CVE-2025-0849 CampCodes School Management Software Staff edit-staff improper authorization

What is CVE-2025-0849?

CVE-2025-0849 is a medium-severity missing authorization vulnerability in CampCodes School Management Software, published on 30 Jan 2025. Any signed-in user can exploit it over the network, with no action from the victim.

Official description

A vulnerability classified as critical has been found in CampCodes School Management Software 1.0. Affected is an unknown function of the file /edit-staff/ of the component Staff Handler. The manipulation leads to improper authorization. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.

Weakness: CWE-285, CWE-266

Which versions are affected by CVE-2025-0849?

It affects 1 product.

Products include Campcodes School Management Software.

How do I fix CVE-2025-0849?

No fix has been published for CVE-2025-0849 yet. Limit exposure of the affected software until one is available.

Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.

Is CVE-2025-0849 being exploited?

It is not confirmed as exploited in the wild, but public exploit code for CVE-2025-0849 exists.

Other vulnerabilities in CampCodes School Management Software

• CVE-2025-0710 CampCodes School Management Software Notice Board Page notice-list cross site scripting Medium 5.3
• CVE-2025-0581 CampCodes School Management Software Chat History send cross site scripting Medium 5.3
• CVE-2025-1159 CampCodes School Management Software academic-calendar cross site scripting Medium 5.1
• CVE-2025-0559 Campcodes School Management Software Create Id Card Page create-id-card cross site scripting Medium 5.1
• CVE-2025-0560 CampCodes School Management Software Photo Gallery Page photo-gallery cross site scripting Medium 5.1

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-h9p3-57f6-xpmg.