Override access vulnerability in the Academic Management System of the Gardener Teaching and Learning Management Platform

The Gardener Instructional Management Platform is a comprehensive school management platform that focuses on teaching as an integrated management program. There is an override access vulnerability in the academic management system of the Gardener Teaching Management Platform. After logging in to...

High Schooler Nets $10,000 For Google Bug

Google fixed a bug last month that could have let anyone access an internal Google website and in turn access sensitive data. The company awarded a hefty $10,000 bounty to the researcher that uncovered it, Ezequiel Pereira, an Uruguayan high school student, last Friday. Pereira stumbled upon the...

Information Disclosure

Moodle is vulnerable to information disclosure. The library does not properly hide student information during blind marking, allowing a malicious users to view student information on code inspection...

Privilege Escalation

Moodle is vulnerable to privilege escalations. On big installations, when the sync script was run it would improperly assign a manager role to suspended student accounts, granting these accounts the same access rights as a manager role...

Cross-site Scripting (XSS)

Moodle is vulnerable to cross-site scripting XSS. Authenticated attackers can leverage a flaw in the survey module and the student role to inject web script into a survey answer...

WordPress IBPS Online Exam plugin <=1.0 - Authenticated SQL Injection (SQLi) vulnerability

Authenticated SQL Injection SQLi vulnerability found in WordPress IBPS Online Exam plugin =1.0 versions. Blind SQL Injection possible when logged in as a student. Solution 2017.07.29 - We were unable to find information about patched release of WordPress IBPS Online Exam plugin. Also, we were...

WordPress IBPS Online Exam plugin <=1.0 - Authenticated Stored Cross-site scripting (XSS) vulnerability

Authenticated Stored Cross-site scripting XSS vulnerability found in WordPress IBPS Online Exam plugin =1.0 versions by 8bitsec. The attack is possible when logged in as a student. Solution 2017.07.29 - We were unable to find information about patched release of WordPress IBPS Online Exam plugin...

student.wiki.pisd.edu XSS vulnerability

Vulnerable URL: http://student.wiki.pisd.edu/s/mediaplayer.swf?file=http://content.bitsontherun.com/videos/bkaovAYt-364766.flv=falseℑ=http://appsec.ws/ExploitDB/cMon.jpg=true=javascript:confirm/openbugbounty/;//=blank&.swf Details: Description| Value ---|--- Patched:| No Latest check for patch:|...

Authorization Bypass

Moodle is vulnerable to authorization bypass. The library does not consider if a forum is optional, allowing a malicious user to bypass forum-subscription requirements through the student role and unsubscribing from all forums...

Alio Applicant Portal 6.0 SQL Injection Vulnerability

Alio Applicant Portal versions 6.0 and below suffer from a remote SQL injection vulnerability. +---------------------------------------------------------+ | Vulnerable Software: Alio Applicant Portal | | Vendor: http://www.myalio.com/ | | Vulnerability Type: SQL Injection | | Date Released:...

Unauthorised Modification

moodle is vulnerable to unauthorised modifications. A malicious user can bypass an activity's read-only state by using the student role and modify the database...

Bypass Access Restrictions

Moodle is vulnerable to access restrictions being bypassed. Authenticated users can leverage the student role to bypass access restrictions and read the RSS feed for a forum. This is possible because mod/forum/rsslib.php does not correctly implement the requirement for posting before reading a Q...

AuroMeera Technometrix Pvt Cross-Site Scripting Vulnerability

eMLi is a comprehensive education management suite from AuroMeera Technometrix Pvt for educational institutions in India and globally. A cross-site scripting vulnerability in core-eMLi of AuroMeera Technometrix Pvt's eMLi allows an attacker to send malicious code as a browser-side script to...

CVE-2017-7621

Cross Site Scripting Vulnerability in core-eMLi in AuroMeera Technometrix Pvt. Ltd. eMLi V1.0 allows an Attacker to send malicious code, generally in the form of a browser-side script, to a different end user via the page parameter to code/studentportal/home.php. The affected versions are eMLi...

PT-2017-17849

Name of the Vulnerable Software and Affected Versions AuroMeera Technometrix Pvt. Ltd. eMLi versions 1.0 Description The issue allows an attacker to send malicious code, generally in the form of a browser-side script, to a different end user via the "page" parameter to "code/student...

Quadz School Management System 3.1 SQL Injection Vulnerability

Exploit for php platform in category web applications Exploit Title: Quadz School Management System v3.1 - SQL Injection Google Dork: N/A Date: 12.02.2017 Vendor Homepage: http://awardcorporation.com/ Software Buy: https://codecanyon.net/item/quadz-school-management-system/10452009 Demo:...

TI Online Examination System 2.0 SQL Injection

Exploit Title: TI Online Examination System v2.0 - SQL Injection Google Dork: N/A Date: 12.02.2017 Vendor Homepage: http://textusintentio.com/ Software Buy: https://codecanyon.net/item/ti-online-examination-system-v2/11248904 Demo: http://oesv2.textusintentio.com/ Version: 2.0 Tested on: Win7 x64...

Quadz School Management System 3.1 SQL Injection

Exploit Title: Quadz School Management System v3.1 - SQL Injection Google Dork: N/A Date: 12.02.2017 Vendor Homepage: http://awardcorporation.com/ Software Buy: https://codecanyon.net/item/quadz-school-management-system/10452009 Demo: http://mass.awardcorporation.com/ Version: 3.1 Tested on: Win7...

Examplo Online Exam System SQL Injection

Exploit Title: Examplo - Online Exam System - SQL Injection Google Dork: N/A Date: 09.02.2017 Vendor Homepage: http://softpae.sk/ Software Buy: https://codecanyon.net/item/examplo-online-exam-system/16174658 Demo: http://munka.softpae.sk/examplo/ Version: N/A Tested on: Win7 x64, Kali Linux x64...

SOA School Management - 'view' SQL Injection

Exploit Title: Complete School Management Software with Web Portal - SQL Injection Google Dork: N/A Date: 09.02.2017 Vendor Homepage: http://www.ynetinteractive.com/ Software Buy: http://www.ynetinteractive.com/soa/ Demo: http://www.ynetinteractive.com/soa/demo.php Version: N/A Tested on: Win7 x6...