Kashipara E-learning Management System 安全漏洞

Kashipara E-learning Management System is a learning management system from Kashipara. A security vulnerability exists in Kashipara E-learning Management System v1.0, which stems from an SQL injection vulnerability in /admin/deletedepartment.php...

CVE-2024-54938

A Directory Listing issue was found in Kashipara E-Learning Management System v1.0, which allows remote attackers to access sensitive files and directories via /admin/uploads...

CVE-2024-54929: Improper Neutralization of Special Elements used in an SQL Command

KASHIPARA E-learning Management System v1.0 is vulnerable to SQL Injection in /admin/deletesubject.php...

CVE-2024-54935

A Stored Cross-Site Scripting XSS vulnerability was found in /sendmessageteachertostudent.php of kashipara E-learning Management System v1.0. This vulnerability allows remote attackers to execute arbitrary scripts via the mymessage parameter...

CVE-2024-54933

Kashipara E-learning Management System v1.0 is vulnerable to SQL Injection in the /admin/delete_content.php endpoint. This vulnerability occurs because the application fails to properly neutralize special elements used in SQL commands, potentially allowing an attacker to inject malicious code. Wh...

CVE-2024-54938

A Directory Listing issue was identified in Kashipara E-Learning Management System v1.0 . This vulnerability allows remote attackers to access sensitive files and directories by interacting with the /admin/uploads API endpoint. The impact includes unauthorized viewing of important files. While no...

CVE-2024-54923: Improper Neutralization of Special Elements used in an SQL Command

A SQL Injection vulnerability was found in /admin/editteacher.php in kashipara E-learning Management System v1.0, which allows remote attackers to execute arbitrary SQL commands to get unauthorized database access via the department parameter...

CVE-2024-54918

Kashipara E-learning Management System v1.0 is vulnerable to Remote Code Execution (RCE) due to an unrestricted file upload vulnerability in the /teacher_avatar.php endpoint. An attacker can exploit this flaw by uploading arbitrary files to execute malicious code on the target system. No patch is...

PT-2024-36456 · Unknown · Kashipara E-Learning Management System

Name of the Vulnerable Software and Affected Versions: Kashipara E-Learning Management System version 1.0 Description: A Directory Listing issue was found in Kashipara E-Learning Management System, which allows remote attackers to access sensitive files and directories via the "/admin/uploads" AP...

CVE-2024-54918: Unrestricted Upload of File with Dangerous Type

Kashipara E-learning Management System v1.0 is vulnerable to Remote Code Execution via File Upload in /teacheravatar.php...

CVE-2024-54922

A SQL Injection vulnerability exists in the kashipara E-learning Management System v1.0 within the /admin/edit_user.php file. Remote attackers can exploit the firstname, lastname, and username parameters to execute arbitrary SQL commands, leading to unauthorized database access and the exposure o...

CVE-2024-54919

A Stored Cross Site Scripting XSS was found in /teacheravatar.php of kashipara E-learning Management System v1.0. This vulnerability allows remote attackers to execute arbitrary java script via the filename parameter...

CVE-2024-54926

A SQL Injection vulnerability exists in the kashipara E-learning Management System v1.0 within the /search_class.php file. The root cause is the improper neutralization of special elements used in an SQL command via the school_year parameter. This allows remote attackers to execute arbitrary SQL ...

CVE-2024-54925

The kashipara E-learning Management System v1.0 is vulnerable to a SQL Injection flaw within the /remove_sent_message.php file. This vulnerability is caused by improper neutralization of special elements in the id parameter, which allows remote attackers to execute arbitrary SQL commands. Success...

CVE-2024-54931

A SQL Injection was found in /admin/deleteevent.php in kashipara E-learning Management System v1.0, which allows remote attackers to execute arbitrary SQL commands to get unauthorized database access via the id parameter...

CVE-2024-54918

Kashipara E-learning Management System v1.0 is vulnerable to Remote Code Execution via File Upload in /teacheravatar.php...

CVE-2024-54928

kashipara E-learning Management System v1.0 is vulnerable to SQL Injection in /admin/deleteteacher.php,...

CVE-2024-54918

Kashipara E-learning Management System v1.0 is vulnerable to Remote Code Execution via File Upload in /teacheravatar.php...

CVE-2024-54926: Improper Neutralization of Special Elements used in an SQL Command

A SQL Injection vulnerability was found in /searchclass.php of kashipara E-learning Management System v1.0, which allows remote attackers to execute arbitrary SQL commands to get unauthorized database access via the schoolyear parameter...

CVE-2024-54920: Improper Neutralization of Special Elements used in an SQL Command

A SQL Injection vulnerability was found in /teachersignup.php of kashipara E-learning Management System v1.0, which allows remote attackers to execute arbitrary SQL command to get unauthorized database access via the firstname, lastname, and classid parameters...