This vulnerability (CVE-2025-15655) in Mojoomla School Management is classified as CWE-89, indicating improper neutralization of special elements used in SQL commands, commonly known as SQL Injection. The CVSS 3.1 base score is 7.6, reflecting a high severity with network attack vector, low attack complexity, and requiring high privileges but no user interaction. The impact scope is changed (scope: changed), with high confidentiality impact, no integrity impact, and low availability impact. The vulnerability affects versions through 93.2.0, but no patch or official fix has been documented. The vendor has not provided a remediation level or advisory content, and the product is not a cloud service.

An attacker with high privileges can exploit this SQL Injection vulnerability to access or disclose sensitive data (high confidentiality impact). The vulnerability does not affect data integrity but may cause limited availability impact. Since no known exploits are reported in the wild, active exploitation is not confirmed. The lack of an official fix means the vulnerability remains a risk for affected versions.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, organizations should limit high-privilege access to the affected software and monitor for unusual database activity. No vendor advisory or official remediation is currently available.