CVE-2025-14223 MEDIUM

CVE-2025-14223: code-projects Simple Leave Manager request.php sql injection

Vendor Code-Projects

Product Simple Leave Manager

Weakness CWE-89 · SQLi

Published December 8, 2025

Last update January 7, 2026

View on NVD All CVEs

CVSS base score

6.9/10

Attack vector Network

Attack complexity Low

Privileges required None

User interaction None

Confidentiality —

Integrity —

CVSS vector

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P

What the vulnerability does

01Description

A vulnerability has been found in code-projects Simple Leave Manager 1.0. Affected by this vulnerability is an unknown functionality of the file /request.php. Such manipulation of the argument staff_id leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used.

Key dates

02Disclosure timeline

December 8, 2025 CVE published

January 7, 2026 Record updated

External resources

03References

NVD — National Vulnerability Database https://nvd.nist.gov/vuln/detail/CVE-2025-14223 CWE — Common Weakness Enumeration https://cwe.mitre.org/data/definitions/89.html

Related vulnerabilities

04Related CVE

CVE-2025-4908 PHPGurukul Daily Expense Tracker System expense-datewise-reports-detailed.php sql injection CVE-2024-3439 SourceCodester Prison Management System login.php sql injection CVE-2023-45119 Online Examination System v1.0 - Multiple Authenticated SQL Injections (SQLi) CVE-2025-10185 NEX-Forms – Ultimate Forms Plugin for WordPress <= 9.1.6 - Authenticated (Admin+) SQL Injection CVE-2025-22713 WordPress WooCommerce Orders & Customers Exporter plugin <= 5.4 - SQL Injection vulnerability