Product
SourceCodester Student Result Management System 1.0 contains a path traversal vulnerability (CVE-2025-4720) in the drop_student.php endpoint, allowing authenticated attackers to perform arbitrary file deletion via the 'img' parameter.