CVE-2025-13564

MEDIUM

Kimz190 Pre-school Management System - Improper Resource Release

Title source: rule

Description

A security flaw has been discovered in SourceCodester Pre-School Management System 1.0. Impacted is the function removefile of the file app/controllers/FilehelperController.php. Performing manipulation of the argument filepath results in denial of service. The attack is possible to be carried out remotely. The exploit has been released to the public and may be exploited.

References (5)

[Third Party Advisory, VDB Entry] https://vuldb.com/?id.333328

[Permissions Required, VDB Entry] https://vuldb.com/?ctiid.333328

[Third Party Advisory, VDB Entry] https://vuldb.com/?submit.697083

[Exploit, Issue Tracking, Third Party Advisory] https://github.com/0xffaaa/cve/blob/main/Pre_School_Management_System_Arbitrary_File_Deletion_Vulnerabilit.md

View Exploit ZIP pw:eip

[Product] https://www.sourcecodester.com/

Scores

CVSS v3 5.4

EPSS 0.0008

EPSS Percentile 22.3%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L

CISA SSVC

Vulnrichment

Exploitation poc

Automatable no

Technical Impact partial

Details

CWE

CWE-404

Status published

Products (1)

kimz190/pre-school_management_system 1.0

Published Nov 23, 2025

Tracked Since Feb 18, 2026