CVE-2025-13564
SourceCodester Pre-School Management System FilehelperController.php removefile denial of service
- State
- Published
- Severity
- 5.3 Medium
- Published
- Nov 23, 2025
- Updated
- Nov 24, 2025
- Reserved
- Nov 22, 2025
Description
A security flaw has been discovered in SourceCodester Pre-School Management System 1.0. Impacted is the function removefile of the file app/controllers/FilehelperController.php. Performing manipulation of the argument filepath results in denial of service. The attack is possible to be carried out remotely. The exploit has been released to the public and may be exploited.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 4.0 | 5.3 Medium | CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:P | VulDB |
| 3.1 | 5.4 Medium | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L/E:P/RL:X/RC:R | VulDB |
| 3.0 | 5.4 Medium | CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L/E:P/RL:X/RC:R | VulDB |
| 2.0 | 5.5 Medium | AV:N/AC:L/Au:S/C:N/I:P/A:P/E:POC/RL:ND/RC:UR | VulDB |
Weaknesses
- CWE-404 Denial of Service
Affected Products
| Product | Versions |
|---|---|
Pre-School Management SystemSourceCodester |
|
References
- VDB-333328 | SourceCodester Pre-School Management System FilehelperController.php removefile denial of servicevdb-entrytechnical-description
- VDB-333328 | CTI Indicators (IOB, IOC, TTP, IOA)signaturepermissions-required
- Submit #697083 | Pre-School Management System 1.0 delete filethird-party-advisory
- https://github.com/0xffaaa/cve/blob/main/Pre_School_Management_System_Arbitrary_File_Deletion_Vulnerabilit.mdexploit
- https://www.sourcecodester.com/product
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.