---
cve: "CVE-2025-11116"
severity: "MEDIUM"
cvss: 6.9
epss: "0.5%"
vendor: "code-projects"
kev: false
exploited: false
published: "2025-09-28 19:15:33"
tags: [cve, security, medium]
source: tsecurity.de CVE-Dossier
exported: "2026-10-03T21:14:24+02:00"
---

# CVE-2025-11116

> 6.9 MEDIUM · 🧪 PoC

## Beschreibung

A vulnerability was found in code-projects Simple Scheduling System 1.0. This affects an unknown part of the file /add.home.php. The manipulation of the argument faculty results in sql injection. The attack can be executed remotely. The exploit has been made public and could be used. Other parameters might be affected as well.

## CISA-Anreicherung (vulnrichment/ADP)

- CISA-SSVC (Coordinator, v2.0.3):
  - Exploitation: **poc**
  - Automatable: **yes**
  - Technical Impact: **partial**

## CVSS-Vektor

```
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P
```

| Metrik | Wert | Bewertung |
|---|---|---|
| AV Angriffsvektor | Netzwerk | bad |
| AC Komplexität | Gering | bad |
| PR Privilegien | Keine | bad |
| UI Interaktion | Keine | bad |

## Referenzen

- <https://vuldb.com/?id.326197>
- <https://vuldb.com/?ctiid.326197>
- <https://vuldb.com/?submit.662701>
- <https://github.com/yihaofuweng/cve/issues/42>
- <https://code-projects.org/>

---
_Exportiert aus dem [tsecurity.de CVE-Dossier](https://tsecurity.de/cve?cve=CVE-2025-11116) · Datenquellen: EUVD (ENISA), NVD, OSV, CISA KEV, FIRST EPSS, Exploit-DB, BSI WID (CSAF)_