Unifiedtransform 安全漏洞

Unifiedtransform is an open source school management software by Hasib Mahmud Individual Developer. A security vulnerability exists in Unifiedtransform version v2.0, which stems from the /course/edit/id endpoint vulnerability and could lead to remote elevation of privilege...

Unifiedtransform 安全漏洞

Unifiedtransform is an open source school management software by Hasib Mahmud Individual Developer. A security vulnerability exists in Unifiedtransform version v2.0, which stems from the /students/edit/id endpoint vulnerability and could lead to remote elevation of privilege...

CVE-2025-46203

CVE-2025-46203 – Unifiedtransform (v2.0) : The issue stems from incorrect access control on the /students/edit/{id} endpoint, allowing remote users (students/teachers) to escalate privileges and modify other students’ records. Concrete details across connected sources confirm the vulnerable compo...

📄 Unifiedtransform 2.x Student Editor Missing Authorization

Unifiedtransform version 2.x allows any user to access and modify student records via the /students/edit/id endpoints. Description Unifiedtransform v2.X is vulnerable to Incorrect Access Control. Any user students and teachers can access and modify student records via the /students/edit/id...

📄 Unifiedtransform 2.x Course Editor Missing Authorization

Unifiedtransform version 2.x allows any user to access and modify course records via the /course/edit/id endpoints. Description Unifiedtransform v2.X is vulnerable to Incorrect Access Control. Any user students and teachers can access and modify course details via the /course/edit/id endpoints...

Hope-Boot 安全漏洞

Hope-Boot is a modern scaffolding project by the individual developer java-aodeng. A security vulnerability exists in Hope-Boot v1.0.0, which stems from improper access control in the component /user/edit/ and could lead to bypassing authentication...

Cross-site Scripting (XSS)

Overview Affected versions of this package are vulnerable to Cross-site Scripting XSS through the article name field in plugins/content/pages/content.php, accessible over the content/edit endpoint. An attacker can steal cookies and perform session hijacking by injecting malicious scripts. Details...

PT-2025-4117 · Zenvia · Zenvia Movidesk

Name of the Vulnerable Software and Affected Versions: Zenvia Movidesk versions prior to 25.01.22.245a473c54 Description: A problematic issue was found in Zenvia Movidesk, affecting some unknown functionality of the file /Account/EditProfile of the component Profile Editing. The manipulation of t...

PT-2025-3404 · 07Flycms · 07Flycms

Name of the Vulnerable Software and Affected Versions: 07FLYCMS version 1.3.9 Description: A Cross-Site Request Forgery CSRF issue was discovered in 07FLYCMS. The issue occurs via the "/erp.07fly.net:80/oa/OaTask/edit.html" API endpoint. Recommendations: For version 1.3.9, as a temporary...

PT-2025-3197 · Librenms · Librenms

Name of the Vulnerable Software and Affected Versions: Librenms versions up to 24.11.0 Description: The issue concerns a stored XSS vulnerability in the parameters of the /device/$DEVICE ID/edit endpoint, specifically the display parameter. This allows remote attackers to inject malicious scripts...

PT-2024-36441 · Unknown · Kashipara E-Learning Management System

Name of the Vulnerable Software and Affected Versions: Kashipara E-learning Management System version 1.0 Description: A SQL injection issue was found in the /admin/edit teacher.php endpoint, allowing remote attackers to execute arbitrary SQL commands and gain unauthorized access to the database...

PT-2024-35437 · Dcme-320 +3 · Dcme-320 +3

Name of the Vulnerable Software and Affected Versions: DCME-320 versions 7.4.12.90 and earlier DCME-520 versions 9.25.5.11 and earlier DCME-320-L versions 9.3.5.26 and earlier DCME-720 versions 9.1.5.11 and earlier Description: The issue allows for Remote Code Execution via the...

PT-2024-34433 · Unknown · Kashipara E-Learning Management System Project

Name of the Vulnerable Software and Affected Versions: KASHIPARA E-learning Management System Project version 1.0 Description: A SQL Injection issue was found in the /admin/edit student.php endpoint via the cys, un, ln, fn, and id parameters. This allows for potential unauthorized access to...

PT-2024-16306 · Linzhaoguan · Linzhaoguan Pb-Cms

Name of the Vulnerable Software and Affected Versions: LinZhaoguan pb-cms versions up to 2.0.1 Description: A problematic issue has been found in the Edit Article Handler component, affecting the processing of the file "/adminarticle/edit?id=2". This leads to cross-site scripting, and the attack...

PT-2024-29020 · Netbox · Netbox

Name of the Vulnerable Software and Affected Versions: netbox version 4.0.3 Description: A cross-site scripting XSS issue allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the circuit ID parameter at "/circuits/circuits/id/edit/" API endpoint...

PT-2024-29008 · Netbox · Netbox

Name of the Vulnerable Software and Affected Versions: netbox version 4.0.3 Description: A cross-site scripting XSS issue allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Name parameter at "/dcim/interfaces/id/edit/". Recommendations: For netbox...

CVE-2024-39027

SeaCMS v12.9 has an unauthorized SQL injection vulnerability. The vulnerability is caused by the SQL injection through the cid parameter at /js/player/dmplayer/dmku/index.php?ac=edit, which can cause sensitive database information to be leaked...

PT-2024-23101 · Unknown · Sentrifugo

Name of the Vulnerable Software and Affected Versions: Sentrifugo version 3.2 Description: A Cross-Site Scripting XSS issue exists, allowing a remote user to send a specially crafted URL to the victim and steal their session data. This is achieved through the...

PT-2024-22514 · Dedecms · Dedecms

Name of the Vulnerable Software and Affected Versions: DedeCMS version 5.7 Description: A Cross-Site Request Forgery CSRF issue was found in DedeCMS. The issue is related to the "/dede/media edit.php" endpoint. Recommendations: For DedeCMS version 5.7, as a temporary workaround, consider...

PT-2024-22523 · Dedecms · Dedecms

Name of the Vulnerable Software and Affected Versions: DedeCMS version 5.7 Description: A Cross-Site Request Forgery CSRF issue was discovered in DedeCMS. The issue is related to the "/dede/plus edit.php" API endpoint. Recommendations: For DedeCMS version 5.7, as a temporary workaround, consider...