{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2025-13468","assignerOrgId":"1af790b2-7ee1-4545-860a-a788eba489b5","state":"PUBLISHED","assignerShortName":"VulDB","dateReserved":"2025-11-20T06:58:09.831Z","datePublished":"2025-11-20T13:32:08.236Z","dateUpdated":"2025-11-20T18:33:51.514Z"},"containers":{"cna":{"providerMetadata":{"orgId":"1af790b2-7ee1-4545-860a-a788eba489b5","shortName":"VulDB","dateUpdated":"2025-11-20T13:32:08.236Z"},"title":"SourceCodester Alumni Management System Delete admin_class.php delete_event authorization","problemTypes":[{"descriptions":[{"type":"CWE","cweId":"CWE-862","lang":"en","description":"Missing Authorization"}]},{"descriptions":[{"type":"CWE","cweId":"CWE-863","lang":"en","description":"Incorrect Authorization"}]}],"affected":[{"vendor":"SourceCodester","product":"Alumni Management System","versions":[{"version":"1.0","status":"affected"}],"modules":["Delete Handler"]}],"descriptions":[{"lang":"en","value":"A weakness has been identified in SourceCodester Alumni Management System 1.0. This issue affects the function delete_forum/delete_career/delete_comment/delete_gallery/delete_event of the file admin/admin_class.php of the component Delete Handler. Executing manipulation of the argument ID can lead to missing authorization. It is possible to launch the attack remotely. The exploit has been made available to the public and could be exploited."}],"metrics":[{"cvssV4_0":{"version":"4.0","baseScore":5.3,"vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:P","baseSeverity":"MEDIUM"}},{"cvssV3_1":{"version":"3.1","baseScore":5.4,"vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L/E:P/RL:X/RC:R","baseSeverity":"MEDIUM"}},{"cvssV3_0":{"version":"3.0","baseScore":5.4,"vectorString":"CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L/E:P/RL:X/RC:R","baseSeverity":"MEDIUM"}},{"cvssV2_0":{"version":"2.0","baseScore":5.5,"vectorString":"AV:N/AC:L/Au:S/C:N/I:P/A:P/E:POC/RL:ND/RC:UR"}}],"timeline":[{"time":"2025-11-20T00:00:00.000Z","lang":"en","value":"Advisory disclosed"},{"time":"2025-11-20T01:00:00.000Z","lang":"en","value":"VulDB entry created"},{"time":"2025-11-20T08:03:14.000Z","lang":"en","value":"VulDB entry last update"}],"credits":[{"lang":"en","value":"mlgzackfly (VulDB User)","type":"reporter"}],"references":[{"url":"https://vuldb.com/?id.333041","name":"VDB-333041 | SourceCodester Alumni Management System Delete admin_class.php delete_event authorization","tags":["vdb-entry","technical-description"]},{"url":"https://vuldb.com/?ctiid.333041","name":"VDB-333041 | CTI Indicators (IOB, IOC, IOA)","tags":["signature","permissions-required"]},{"url":"https://vuldb.com/?submit.694826","name":"Submit #694826 | SourceCodester Alumni Management System 1.0 Missing Authorization","tags":["third-party-advisory"]},{"url":"https://hackmd.io/@mlgzackfly/SourceCodester","tags":["exploit"]},{"url":"https://www.sourcecodester.com/","tags":["product"]}],"tags":["x_freeware"]},"adp":[{"metrics":[{"other":{"type":"ssvc","content":{"timestamp":"2025-11-20T18:33:38.444540Z","id":"CVE-2025-13468","options":[{"Exploitation":"poc"},{"Automatable":"no"},{"Technical Impact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}}],"title":"CISA ADP Vulnrichment","providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2025-11-20T18:33:51.514Z"}}]}}