7 matches found
CVE-2026-35678
Informe de Investigación de Vulnerabilidad: Referencia Directa a Objetos Insegura IDOR en Todo Eduplus Student ERP Investigador: Vinay Sharma 1. Resumen Ejecutivo Este informe detalla una vulnerabilidad de seguridad de alta severidad identificada en la plataforma Eduplus Student ERP,...
PT-2026-55780
Name of the Vulnerable Software and Affected Versions SourceCodester Class and Exam Timetabling System version 1.0 Description An issue exists in the /edit exam.php file where improper handling of the ID argument allows for SQL injection. This flaw enables a remote attacker to manipulate database...
CVE-2025-25616
The open-source school management software Unifiedtransform version 2.0 is vulnerable to Incorrect Access Control (CWE-284). This flaw allows students to bypass authorization to modify exam rules via the /exams/edit-rule?exam_rule_id=1 endpoint. By manipulating the exam_rule_id parameter, an atta...
PT-2024-26255 · Unknown · Campcodes Complete Web-Based School Management System
Name of the Vulnerable Software and Affected Versions: Campcodes Complete Web-Based School Management System version 1.0 Description: A SQL injection issue allows an attacker to execute arbitrary SQL commands via the name parameter in the "/model/update exam.php" API endpoint. Recommendations: Fo...
The vulnerability of the LearnDash plugin’s interface in the WordPress content management system allows a hacker to gain unauthorized access to protected information.
The vulnerability of the LearnDash plugin’s interface in the WordPress content management system is related to insufficient protection of operational data during the processing of the sfwd-question and ld-exam endpoints. Exploiting this vulnerability can allow an attacker, operating remotely, to...
PT-2023-8521 · WordPress · Learndash Lms
Name of the Vulnerable Software and Affected Versions: LearnDash LMS plugin for WordPress versions up to, and including, 4.10.1 Description: The issue is related to Sensitive Information Exposure, which can be exploited via API, allowing unauthenticated attackers to obtain access to quizzes. The...
