CVE-2021-26764

CVE-2021-26764 affects PHPGurukul Student Record System version 4.0. The vulnerability is a SQL injection in the parameter “id” of the endpoint edit-std.php , caused by insufficient input validation. Remote attackers can execute arbitrary SQL statements via this parameter. Documented in multiple ...

CVE-2021-26764

SQL injection vulnerability in PHPGurukul Student Record System v 4.0 allows remote attackers to execute arbitrary SQL statements, via the id parameter to edit-std.php...

CVE-2021-26762

SQL injection vulnerability in PHPGurukul Student Record System 4.0 allows remote attackers to execute arbitrary SQL statements, via the cid parameter to edit-course.php...

CVE-2021-26765

PHPGurukul Student Record System 4.0 is vulnerable to SQL injection via the sid parameter in edit-sub.php . Root cause: lack of validation of externally entered SQL in sid, enabling remote attackers to execute arbitrary SQL. Exploitation details are not provided in the sources. Affected version: ...

PHPGurukul Student Record System SQL注入漏洞

PHPGurukul Student Record System is an application that is vulnerable to SQL injection. The vulnerability stems from a lack of validation of external input SQL statements in the cid parameter of edit-course.php, which can be exploited by remote attackers to through to execute arbitrary SQL...

PHPGurukul Student Record System SQL注入漏洞

PHPGurukul Student Record System is an application that is vulnerable to SQL injection in version 4.0 of the PHPGurukul Student Record System. The vulnerability stems from a lack of validation of external input SQL statements in the id parameter of edit-std.php, which can be exploited by remote...

PHPGurukul Student Record System SQL注入漏洞

PHPGurukul Student Record System is an application. A SQL injection vulnerability exists in PHPGurukul Student Record System version 4.0, which stems from the lack of validation of externally entered SQL statements in the sid parameter of edit-sub.php, and can be exploited by remote attackers to...

PT-2021-17127 · Unknown · Phpgurukul Student Record System

Name of the Vulnerable Software and Affected Versions: PHPGurukul Student Record System version 4.0 Description: The issue allows remote attackers to execute arbitrary SQL statements. This is achieved via the cid parameter to the "edit-course.php" endpoint. Recommendations: For PHPGurukul Student...

CASAP Automated Enrollment 跨站脚本漏洞

CASAP Automated Enrollment is an automated enrollment system from the CASAP organization. The purpose of the project is to provide CASAP with an automated enrollment system to streamline the school process and make it more effective, efficient and easy to retrieve. A security vulnerability exists...

Khan Academy: Enumerate all the class codes via google dorking

I used this particular google dork site:khanacademy.org/join/ to enumerate all the links of joining classes. 1. Go to google and use the above query to enumerate all of them. 2. Create the student account by filling all the required details 3. Now you're in the class without being actually invite...

CVE-2020-25408

A Cross-Site Request Forgery CSRF vulnerability exists in ProjectWorlds College Management System Php 1.0 that allows a remote attacker to modify, delete, or make a new entry of the student, faculty, teacher, subject, scores, location, and article data...

CVE-2020-25408

A Cross-Site Request Forgery CSRF vulnerability exists in ProjectWorlds College Management System Php 1.0 that allows a remote attacker to modify, delete, or make a new entry of the student, faculty, teacher, subject, scores, location, and article data...

Cross site request forgery (csrf)

A Cross-Site Request Forgery CSRF vulnerability exists in ProjectWorlds College Management System Php 1.0 that allows a remote attacker to modify, delete, or make a new entry of the student, faculty, teacher, subject, scores, location, and article data...

CVE-2020-25408

A Cross-Site Request Forgery CSRF vulnerability exists in ProjectWorlds College Management System Php 1.0 that allows a remote attacker to modify, delete, or make a new entry of the student, faculty, teacher, subject, scores, location, and article data...

Projectsworlds College Management System 跨站请求伪造漏洞

ProjectWorlds College Management System is a college management system. projectWorlds College Management System is vulnerable to cross-site request forgery, which can be exploited by attackers to modify, delete student, faculty, teacher, subject, grade, location, and article data or create new...

Cross-site Scripting (XSS) - Stored in changeweb/unifiedtransform

✍️ Description Stored Cross Site Scripting in the message/all.blade.php. 🕵️‍♂️ Proof of Concept As a teacher, click on "My Courses" and then "message students". CKEditor hides the underlying where we can add tag or capture the request in a proxy like burpsuite and edit the HTTP POST request. Select...

LifterLMS < 4.21.2 - Access Other Student Grades/Answers via IDOR

The plugin was affected by an IDOR issue, allowing students to see other student answers and grades PoC - Add 2 users with Student role for the scenario . - Create A course With a quiz I picked True or Flase question for my quiz - Set Enrol on Free for the ease of scenario - Enrol into the...

SQL Injection Vulnerability in student-record-system-php

student-record-system-php is a student record system. A SQL injection vulnerability exists in student-record-system-php, which can be exploited by an attacker to obtain sensitive information from the database...

Web-School ERP Cross-Site Request Forgery Vulnerability (CNVD-2021-28279)

Web-School ERP is a school management software for schools and educational organizations. A cross-site request forgery vulnerability exists in Web-School ERP version 5.0. An attacker can exploit this vulnerability to create a studentleaveapplication request via...

CVE-2021-30112

Web-School ERP V 5.0 contains a cross-site request forgery CSRF vulnerability that allows a remote attacker to create a studentleaveapplication request through module/core/studentleaveapplication/create. The application fails to validate the CSRF token for a POST request using Guardian privilege...