CVE-2025-13564
MEDIUMPre-School Management System 1.0 - Denial of Service via Filepath Manipulation in FilehelperController
Title source: llmDescription
A security flaw has been discovered in SourceCodester Pre-School Management System 1.0. Impacted is the function removefile of the file app/controllers/FilehelperController.php. Performing manipulation of the argument filepath results in denial of service. The attack is possible to be carried out remotely. The exploit has been released to the public and may be exploited.
References (5)
Core 5
Core References
Third Party Advisory, VDB Entry vdb-entry
technical-description
https://vuldb.com/?id.333328
Permissions Required, VDB Entry signature
permissions-required
https://vuldb.com/?ctiid.333328
Third Party Advisory, VDB Entry third-party-advisory
https://vuldb.com/?submit.697083
Exploit, Issue Tracking, Third Party Advisory exploit
https://github.com/0xffaaa/cve/blob/main/Pre_School_Management_System_Arbitrary_File_Deletion_Vulnerabilit.md
Product product
https://www.sourcecodester.com/
Scores
CVSS v3
5.4
EPSS
0.0032
EPSS Percentile
23.1%
Attack Vector
NETWORK
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L
CISA SSVC
Vulnrichment
Exploitation
poc
Automatable
no
Technical Impact
partial
Details
CWE
CWE-404
Status
published
Products (1)
kimz190/pre-school_management_system
1.0
Published
Nov 23, 2025
Tracked Since
Feb 18, 2026