Vulnerability · Published Nov 20, 2025 · Assigned by VulDB

CVE-2025-13468SourceCodester Alumni Management System Delete admin_class.php delete_event authorization

Medium 5.4

In plain English

A medium-severity missing authorization in Alumni Management System from SourceCodester. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 35% of all known vulnerabilities).

Severity (CVSS 3.1)5.4Medium

Exploit odds (30 days)0.4%top 64.6% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

A weakness has been identified in SourceCodester Alumni Management System 1.0. This issue affects the function delete_forum/delete_career/delete_comment/delete_gallery/delete_event of the file admin/admin_class.php of the component Delete Handler. Executing manipulation of the argument ID can lead to missing authorization. It is possible to launch the attack remotely. The exploit has been made available to the public and could be exploited.

Affected products (as reported)

Vendor	Product	Versions
SourceCodester	Alumni Management System	1.0

Weakness: CWE-862, CWE-863 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L/E:P/RL:X/RC:R

References

VDB-333041 | SourceCodester Alumni Management System Delete admin_class.php delete_event authorization vdb-entry, technical-description
VDB-333041 | CTI Indicators (IOB, IOC, IOA) signature, permissions-required
Submit #694826 | SourceCodester Alumni Management System 1.0 Missing Authorization third-party-advisory
https://hackmd.io/@mlgzackfly/SourceCodester exploit
https://www.sourcecodester.com/ product