CVE-2025-25964

CVE-2025-25964: School Information Management System v1.0 における SQL インジェクション はじめに 今日のデジタル環境において、SQL インジェクション（SQLi）は、Web アプリケーションで見られる最も一般的かつ危険な脆弱性の 1 つであり続けています。このブログ記事では、Itsourcecode によって開発された School Information Management System v1.0 で発見された、重大な SQL...

CVE-2026-37750

CVE-2026-37750 — School Management System 1.0 - 反射型XSS 詳細...

CVE-2026-86268

A vulnerability was detected in itsourcecode School Management System 1.0. Impacted is an unknown function of the file UserLogin.php. The manipulation of the argument email results in sql injection. The attack can be executed remotely. The exploit is now public and may be used...

CVE-2026-86268 itsourcecode School Management System User_Login.php sql injection

A vulnerability was detected in itsourcecode School Management System 1.0. Impacted is an unknown function of the file UserLogin.php. The manipulation of the argument email results in sql injection. The attack can be executed remotely. The exploit is now public and may be used...

CVE-2026-86268

A SQL injection vulnerability exists in itsourcecode School Management System 1.0 , specifically in the file User_Login.php where manipulation of the email argument allows a remote attacker to inject SQL queries without authentication. The vulnerability is rated HIGH (CVSS 3.1: 7.3) with low impa...

CVE-2026-86268 itsourcecode School Management System User_Login.php sql injection

A vulnerability was detected in itsourcecode School Management System 1.0. Impacted is an unknown function of the file UserLogin.php. The manipulation of the argument email results in sql injection. The attack can be executed remotely. The exploit is now public and may be used...

EUVD-2026-72244

A vulnerability was detected in itsourcecode School Management System 1.0. Impacted is an unknown function of the file UserLogin.php. The manipulation of the argument email results in sql injection. The attack can be executed remotely. The exploit is now public and may be used...

PT-2026-86624

A vulnerability was detected in itsourcecode School Management System 1.0. Impacted is an unknown function of the file User Login.php. The manipulation of the argument email results in sql injection. The attack can be executed remotely. The exploit is now public and may be used...

CVE-2026-86268: Improper Neutralization of Special Elements used in an SQL Command

A vulnerability was detected in itsourcecode School Management System 1.0. Impacted is an unknown function of the file UserLogin.php. The manipulation of the argument email results in sql injection. The attack can be executed remotely. The exploit is now public and may be used...

school-buslocation-sqli-cve

CVE-2026-XXXXX Unauthenticated SQL Injection in School Man...

CVE-2025-65136

In manikandan580 School-management-system 1.0, a reflected XSS vulnerability exists in /studentms/admin/contact-us.php via the pagedes POST parameter...

CVE-2025-65135

In manikandan580 School-management-system 1.0, a time-based blind SQL injection vulnerability exists in /studentms/admin/between-date-reprtsdetails.php through the fromdate POST parameter...

CVE-2026-47324

ProjectsAndPrograms school-management-system is vulnerable to Stored Cross‑Site Scripting XSS in multiple attributes of students and teachers objects. An authorized attacker e.g., a teacher or administrator can inject malicious JavaScript that is subsequently executed in other users’ browsers...

CVE-2026-47325 Weak password policy in ProjectsAndPrograms school-management-system

ProjectsAndPrograms school-management-system uses predictable credentials by generating student's and teacher's passwords solely from the user’s date of birth e.g., 12072000 for 12 July 2000. The application does not require or prompt users to change the password upon first login. This behavior...

EUVD-2026-34094

ProjectsAndPrograms school-management-system uses predictable credentials by generating student's and teacher's passwords solely from the user’s date of birth e.g., 12072000 for 12 July 2000. The application does not require or prompt users to change the password upon first login. This behavior...

CVE-2026-47324

ProjectsAndPrograms school-management-system is vulnerable to Stored XSS in multiple attributes of student and teacher objects. An authorized attacker (e.g., a teacher or administrator) can inject malicious JavaScript that executes in other users’ browsers. When chained with CVE-2025-11661 (unaut...

CVE-2026-47324 Stored XSS in Multiple Points in ProjectsAndPrograms school-management-system

ProjectsAndPrograms school-management-system is vulnerable to Stored Cross‑Site Scripting XSS in multiple attributes of students and teachers objects. An authorized attacker e.g., a teacher or administrator can inject malicious JavaScript that is subsequently executed in other users’ browsers...

EUVD-2026-34093

ProjectsAndPrograms school-management-system is vulnerable to Stored Cross‑Site Scripting XSS in multiple attributes of students and teachers objects. An authorized attacker e.g., a teacher or administrator can inject malicious JavaScript that is subsequently executed in other users’ browsers...

CVE-2026-47324

ProjectsAndPrograms school-management-system is vulnerable to Stored Cross‑Site Scripting XSS in multiple attributes of students and teachers objects. An authorized attacker e.g., a teacher or administrator can inject malicious JavaScript that is subsequently executed in other users’ browsers...

school-management-system 安全漏洞

School-Management-System is a PHP-based school management system developed by Shubham Kumar, an individual developer. The School-Management-System has a security vulnerability, which stems from the use of predictable password generation methods. This vulnerability may allow attackers to easily...