CVE-2024-33402

A SQL injection vulnerability in /model/approvepettycash.php in campcodes Complete Web-Based School Management System 1.0 allows attacker to execute arbitrary SQL commands via the id parameter...

CVE-2024-33802

A SQL injection vulnerability in /model/getstudentsubject.php in campcodes Complete Web-Based School Management System 1.0 allows an attacker to execute arbitrary SQL commands via the index parameter...

CVE-2024-6268

A vulnerability, which was classified as critical, has been found in lahirudanushka School Management System 1.0.0/1.0.1. Affected by this issue is some unknown functionality of the file login.php of the component Login Page. The manipulation of the argument email leads to sql injection. The atta...

CVE-2024-12470

The School Management System – SakolaWP plugin for WordPress is vulnerable to privilege escalation in all versions up to, and including, 1.0.8. This is due to the registration function not properly limiting what roles a user can register as. This makes it possible for unauthenticated attackers to...

CVE-2024-12470

CVE-2024-12470 affects the WordPress plugin School Management System – SakolaWP (SakolaWP-lite) up to version 1.0.8. Root cause: the registration function does not correctly restrict allowable user roles, enabling an unauthenticated attacker to register as an administrator. Impact: administrator ...

CVE-2024-9659

The School Management System for Wordpress plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the mjsmgtuseravatarimageupload function in all versions up to, and including, 91.5.0. This makes it possible for unauthenticated attackers to upload...

CVE-2024-9659

The School Management System for Wordpress plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the mjsmgtuseravatarimageupload function in all versions up to, and including, 91.5.0. This makes it possible for unauthenticated attackers to upload...

CVE-2024-9659

CVE-2024-9659 affects School Management System for WordPress (WordPress plugin) up to version 91.5.0, where missing file type validation in mj_smgt_user_avatar_image_upload() allows unauthenticated arbitrary file uploads. The impact is described as potentially enabling remote code execution on th...

CVE-2024-9660 School Management <= 91.5.0 - Authenticated (Student+) Arbitrary File Upload

The School Management System for Wordpress plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the mjsmgtloaddocumetsnew and mjsmgtloaddocumets functions in all versions up to, and including, 91.5.0. This makes it possible for authenticated attacker...

CVE-2024-9660

CVE-2024-9660 (School Management System for Wordpress) The WordPress plugin versions up to 91.5.0 are vulnerable to arbitrary file uploads due to missing file-type validation in mj_smgt_load_documets_new() and mj_smgt_load_documets(), enabling authenticated users with Student-level access and abo...

CVE-2024-9660 School Management <= 91.5.0 - Authenticated (Student+) Arbitrary File Upload

The School Management System for Wordpress plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the mjsmgtloaddocumetsnew and mjsmgtloaddocumets functions in all versions up to, and including, 91.5.0. This makes it possible for authenticated attacker...

PT-2024-39747 · WordPress · School Management System

Name of the Vulnerable Software and Affected Versions: The School Management System for Wordpress plugin for WordPress versions up to, and including, 91.5.0 Description: The issue is related to arbitrary file uploads due to missing file type validation in the mj smgt load documets new and mj smgt...

WordPress plugin School Management System 代码问题漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed in the PHP language. WordPress plugin is an application plugin that supports personal blog sites on PHP and MySQL servers. A code issue vulnerability exists in WordPress plugin...

WordPress plugin School Management System 代码问题漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed in the PHP language. WordPress plugin is an application plugin that supports personal blog sites on PHP and MySQL servers. A code issue vulnerability exists in WordPress plugin...

PT-2024-39746 · WordPress · School Management System

Name of the Vulnerable Software and Affected Versions: School Management System for Wordpress plugin for WordPress versions up to, and including, 91.5.0 Description: The issue arises from missing file type validation in the mj smgt user avatar image upload function, allowing unauthenticated...

CVE-2024-9637 School Management System – WPSchoolPress <= 2.2.10 - Insecure Direct Object Reference to Authenticated (Teacher+) Account Takeover/Privilege Escalation

The School Management System – WPSchoolPress plugin for WordPress is vulnerable to privilege escalation via account takeover in all versions up to, and including, 2.2.10. This is due to the plugin not properly validating a user's identity prior to updating their details like email. This makes it...

Multi Branch School Management System 3.5 Backup Disclosure

============================================================================================================================================= | Title : Multi Branch School Management System 3.5 Backup Disclosure Vulnerability | | Author : indoushka | | Tested on : windows 10 FrPro / browser :...

CVE-2024-8784

A vulnerability classified as critical was found in QDocs Smart School Management System 7.0.0. Affected by this vulnerability is an unknown functionality of the file /user/chat/mynewuser of the component Chat. The manipulation of the argument users with the input...

CVE-2024-8784 QDocs Smart School Management System Chat mynewuser sql injection

A vulnerability classified as critical was found in QDocs Smart School Management System 7.0.0. Affected by this vulnerability is an unknown functionality of the file /user/chat/mynewuser of the component Chat. The manipulation of the argument users with the input...

CVE-2024-8784

CVE-2024-8784 affects QDocs Smart School Management System 7.0.0, specifically the Chat component at /user/chat/mynewuser. The vulnerability arises from manipulation of the POST parameter users[] that leads to SQL injection (exploitation described as remote). Publicly disclosed exploit exists; im...