CVE-2025-2351

Summary

CVE-2025-2351 is a newly disclosed critical vulnerability affecting the DayCloud StudentManage 1.0 system. The issue lies in the unknown code of the /admin/adminScoreUrl component's Login Endpoint. An attacker can exploit this SQL injection vulnerability by manipulating query arguments remotely. Since continuous delivery with rolling releases is used by this product, the exact versions with the vulnerability and the patches are not yet known. The vendor has been contacted about this disclosure but has not responded. Public exploits for the vulnerability are currently available, increasing the risk for potential attacks.

Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.