Vulnerability · Published Nov 10, 2025 · Assigned by VulDB

CVE-2025-12939SourceCodester Interview Management System addCandidate.php sql injection

Medium 6.3

In plain English

A medium-severity SQL injection in Interview Management System from SourceCodester. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 29% of all known vulnerabilities).

Severity (CVSS 3.1)6.3Medium

Exploit odds (30 days)0.4%top 71.2% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

A security flaw has been discovered in SourceCodester Interview Management System up to 1.0. Affected by this issue is some unknown functionality of the file /addCandidate.php. The manipulation of the argument candName results in sql injection. The attack can be launched remotely. The exploit has been released to the public and may be exploited.

Affected products (as reported)

Vendor	Product	Versions
SourceCodester	Interview Management System	1.0

Weakness: CWE-89, CWE-74 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R

References

VDB-331663 | SourceCodester Interview Management System addCandidate.php sql injection vdb-entry, technical-description
VDB-331663 | CTI Indicators (IOB, IOC, TTP, IOA) signature, permissions-required
Submit #682314 | SourceCodester Interview Management System V1.0 Information Disclosure + Input Validation third-party-advisory
https://github.com/puppytgyh/-CVE/issues/10 exploit, issue-tracking
https://www.sourcecodester.com/ product