CVE-2025-15655 is an SQL Injection vulnerability (CWE-89) in Mojoomla School Management software versions up to 93.2.0. The vulnerability allows an attacker with high privileges to inject malicious SQL commands due to improper neutralization of special elements in SQL queries. The CVSS 3.1 base score is 7.6, reflecting network attack vector, low attack complexity, required high privileges, no user interaction, and a scope change. The impact includes high confidentiality loss and low availability impact, with no integrity impact. There is no vendor advisory or patch available at this time.

An attacker with high privileges can exploit this vulnerability remotely to execute unauthorized SQL commands, potentially leading to disclosure of sensitive information (high confidentiality impact) and partial disruption of service (low availability impact). Integrity of data is not impacted according to the CVSS vector. No known exploits are reported in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict high privilege access to trusted users only and monitor for suspicious activity related to SQL queries. Avoid exposing vulnerable interfaces to untrusted networks if possible.