CVE-2025-25621

CVE-2025-25621 Unifiedtransform v2.0 ist anfällig für falsche Zugriffskontrolle, die es Lehrern ermöglicht, die Anwesenheit anderer Lehrer über den Endpunkt /courses/teacher/index?teacherid=2&semesterid=1 zu erfassen. Hersteller: Unifiedtransform PoC Schritt 1: Melden Sie sich als Lehrer bei der...

CVE-2025-25615

CVE-2025-25615 Unifiedtransform v2.0 ist anfällig für eine fehlerhafte Zugriffskontrolle, die es Lehrern ermöglicht, die Anwesenheitsliste für alle Klassenabschnitte einzusehen. Hersteller: Unifiedtransform PoC Schritt 1: Melden Sie sich als Lehrer in der Anwendung an. Schritt 2: Navigieren Sie z...

CVE-2024-39250

Template PoC nuclei CVE-2024-39250 O TimeTrax https://etimetrax.com/ da Efrotech http://www.efrotech.com/ é um programa de rastreamento de presença de Recursos Humanos, e encontrei uma vulnerabilidade de injeção SQL não autenticada. É fácil executar o vetor de ataque, então criei um template nucl...

CVE-2023-51802

CVE-2023-51802 Simple Student Attendance System v.1.0 - attendancereport में क्रॉस-साइट स्क्रिप्टिंग XSS कमजोरियाँ विवरण : Simple Student Attendance System v.1.0 में क्रॉस साइट स्क्रिप्टिंग कमजोरी एक दूरस्थ हमलावर को attendancereport घटक में "page" या "classmonth" पैरामीटर में एक क्राफ्टेड पेलोड ...

CVE-2023-51801

CVE-2023-51801 Simple Student Attendance System v.1.0 - ثغرات حقن SQL متعددة - studentform.php و classform.php الوصف :Simple Student Attendance System v.1.0 عرضة لثغرات حقن SQL متعددة يمكن استغلالها من قبل مهاجمين مُصادَقين. توجد هذه الثغرات في studentform.php و classform.php، مما يسمح بتنفيذ أوا...

CVE-2026-15493

A vulnerability was detected in Akpali9 Attendance-Management-System up to 70b91fe38f4195b701a45f0edcd4f42d5f64aeee. This issue affects some unknown processing of the file absent.php. Performing a manipulation of the argument exportdate results in cross site scripting. It is possible to initiate...

EUVD-2026-43215

A vulnerability was detected in Akpali9 Attendance-Management-System up to 70b91fe38f4195b701a45f0edcd4f42d5f64aeee. This issue affects some unknown processing of the file absent.php. Performing a manipulation of the argument exportdate results in cross site scripting. It is possible to initiate...

CVE-2026-15493

The CVE-2026-15493 entry concerns Akpali9 Attendance-Management-System. Vulnerability context: absent.php processing is affected, enabling cross-site scripting via manipulation of the export_date argument. Impact is stated as remote initiation with low to moderate risk indicators depending on the...

CVE-2026-15478

A flaw has been found in IceHRM up to 35.0.1. This impacts an unknown function of the file core/src/Reports/User/Reports/EmployeeAttendanceReport.php of the component UserReport Endpoint. Executing a manipulation of the argument employeeList can lead to sql injection. The attack can be launched...

CVE-2026-15478

IceHRM

CVE-2026-15478 IceHRM UserReport Endpoint EmployeeAttendanceReport.php sql injection

A flaw has been found in IceHRM up to 35.0.1. This impacts an unknown function of the file core/src/Reports/User/Reports/EmployeeAttendanceReport.php of the component UserReport Endpoint. Executing a manipulation of the argument employeeList can lead to sql injection. The attack can be launched...

EUVD-2026-43053

Improperly Controlled Modification of Dynamically-Determined Object Attributes vulnerability in Drupal Flag attendance field allows Object Injection. This issue affects Flag attendance field versions: from 0.0.0 to 1.2...

CVE-2026-55809

Improperly Controlled Modification of Dynamically-Determined Object Attributes vulnerability in Drupal Flag attendance field allows Object Injection. This issue affects Flag attendance field versions: from 0.0.0 to 1.2...

CVE-2026-55809

The CVE-2026-55809 issue affects the Drupal Flag attendance field module, with vulnerable versions 0.0.0 through 1.2. The root cause is improper control of modification of dynamically-determined object attributes, with data stored as PHP-serialized strings. If malicious data is written to the fie...

CVE-2026-55809 Flag attendance field - Critical - PHP object injection - SA-CONTRIB-2026-049

Improperly Controlled Modification of Dynamically-Determined Object Attributes vulnerability in Drupal Flag attendance field allows Object Injection. This issue affects Flag attendance field versions: from 0.0.0 to 1.2...

CVE-2026-45780

Discourse is an open-source discussion platform. Prior to 2026.6.0, 2026.5.1, 2026.4.2, and 2026.1.5, EventSerializer could expose invited group names, sample invitees, and attendance statistics to users who could view the topic but were not entitled to view the private event invitee list. This...

CVE-2026-45780

Discourse is an open-source discussion platform. Prior to 2026.6.0, 2026.5.1, 2026.4.2, and 2026.1.5, EventSerializer could expose invited group names, sample invitees, and attendance statistics to users who could view the topic but were not entitled to view the private event invitee list. This...

CVE-2026-45780 Discourse: Private event sample invitees are serialized to non-invited event viewers

Discourse is an open-source discussion platform. Prior to 2026.6.0, 2026.5.1, 2026.4.2, and 2026.1.5, EventSerializer could expose invited group names, sample invitees, and attendance statistics to users who could view the topic but were not entitled to view the private event invitee list. This...

PT-2026-56994

Name of the Vulnerable Software and Affected Versions Discourse versions prior to 2026.6.0 Discourse versions prior to 2026.5.1 Discourse versions prior to 2026.4.2 Discourse versions prior to 2026.1.5 Description The EventSerializer could expose invited group names, sample invitees, and attendan...

DRUPAL-CONTRIB-2026-049

The Flag attendance field module gives you the ability to add attendance by depending on Flag module. flagattendancefield stores some data as PHP-serialized strings. In some situations, malicious data can be written directly to the field. This can lead to an object injection vulnerability when th...