VDB Entry
• https://www.sourcecodester.com/Product
• https://github.com/Xiaoyi-ing/CVE/issues/4Exploit, Issue Tracking, Third Party Advisory

Published

May 15, 2025

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2025-47183In GStreamer through 1.26.1, the isomp4 plugin's qtdemux_par…6.6
• CVE-2025-47184An XML external entities (XXE) injection vulnerability in th…5.3
• CVE-2025-47187A vulnerability in the Mitel 6800 Series, 6900 Series, and 6…7.5
• CVE-2025-47188A vulnerability in the Mitel 6800 Series, 6900 Series, and 6…6.5
• CVE-2025-47189Netwrix Directory Manager (formerly Imanami GroupID) 11.0.0.…6.1
• CVE-2025-4719A vulnerability was found in Campcodes Sales and Inventory S…9.8
• CVE-2025-47201In Intrexx Portal Server before 12.0.4, multiple Velocity-Sc…5.4
• CVE-2025-47202In RRC in Samsung Mobile Processor, Wearable Processor, and …9.1
• CVE-2025-47203dbclient in Dropbear SSH before 2025.88 allows command injec…4.5
• CVE-2025-47204An issue was discovered in post.php in bootstrap-multiselect…6.1
• CVE-2025-47205A NULL pointer dereference vulnerability has been reported t…4.9
• CVE-2025-47206An out-of-bounds write vulnerability has been reported to af…8.1