CVE-2025-52410

Critical · 9.8

CVSS

9.8

EPSS

0.3%

Published

Nov 20, 2025

CISA due date

—

The record

Institute-of-Current-Students v1.0 contains a time-based blind SQL injection vulnerability in the mydetailsstudent.php endpoint. The `myds` GET parameter is not adequately sanitized before being used in SQL queries.

Affected packages

Ecosystem	Package	Introduced	Fixed