Vulnerability · Published Apr 13, 2025 · Assigned by VulDB

CVE-2025-3536Tutorials-Website Employee Management System delete-user.php improper authorization

Medium 6.5

In plain English

A medium-severity security flaw in Employee Management System from Tutorials-Website. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.7% (higher than 54% of all known vulnerabilities).

Severity (CVSS 3.1)6.5Medium

Exploit odds (30 days)0.7%top 46.0% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

A vulnerability was found in Tutorials-Website Employee Management System 1.0 and classified as critical. Affected by this issue is some unknown functionality of the file /admin/delete-user.php. The manipulation of the argument ID leads to improper authorization. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

Affected products (as reported)

Vendor	Product	Versions
Tutorials-Website	Employee Management System	1.0

Weakness: CWE-285, CWE-266 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L

References

VDB-304574 | Tutorials-Website Employee Management System delete-user.php improper authorization vdb-entry, technical-description
VDB-304574 | CTI Indicators (IOB, IOC, TTP, IOA) signature, permissions-required
Submit #545810 | Tutorials-website Employee Management System(EMS) 1.0 Insecure Direct Object Reference (IDOR) third-party-advisory
https://www.websecurityinsights.my.id/2025/03/tutorials-website-employee-management.html exploit