CVE-2025-25964

CVE-2025-25964: Inyección SQL en School Information Management System v1.0 Introducción En el panorama digital actual, la inyección SQL SQLi sigue siendo una de las vulnerabilidades más comunes y peligrosas encontradas en aplicaciones web. Esta publicación de blog analiza una vulnerabilidad críti...

CVE-2024-33911

The School Management 10.3.4 - Post-Authenticated SQL Injection Exploit Title: The School Management 10.3.4 - Post-Authenticated SQL Injection Date: 29 April, 2024 Exploit Author: Ivan Spiridonov xbz0n Vendor Homepage: https://theschool-management.com Version: 10.3.4 Tested on: Ubuntu 22.04 CVE:...

CVE-2025-46204

Description Unifiedtransform v2.0 is vulnerable to Incorrect Access Control. Any user students and teachers can access and modify course details via the /course/edit/id endpoints. This functionality intended exclusively for administrative use. Exploiting this flaw allows unauthorized manipulation...

CVE-2026-37750

CVE-2026-37750 — School Management System 1.0 - XSS Riflesso Dettagli...

CVE-2026-9767

The The School Management – Education & Learning ERP plugin for WordPress is vulnerable to generic SQL Injection via 'order0dir' Parameter in all versions up to, and including, 5.4 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL...

EUVD-2026-59904

The The School Management – Education & Learning ERP plugin for WordPress is vulnerable to generic SQL Injection via 'order0dir' Parameter in all versions up to, and including, 5.4 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL...

CVE-2026-9767

The The School Management – Education & Learning ERP plugin for WordPress is vulnerable to generic SQL Injection via 'order0dir' Parameter in all versions up to, and including, 5.4 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL...

CVE-2026-9767 The School Management <= 5.4 - Authenticated (Custom+) SQL Injection via 'order[0][dir]' Parameter

The The School Management – Education & Learning ERP plugin for WordPress is vulnerable to generic SQL Injection via 'order0dir' Parameter in all versions up to, and including, 5.4 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL...

CVE-2026-9767

CVE-2026-9767 affects The School Management – Education & Learning ERP plugin for WordPress up to version 5.4. The vulnerability is a generic SQL Injection via the parameter order[0][dir] in multiple AJAX handlers (e.g., wlsm-fetch-staff-classes, wlsm-fetch-notices, wlsm-fetch-subjects, wlsm-fetc...

school-buslocation-sqli-cve

CVE-2026-XXXXX Unauthenticated SQL Injection in School Man...

EUVD-2025-210249

Unauthenticated Insecure Direct Object References IDOR in School Management = 93.1.0 versions...

CVE-2025-15657

Unauthenticated Insecure Direct Object References IDOR in School Management = 93.1.0 versions...

CVE-2025-15657

The CVE CVE-2025-15657 affects the WordPress School Management plugin (versions up to 93.1.0). It is an unauthenticated Insecure Direct Object References (IDOR) vulnerability, where an attacker may access object references without authentication. Metrics indicate a CVSS v3.1 base score of 5.3 (Co...

CVE-2025-15657 WordPress School Management plugin <= 93.1.0 - Insecure Direct Object References (IDOR) vulnerability

Unauthenticated Insecure Direct Object References IDOR in School Management = 93.1.0 versions...

CVE-2025-65136

In manikandan580 School-management-system 1.0, a reflected XSS vulnerability exists in /studentms/admin/contact-us.php via the pagedes POST parameter...

CVE-2025-65135

In manikandan580 School-management-system 1.0, a time-based blind SQL injection vulnerability exists in /studentms/admin/between-date-reprtsdetails.php through the fromdate POST parameter...

CVE-2025-15655

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in Mojoomla School Management allows SQL Injection. This issue affects School Management: from n/a through 93.2.0...

CVE-2025-15656

Incorrect Privilege Assignment vulnerability in Mojoomla School Management allows Privilege Escalation. This issue affects School Management: from n/a through 93.2.0...

CVE-2026-47324

ProjectsAndPrograms school-management-system is vulnerable to Stored Cross‑Site Scripting XSS in multiple attributes of students and teachers objects. An authorized attacker e.g., a teacher or administrator can inject malicious JavaScript that is subsequently executed in other users’ browsers...

EUVD-2026-34094

ProjectsAndPrograms school-management-system uses predictable credentials by generating student's and teacher's passwords solely from the user’s date of birth e.g., 12072000 for 12 July 2000. The application does not require or prompt users to change the password upon first login. This behavior...