{"id":"CVE-2025-66947","title":"SQL injection vulnerability in krishanmuraiji SMS v.1.0, within the /studentms/admin/edit-class-detail.php via the editid GET parameter","summary":"SQL injection vulnerability in krishanmuraiji SMS v.1.0, within the /studentms/admin/edit-class-detail.php via the editid GET parameter. An attacker can trigger controlled delays using SQL SLEEP() to infer database contents. Successful e…","severity":"medium","cvss":6.5,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N","cwe":["CWE-89"],"vendor":"krishanmurariji","product":"student_management_system","affected":["student_management_system = 1.0"],"published":"2025-12-26","updated":"2026-10-14","sourceUpdated":"2026-10-14T16:10:00.250","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2025-66947","references":[{"url":"https://github.com/kabir0104k/CVE-2025-66947/blob/main/README.md","label":"cve@mitre.org"}],"tags":["nvd","exploit-available"],"epss":0.00281,"epssPercentile":0.19075,"exploits":{"github":1,"githubRepos":["https://github.com/kabir0104k/CVE-2025-66947"],"checkedAt":"2026-10-14T16:41:07.236Z"},"exploitAvailable":true,"ingestedAt":"2026-10-14T16:40:32.059Z","slug":"CVE-2025-66947","body":"## Overview\n\nSQL injection vulnerability in krishanmuraiji SMS v.1.0, within the /studentms/admin/edit-class-detail.php via the editid GET parameter. An attacker can trigger controlled delays using SQL SLEEP() to infer database contents. Successful exploitation may lead to full database compromise, especially within an administrative module.\n\n## Affected\n\n- `student_management_system = 1.0`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"twilight","depthScore":48,"depthScoreParts":{"impact":35.8,"likelihood":0.1,"exploitation":12,"ransomware":0},"changes":[]}