CVE-2025-13468: oretnom23 alumni_management_system Missing Authorization

Vulnerability summary

CVE-2025-13468 is a high (CVSS 8.1) Missing Authorization vulnerability in oretnom23 alumni_management_system. EPSS estimates a 0.38% chance of exploitation in the next 30 days, higher than 30.2% of scored vulnerabilities. 1 public exploit is recorded.

Timeline

1. 20-11-2025
   PublishedVulnerability first disclosed.
2. 20-11-2025
   Last modifiedVulnerability information updated.

Description

A weakness has been identified in SourceCodester Alumni Management System 1.0. This issue affects the function delete_forum/delete_career/delete_comment/delete_gallery/delete_event of the file admin/admin_class.php of the component Delete Handler. Executing manipulation of the argument ID can lead to missing authorization. It is possible to launch the attack remotely. The exploit has been made available to the public and could be exploited.

• CWE-862Missing AuthorizationThe product does not perform an authorization check when an actor attempts to access a resource or perform an action.
• CWE-863Incorrect AuthorizationThe product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check.