CVE-2020-23935

Kabir Alhasan Student Management System 1.0 is vulnerable to Authentication Bypass via "Username: admin' && Password: Write Something"...

CVE-2020-23935

CVE-2020-23935 affects Kabir Alhasan Student Management System 1.0. An authentication bypass is possible via a crafted login payload, e.g., Username: admin'# and any Password, allowing bypass of the login check through the admin path (process.php). Multiple sources corroborate an SQLi- or bypass-...

CVE-2020-23935: Improper Neutralization of Special Elements used in an SQL Command

Kabir Alhasan Student Management System 1.0 is vulnerable to Authentication Bypass via "Username: admin' && Password: Write Something"...

PT-2020-15601 · Kabir Alhasan · Kabir Alhasan Student Management System

Name of the Vulnerable Software and Affected Versions: Kabir Alhasan Student Management System version 1.0 Description: The issue allows for Authentication Bypass. An attacker can exploit this by using a specific combination of username and password, such as 'admin', to bypass authentication...

Unauthorized Access Vulnerability in the National Student Management Information System for Secondary Vocational Schools

National Secondary Vocational School Student Management Information System is a student information management system. An unauthorized access vulnerability exists in the National Secondary Vocational School Student Management Information System, which can be exploited by an attacker to obtain use...

SQL Injection Vulnerability in the Student Management Service Platform of Beijing Sanyituo Technology Co.

Beijing SANYITO Technology Co., Ltd. is an intelligent and intensive high-tech enterprise specializing in computer software research and development, application and service. There is a SQL injection vulnerability in the student management service platform of Beijing SanYiTuo Technology Co., Ltd,...

FreeSMS 2.1.2 - SQL Injection (Authentication Bypass)

FreeSMS 2.1.2 - SQL Injection Authentication Bypass Exploit Title: FreeSMS 2.1.2 - Authentication Bypass Date: 2019-04-03 Exploit Author: Yilmaz Degirmenci Vendor Homepage: https://freesms.sourceforge.io/ Software Link: https://sourceforge.net/projects/freesms/ Version: v2.1.2 Category: Webapps...

SQL Injection Vulnerability in the Student Management System wjgl_xx.asp Page of Shanxi Huaxing TechSoft Co.

Student Management System is a software application for the daily management of various student information. A SQL injection vulnerability exists in the Student Management System developed by Shanxi Huaxing TechSoft Co. Ltd, which can be exploited by attackers to obtain sensitive information from...

某用户量较大的综合管理系统mssql注射漏洞

简要描述： 大量学生综合系统使用安脉的。 详细说明： 厂商： 上海安脉计算机科技有限公司 http://www.anmai.net/ SQL注射点： /oa/news/updateAffiche.aspx?id=1 其中id参数存在sql注射 互联网自动采集案例5枚： http://zhgl.w25z.cn/ANMAI/oa/news/updateAffiche.aspx?id=1 http://www.jukui.com/ANMAI/oa/news/updateAffiche.aspx?id=1...

CVE-2014-1914

Multiple cross-site scripting XSS vulnerabilities in Command School Student Management System 1.06.01 allow remote attackers to inject arbitrary web script or HTML via the 1 topic parameter to sw/addtopic.php or 2 nick parameter to sw/chat/message.php...

CVE-2014-1915

Multiple cross-site request forgery CSRF vulnerabilities in Command School Student Management System 1.06.01 allow remote attackers to hijack the authentication of 1 administrators for requests that change the administrator password via an update action to sw/adminchangepassword.php or 2...

Cross site scripting

Multiple cross-site scripting XSS vulnerabilities in Command School Student Management System 1.06.01 allow remote attackers to inject arbitrary web script or HTML via the 1 topic parameter to sw/addtopic.php or 2 nick parameter to sw/chat/message.php...

Cross site request forgery (csrf)

Multiple cross-site request forgery CSRF vulnerabilities in Command School Student Management System 1.06.01 allow remote attackers to hijack the authentication of 1 administrators for requests that change the administrator password via an update action to sw/adminchangepassword.php or 2...

CVE-2014-1914

Multiple cross-site scripting XSS vulnerabilities in Command School Student Management System 1.06.01 allow remote attackers to inject arbitrary web script or HTML via the 1 topic parameter to sw/addtopic.php or 2 nick parameter to sw/chat/message.php...

CVE-2014-1915

Multiple cross-site request forgery CSRF vulnerabilities in Command School Student Management System 1.06.01 allow remote attackers to hijack the authentication of 1 administrators for requests that change the administrator password via an update action to sw/adminchangepassword.php or 2...

CVE-2014-1914

The CVE-2014-1914 entry describes multiple XSS vulnerabilities in the Command School Student Management System (version 1.06.01). The affected components are the web pages sw/add_topic.php (topic parameter) and sw/chat/message.php (nick parameter), where unsanitized input can be reflected to user...

CVE-2014-1915

CVE-2014-1915 affects Command School Student Management System 1.06.01 and involves Multiple CSRF vulnerabilities. The described flaws allow remote attackers to hijack admin authentication for password changes via sw/admin_change_password.php and to perform add_topic.php actions (adding a topic o...

PT-2014-4364

Name of the Vulnerable Software and Affected Versions Command School Student Management System version 1.06.01 Description The issue affects the Command School Student Management System, allowing remote attackers to exploit multiple cross-site request forgery CSRF vulnerabilities. This can lead t...

PT-2014-4363

Name of the Vulnerable Software and Affected Versions Command School Student Management System version 1.06.01 Description The issue concerns multiple cross-site scripting XSS vulnerabilities. These vulnerabilities allow remote attackers to inject arbitrary web script or HTML. Specifically, the...

CVE-2014-1914: Improper Neutralization of Input During Web Page Generation

Multiple cross-site scripting XSS vulnerabilities in Command School Student Management System 1.06.01 allow remote attackers to inject arbitrary web script or HTML via the 1 topic parameter to sw/addtopic.php or 2 nick parameter to sw/chat/message.php...