CVE-2025-14646 is a high severity SQL injection (CVSS 7.3) in code-projects Student File Management System version 1.0. The CVE record says the exploit is public. No fixed version is confirmed, so the safe course is to take it off the internet, restrict access and fix the input handling.
What's affected
The record lists code-projects Student File Management System, version 1.0.
The weak spot is the file /admin/delete_student.php, through the argument stud_id. The record calls the function unknown, which means the advisory does not give a precise code line. That is typical for reports on this kind of small PHP project.
The record does not list a fixed version. The vendor site and the linked reports should be checked for any update, and until one is confirmed you should treat version 1.0 as unpatched.
How to check if you're exposed
This is application source you deploy yourself, so there is no package manager entry to query. Work from the files.
First confirm you run the product and version in the record. Look in the project folder for a readme, a version note or the download page you used. Then search the code for the affected file and the argument.
grep -rn "delete_student.php" /var/www/
Swap the path for your web root. If the file exists and handles the stud_id value as the record describes, you match the description. Next, check your web server logs for requests to that file that you do not recognize.
grep "delete_student.php" /var/log/nginx/access.log | tail -n 50
Use your own log path. Odd characters, very long values or a burst of requests to one page deserve a closer look. You can also run the free in-browser dependency scan on any package manifests that ship with the project.
What to do now
- Find every copy of Student File Management System you or your team run, including test and demo servers.
- Take the application off the public internet, or put it behind a VPN or an IP allowlist, until you can fix it.
- Change the code that handles stud_id so the query uses prepared statements with bound parameters, and validate the value on the server.
- Check logs and the database for signs of use, and rotate any passwords stored by the application.
- Watch the vendor site and the linked reports for a patch, and re-scan once you change the code.
Why it matters
This is the classic SQL injection weakness. The code takes the value of stud_id and builds a database command out of it without keeping data and command apart. The record maps it to CWE-74 (injection), CWE-89 (SQL injection). When that happens, a request can change what the database is asked to do, which puts stored records at risk.
The CVSS vector (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L) shows why the score sits at 7.3. It is reachable over the network, needs no privileges and no user action, and the impact on confidentiality, integrity and availability is rated low to each. The CVE is not on the CISA Known Exploited Vulnerabilities list. The record does say a public exploit exists, which means the barrier to misuse is low even though no attack is confirmed.
Projects like this are often copied into school or hobby deployments and then forgotten, so they stay online for years. Prepared statements fix the whole class, not just this one file.
Try it yourself
Click through it at your own pace, or open it full screen.
Quick check
What is the quickest way to stop this class of bug?
Use prepared statements with bound parameters for every query that includes user input. Escaping by hand is easy to get wrong. Server side validation of type and length is a useful second layer.
Does this CVE appear in the CISA KEV list?
No. The record marks it as not in the Known Exploited Vulnerabilities catalog. It does say a public exploit exists, so treat it as a real risk anyway.
Sources
- Safeguard Gold entry for CVE-2025-14646
- code-projects.org reference
- github.com reference
- vuldb.com reference
- vuldb.com reference
This post is based on the CVE record (published 2025-12-14, source cna@vuldb.com). The reference pages above are the ones the record lists. Check them for any later changes.
Last reviewed: 19 October 2026.
