CVE-2025-13270 is a SQL injection vulnerability in Campcodes School Fees Payment Management System 1.0, specifically in the /ajax.php?action=save_course endpoint. The vulnerability arises from improper handling of the ID parameter, allowing remote attackers with low privileges to manipulate SQL queries. Exploit code has been publicly disclosed. The vulnerability has a medium severity rating with a CVSS score of 6.3.