CVE-2025-0211 is a medium severity file inclusion flaw (CVSS 6.3) in Campcodes School Faculty Scheduling System version 1.0, reached through the page argument of /admin/index.php. The record lists no patched release, so the fix is to correct the code, restrict access to the app, or retire it.
What's affected
The record names Campcodes School Faculty Scheduling System, version 1.0. The weak spot is the page input handled at /admin/index.php. The CVSS 3.1 vector is CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L, which means the issue is reachable over the network, needs low privileges (an ordinary account), and has low impact on each of confidentiality, integrity and availability, for a base score of 6.3.
There is no fixed version in the record, and none of the references name one. Treat every copy of this version as affected until you have checked with the project yourself.
The record also says the exploit has been disclosed to the public. It does not say the flaw is exploited in the wild, and it is not on the CISA Known Exploited Vulnerabilities list. Public technical detail still lowers the effort needed, so do not wait on that distinction.
How to check if you're exposed
Start with whether you run the product at all. Search your servers and repositories for the file named in the record.
find /var/www -type f -name "index.php"
Then read the file and check how the page value is used in an include or require statement.
grep -n "include\|require\|_GET" /path/to/index.php
Finally, check web server logs for requests to that path where the page value is not one of the page names the app normally uses.
If you cannot find the product, run a free scan of your repositories and manifests at gold.safeguard.sh/scan. It reports known CVEs for the dependencies it can see. Keep in mind that a hand-written PHP project may not show up in a package inventory, so a file search on the server is the more reliable check here.
What to do now
- Find every copy of Campcodes School Faculty Scheduling System you run, including test and demo servers, and note which ones face the internet.
- Take internet-facing copies offline or place them behind a VPN, a login proxy or an IP allow list until the code is fixed.
- Replace the dynamic include with a fixed map of allowed page names, and reject any value that is not a key in that map.
- Check the other pages in the app for the same pattern, since the same loader is often reused.
- Run the web server account with the least file access it needs, so a bad include cannot read configuration or secrets.
- Watch the project and the NVD record for a fix, and if the product is a sample or abandoned project, plan to replace it. Check the advisory pages before you rely on any claim of a patch.
- Rescan after changes and add the app to a recurring check so a regression is caught.
Why it matters
File inclusion happens when the app builds a file path from request input and loads it as code. The record maps this to CWE-73, external control of a file name or path. The page argument should only ever select from a short fixed list.
When an attacker can steer which file is loaded, the app may expose files it never meant to serve, and may run a file that was placed on the server by some other route.
Quick check
Is there a patched version of School Faculty Scheduling System?
The record does not name one. Check the project page and the advisory, and fix the page loader yourself if you must keep running it.
What is the safest way to load pages by name?
Map each allowed name to a fixed file in code, and reject anything not in the map.
Sources
The other references in the record are public write-ups of the flaw. They were not fetched or reproduced here, and this post gives no attack steps.
Last reviewed: 19 October 2026.
