CVE-2024-54937

A Directory Listing issue was found in Kashipara E-Learning Management System v1.0, which allows remote attackers to access sensitive files and directories via /admin/assets...

CVE-2024-54937

The CVE-2024-54937 entry describes a Directory Listing issue in Kashipara E-Learning Management System v1.0. Affected component: the /admin/assets endpoint. Root cause: directory listing exposure allows remote attackers to access sensitive files and directories, impacting confidentiality. Exploit...

CVE-2024-54936

A Stored Cross-Site Scripting XSS vulnerability was found in /sendmessage.php of Kashipara E-learning Management System v1.0. This vulnerability allows remote attackers to execute arbitrary scripts via the mymessage parameter...

CVE-2024-54936

CVE-2024-54936 affects Kashipara E-learning Management System v1.0. The Stored XSS vulnerability exists in /send_message.php, exploitable via the my_message parameter, potentially enabling arbitrary script execution in a victim’s browser. Affected component: Kashipara E‑learning Management System...

CVE-2024-54929

KASHIPARA E-learning Management System v1.0 is vulnerable to SQL Injection in /admin/deletesubject.php...

CVE-2024-54929

KASHIPARA E-learning Management System v1.0 is affected by an SQL Injection in the /admin/delete_subject.php endpoint. The vulnerability arises from improper handling of input parameters in that admin action, enabling attackers with high privileges (per CVSS: Privileges Required = HIGH) and no us...

CVE-2024-54920

A SQL Injection vulnerability was found in /teachersignup.php of kashipara E-learning Management System v1.0, which allows remote attackers to execute arbitrary SQL command to get unauthorized database access via the firstname, lastname, and classid parameters...

CVE-2024-54919

A Stored Cross Site Scripting XSS was found in /teacheravatar.php of kashipara E-learning Management System v1.0. This vulnerability allows remote attackers to execute arbitrary java script via the filename parameter...

CVE-2024-54919

CVE-2024-54919 affects Kashipara E-learning Management System v1.0, with a Stored Cross-Site Scripting (XSS) in /teacher_avatar.php exploitable via the filename parameter. The root cause is unvalidated/unsanitized user-supplied filename input, enabling an attacker to inject JavaScript that is sto...

CVE-2024-54926

A SQL Injection vulnerability was found in /searchclass.php of kashipara E-learning Management System v1.0, which allows remote attackers to execute arbitrary SQL commands to get unauthorized database access via the schoolyear parameter...

CVE-2024-54933

Kashipara E-learning Management System v1.0 is vulnerable to SQL Injection in /admin/deletecontent.php...

CVE-2024-54935

A Stored Cross-Site Scripting XSS vulnerability was found in /sendmessageteachertostudent.php of kashipara E-learning Management System v1.0. This vulnerability allows remote attackers to execute arbitrary scripts via the mymessage parameter...

CVE-2024-54930

Kashipara E-learning Management System v1.0 is vulnerable to SQL Injection in /admin/deletestudent.php...

CVE-2024-54930

The Kashipara E-learning Management System v1.0 is vulnerable to SQL Injection (CWE-89) within the /admin/delete_student.php endpoint. This vulnerability stems from improper neutralization of special elements used in SQL commands. Exploitation could lead to significant impacts on confidentiality ...

CVE-2024-54935

CVE-2024-54935 describes a Stored Cross-Site Scripting (XSS) in the Kashipara E-learning Management System v1.0. The vulnerability is in /send_message_teacher_to_student.php and is exploitable via the my_message parameter, enabling remote attackers to inject and execute arbitrary scripts. Impact ...

CVE-2024-54933

Kashipara E-learning Management System v1.0 is vulnerable to SQL Injection in the /admin/delete_content.php endpoint. This vulnerability occurs because the application fails to properly neutralize special elements used in SQL commands, potentially allowing an attacker to inject malicious code. Wh...

CVE-2024-54922

A SQL Injection was found in /admin/edituser.php of kashipara E-learning Management System v1.0, which allows remote attackers to execute arbitrary SQL commands to get unauthorized database access via the firstname, lastname, and username parameters...

CVE-2024-54934

Kashipara E-learning Management System v1.0 is vulnerable to SQL Injection in /admin/deleteclass.php...

CVE-2024-54932

Kashipara E-learning Management System v1.0 is vulnerable to SQL Injection in /admin/deletedepartment.php...

CVE-2024-54934

The Kashipara E-learning Management System v1.0 is vulnerable to SQL Injection within the /admin/delete_class.php endpoint. This vulnerability allows an attacker to inject malicious SQL code, potentially leading to unauthorized access or data manipulation. While there is currently no information ...