CVE-2019-1010028

phpscriptsmall.com School College Portal with ERP Script 2.6.1 and earlier is affected by: Cross Site Scripting XSS. The impact is: Attack administrators and teachers, students and more. The component is: /pro-school/index.php?student/message/sendreply/. The attack vector is:...

Cross site scripting

phpscriptsmall.com School College Portal with ERP Script 2.6.1 and earlier is affected by: Cross Site Scripting XSS. The impact is: Attack administrators and teachers, students and more. The component is: /pro-school/index.php?student/message/sendreply/. The attack vector is:...

CVE-2019-1010028

phpscriptsmall.com School College Portal with ERP Script 2.6.1 and earlier is affected by: Cross Site Scripting XSS. The impact is: Attack administrators and teachers, students and more. The component is: /pro-school/index.php?student/message/sendreply/. The attack vector is:...

CVE-2019-1010028

CVE-2019-1010028 affects phpscriptsmall.com School College Portal with ERP Script 2.6.1 and earlier. The vulnerability is a Cross Site Scripting (XSS) issue in the component /pro-school/index.php?student/message/send_reply/ . The attack vector shown is a crafted image tag payload, e.g. . Affected...

PT-2019-11442

Name of the Vulnerable Software and Affected Versions: phpscriptsmall.com School College Portal with ERP Script versions 2.6.1 and earlier Description: The issue allows attackers to target administrators, teachers, and students. It involves a Cross Site Scripting XSS attack, which can be executed...

CVE-2019-1010028: Improper Neutralization of Input During Web Page Generation

phpscriptsmall.com School College Portal with ERP Script 2.6.1 and earlier is affected by: Cross Site Scripting XSS. The impact is: Attack administrators and teachers, students and more. The component is: /pro-school/index.php?student/message/sendreply/. The attack vector is:...

CVE-2019-0325

SAP ERP HCM SAPHRCES , version 3, does not perform necessary authorization checks for a report that reads payroll data of employees in a certain area. Due to this under certain conditions, the user that once had authorization to payroll data of an employee, which was later revoked, may retain...

Authorization

SAP ERP HCM SAPHRCES , version 3, does not perform necessary authorization checks for a report that reads payroll data of employees in a certain area. Due to this under certain conditions, the user that once had authorization to payroll data of an employee, which was later revoked, may retain...

CVE-2019-0325

SAP ERP HCM SAPHRCES , version 3, does not perform necessary authorization checks for a report that reads payroll data of employees in a certain area. Due to this under certain conditions, the user that once had authorization to payroll data of an employee, which was later revoked, may retain...

CVE-2019-0325

CVE-2019-0325 affects SAP ERP HCM (SAP_HRCES) v3.0. The vulnerability arises from missing authorization checks on a payroll-data report, allowing a user who once had payroll data access to retain access after revocation under certain conditions. Impact stated: potential unauthorized reading of pa...

CVE-2019-0325: Missing Authorization

SAP ERP HCM SAPHRCES , version 3, does not perform necessary authorization checks for a report that reads payroll data of employees in a certain area. Due to this under certain conditions, the user that once had authorization to payroll data of an employee, which was later revoked, may retain...

SAP ERP HCM CVE-2019-0325 Remote Authorization Bypass Vulnerability

Description SAP ERP HCM Basis is prone to an authorization-bypass vulnerability. Attackers can exploit this issue to gain unauthorized access and obtain sensitive information. This may aid in further attacks. Technologies Affected SAP ERP HCM 3.0 Recommendations Block external access at the netwo...

PT-2019-4585

Name of the Vulnerable Software and Affected Versions SAP ERP HCM SAP HRCES version 3 Description The issue arises from insufficient authorization checks in a report that reads payroll data of employees in a certain area. This can lead to a situation where a user who once had authorization to...

Odoo Access Control Error Vulnerability (CNVD-2019-30601)

Odoo is an Enterprise Resource Planning ERP and Customer Relationship Management CRM system from Odoo Belgium. The system is developed in Python language with PostgreSQL as database and includes modules for sales management, inventory management, financial management and so on. An access control...

CVE-2019-13294

AROX School-ERP Pro has a command execution vulnerability. importstud.php and uploadfille.php do not have session control. Therefore an unauthenticated user can execute a command on the system...

CVE-2019-13294

AROX School-ERP Pro has a command execution vulnerability. importstud.php and uploadfille.php do not have session control. Therefore an unauthenticated user can execute a command on the system...

CVE-2019-13294

Technical specifics (affected version, root cause, patch, or exploitation details) are not provided in the supplied documents; monitor for official updates from Red Hat, NVD, and CVE records.

CVE-2019-13294: Improper Authentication

AROX School-ERP Pro has a command execution vulnerability. importstud.php and uploadfille.php do not have session control. Therefore an unauthenticated user can execute a command on the system...

PT-2019-13244

Name of the Vulnerable Software and Affected Versions AROX School-ERP Pro affected versions not specified Description The issue concerns a command execution vulnerability. Specifically, the import stud.php and upload file.php files lack session control, allowing an unauthenticated user to execute...

AROX School-ERP Pro - Unauthenticated Remote Command Execution Exploit

This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule "AROX School-ERP Pro Unauthenticated Remote Code Execution", 'Description' = %q This module exploits a command execution vulnerability in AROX...