CVE-2025-11061

Campcodes Online Learning Management System edit_student.php sql injection

A vulnerability was found in Campcodes Online Learning Management System 1.0. This affects an unknown part of the file /admin/edit_student.php. Performing manipulation of the argument cys results in sql injection. The attack is possible to be carried out remotely. The exploit has been made public and could be used.

Affected

Campcodes · Online Learning Management System

CVSS v4.0 VULDB

5.5 MEDIUMCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

CVSS v3.1 NVD

9.8 CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CVSS v3.1 VULDB

7.3 HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

CVSS v2.0 VULDB

7.5 HIGHAV:N/AC:L/Au:N/C:P/I:P/A:P

EPSS

0.48% chance of exploitation in the next 30 days, 40th percentile

Published

2025-09-27

Updated

2025-09-29

Proof-of-concept exploits (1)

• luyisi-7/CVE/issues/50★ · 2025-09-15

Security advisories

• https://vuldb.com/?id.326098
• https://vuldb.com/?submit.659638
• https://www.campcodes.com

References

• CVE Record
• NVD entry

Related

• CVE-2025-10809
• CVE-2025-10810
• CVE-2025-11062
• CVE-2025-11063
• CVE-2025-11064