Is CVE-2025-70152 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2025-70152 being exploited in the wild.

How severe is CVE-2025-70152?

Critical severity, with a CVSS score of 9.8, published 18 February 2026.

Is there a fix for CVE-2025-70152?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2025-70152 attacked?

It is attacked over the network.

Am I affected by CVE-2025-70152?

Check whether you run Code-Projects Community Project Scholars Tracking System or Fabian Scholars Tracking System at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2025-70152: code-projects Community Project Scholars Tracking System SQL injection in user management

CVE-2025-70152 · Severity: critical · CVSS 9.8 · Published 2026-02-18

The Scholars Tracking System is a web-based application for managing student records and administrative tasks. An unauthenticated attacker can exploit SQL injection flaws in the admin user management endpoints to extract all usernames and passwords from the database, modify or insert arbitrary records, or deny service. No authentication is required—attackers can attack directly from the internet without valid credentials.

Vendors: Code-Projects, Fabian.

Quick answers

Is CVE-2025-70152 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2025-70152 being exploited in the wild.
How severe is CVE-2025-70152?: Critical severity, with a CVSS score of 9.8, published 18 February 2026.
Which products and versions are affected?: Code-Projects Community Project Scholars Tracking System 1.0.
Is there a fix for CVE-2025-70152?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2025-70152 attacked?: It is attacked over the network.
Am I affected by CVE-2025-70152?: Check whether you run Code-Projects Community Project Scholars Tracking System or Fabian Scholars Tracking System at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The vulnerability is a combination of missing authentication (CWE-306) and SQL injection (CWE-89) in the /admin/save_user.php and /admin/update_user.php endpoints. These endpoints directly concatenate unsanitized POST parameters (firstname, lastname, username, password, user_id) into SQL INSERT and UPDATE statements without validation or prepared statements. An attacker sends a crafted HTTP POST request with SQL metacharacters (such as single quotes and UNION/SELECT clauses) in the POST body to break out of the SQL string context and inject arbitrary SQL commands. The attack is network-reachable and requires no prior authentication or user interaction. A successful exploit permits full database disclosure, arbitrary data modification, and potential denial of service.

Affected products

code-projects Community Project Scholars Tracking System 1.0

Timeline

2026-02-18: disclosed: CVE-2025-70152 published

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.