CVE-2025-12918 is a high-complexity, remotely exploitable vulnerability in yungifez Skuul School Management System up to version 2.6.5. It involves improper control of resource identifiers within the "View Fee Invoice" component, specifically when manipulating the invoice_id argument in /dashboard/fees/fee-invoices/. While the CVSS score is MEDIUM (5.3), the potential impact is high confidentiality. An exploit has been publicly released, but active exploitation is not confirmed, and there is minimal community discussion or media coverage.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
<= 2.6.5CPE matchmatch criteria | cpe:2.3:a:yungifez:skuul:*:*:*:*:*:*:*:* |
CVSS version used by this source: 4.0
CVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
The average CVE in this peer group has 0.0 Twitter, 0.0 Reddit, 0.1 Bluesky, 0.0 Mastodon, and 0.1 GitHub mentions.
No media coverage found for this CVE.
The average CVE in this peer group has 0.1 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.