CVE-2025-11110: Campcodes Online Learning Management System school_year.php sql injection

Published Sep 28, 2025

Updated

A security flaw has been discovered in Campcodes Online Learning Management System 1.0. The impacted element is an unknown function of the file /admin/schoolyear.php. The manipulation of the argument schoolyear results in sql injection. It is possible to launch the attack remotely. The exploit has been released to the public and may be exploited.

Affected Software

2 affected components

Campcodes Online Learning Management System

Campcodes Online Learning Management System=1.0

Event History

Sep 28, 2025

CVE Published

via MITRE·04:02 PM

Data Sourced

via MITRE·04:02 PM

DescriptionSeverityWeakness

Data Sourced

via NVD·04:15 PM

DescriptionSeverityWeaknessAffected Software

Frequently Asked Questions

What is the severity of CVE-2025-11110?

CVE-2025-11110 is considered a critical vulnerability due to its potential for SQL injection, which could allow remote attackers to execute arbitrary SQL queries.

How do I fix CVE-2025-11110?

To fix CVE-2025-11110, ensure proper input validation and parameterized queries to prevent SQL injection in the school_year.php file.

What systems are affected by CVE-2025-11110?

CVE-2025-11110 affects Campcodes Online Learning Management System version 1.0.

What type of vulnerability is CVE-2025-11110?

CVE-2025-11110 is a SQL injection vulnerability that allows attackers to manipulate SQL queries through user input.

Can CVE-2025-11110 be exploited remotely?

Yes, CVE-2025-11110 can be exploited remotely, making it accessible to attackers over the internet.