CVE-2023-51801

CVE-2023-51801 Simple Student Attendance System v.1.0 - 다중 SQL 인젝션 취약점 - studentform.php 및 classform.php 설명 : Simple Student Attendance System v.1.0은 인증된 공격자가 악용할 수 있는 다중 SQL 인젝션 취약점에 취약합니다. 이러한 취약점은 studentform.php 및 classform.php에 존재하며, 'id' 매개변수를 통해 임의의 SQL 명령을 실행할 수 있습니다. 취약한 제품 버전 : Simple...

CVE-2023-51802

CVE-2023-51802 Simple Student Attendance System v.1.0 - 출석 보고서의 크로스사이트 스크립팅XSS 취약점 설명 : Simple Student Attendance System v.1.0의 크로스사이트 스크립팅 취약점으로 인해 원격 공격자가 출석 보고서 컴포넌트의 "page" 또는 "classmonth" 매개변수에 조작된 페이로드를 전달하여 임의 코드를 실행할 수 있습니다. 취약한 제품 버전 : Simple Student Attendance System v.1.0 CVE 작성자 :...

CVE-2024-39250

CVE-2024-39250 PoC nuclei 템플릿 Efrotech http://www.efrotech.com/의 TimeTrax https://etimetrax.com/는 인사 출석 추적 프로그램이며, 인증되지 않은 SQL 인젝션 취약점을 발견했습니다. 공격 벡터를 실행하기 쉬워서 nuclei 템플릿을 만들었습니다...

CVE-2025-25621

CVE-2025-25621 Unifiedtransform v2.0은 부적절한 접근 제어 취약점이 존재하여, 교사가 /courses/teacher/index?teacherid=2&semesterid=1 엔드포인트를 통해 동료 교사의 출석을 체크할 수 있습니다. 공급업체: Unifiedtransform PoC Step 1: 교사로 애플리케이션에 로그인합니다. Step 2: 엔드포인트 /courses/teacher/index?teacherid=2&semesterid=1로 이동합니다 Teacher ID 변경 가능. Step 3: "출...

CVE-2025-25615

CVE-2025-25615 Unifiedtransform v2.0에는 부적절한 접근 제어Incorrect Access Control 취약점이 존재하며, 이를 통해 교사가 모든 학급 섹션의 출석부를 볼 수 있습니다. 공급업체: Unifiedtransform PoC 1단계: 교사Teacher 계정으로 애플리케이션에 로그인합니다. 2단계: 다음 엔드포인트로 이동합니다: /attendances/view?classid=1&sectionid=2&courseid=1 classid 및 sectionid 매개변수를 수정하여 다른 섹션에 접근할...

CVE-2026-94048

A vulnerability was detected in CodeAstro QR Code Attendance Management System 1.0. This affects the function Save of the file app/Controllers/UserController.php. The manipulation of the argument roleid results in improper privilege management. The attack can be executed remotely. The exploit is...

CVE-2026-94048

CodeAstro QR Code Attendance Management System 1.0 is affected by an improper privilege management vulnerability in the Save function of app/Controllers/UserController.php. Manipulation of the role_id argument allows a remote, authenticated user with high privileges to escalate access, with a sco...

CVE-2026-94048 CodeAstro QR Code Attendance Management System UserController.php save privileges management

A vulnerability was detected in CodeAstro QR Code Attendance Management System 1.0. This affects the function Save of the file app/Controllers/UserController.php. The manipulation of the argument roleid results in improper privilege management. The attack can be executed remotely. The exploit is...

EUVD-2026-83782

A vulnerability was detected in CodeAstro QR Code Attendance Management System 1.0. This affects the function Save of the file app/Controllers/UserController.php. The manipulation of the argument roleid results in improper privilege management. The attack can be executed remotely. The exploit is...

CVE-2026-37749

CVE-2026-37749 — CodeAstro Simple Attendance Management System 1.0 - SQLインジェクション 詳細...

EUVD-2026-72175

A security flaw has been discovered in Projectwolds Online Attendance System 1.0. Affected by this issue is some unknown functionality of the file profile.php. The manipulation of the argument email results in cross site scripting. The attack may be performed from remote. The exploit has been...

CVE-2026-86226

A security flaw has been discovered in Projectwolds Online Attendance System 1.0. Affected by this issue is some unknown functionality of the file profile.php. The manipulation of the argument email results in cross site scripting. The attack may be performed from remote. The exploit has been...

CVE-2026-86226

Projectwolds Online Attendance System 1.0 contains a cross-site scripting (XSS) vulnerability in the file profile.php , triggered by manipulation of the email argument. The flaw allows a remote attacker with low privileges to inject scripts if a user interacts with the crafted request. The CVSS 3...

CVE-2026-86226 Projectwolds Online Attendance System profile.php cross site scripting

A security flaw has been discovered in Projectwolds Online Attendance System 1.0. Affected by this issue is some unknown functionality of the file profile.php. The manipulation of the argument email results in cross site scripting. The attack may be performed from remote. The exploit has been...

PT-2026-86573

Name of the Vulnerable Software and Affected Versions Projectwolds Online Attendance System version 1.0 Description A remote cross-site scripting issue exists in the profile.php file. The flaw allows for the manipulation of the email variable to execute malicious scripts in the context of the...

CVE-2026-15493

A vulnerability was detected in Akpali9 Attendance-Management-System up to 70b91fe38f4195b701a45f0edcd4f42d5f64aeee. This issue affects some unknown processing of the file absent.php. Performing a manipulation of the argument exportdate results in cross site scripting. It is possible to initiate...

EUVD-2026-43215

A vulnerability was detected in Akpali9 Attendance-Management-System up to 70b91fe38f4195b701a45f0edcd4f42d5f64aeee. This issue affects some unknown processing of the file absent.php. Performing a manipulation of the argument exportdate results in cross site scripting. It is possible to initiate...

CVE-2026-15493

The CVE-2026-15493 entry concerns Akpali9 Attendance-Management-System. Vulnerability context: absent.php processing is affected, enabling cross-site scripting via manipulation of the export_date argument. Impact is stated as remote initiation with low to moderate risk indicators depending on the...

CVE-2026-15493 Akpali9 Attendance-Management-System absent.php cross site scripting

A vulnerability was detected in Akpali9 Attendance-Management-System up to 70b91fe38f4195b701a45f0edcd4f42d5f64aeee. This issue affects some unknown processing of the file absent.php. Performing a manipulation of the argument exportdate results in cross site scripting. It is possible to initiate...

CVE-2026-15478

A flaw has been found in IceHRM up to 35.0.1. This impacts an unknown function of the file core/src/Reports/User/Reports/EmployeeAttendanceReport.php of the component UserReport Endpoint. Executing a manipulation of the argument employeeList can lead to sql injection. The attack can be launched...