GHSA-MM73-86F9-5X5C Moodle Grade information disclosure in grade's external fetch functions

It was found in Moodle before version 3.10.1, 3.9.4 and 3.8.7 that a insufficient capability checks in some grade related web services meant students were able to view other students grades...

CVE-2022-1819

CVE-2022-1819 affects the Student Information System 1.0, specifically the admin/?page=students path in the Student Roll module. The vulnerability is an authenticated cross-site scripting (XSS) flaw triggered by input manipulation of the form . Exploit details have been disclosed publicly. The pr...

Student Information System 跨站脚本漏洞

oretnom23 Student Information System is a student information system by the individual developer oretnom23. A security vulnerability exists in Student Information System version 1.0, which stems from a cross-site scripting issue in admin/?page=students of the Student Roll module...

PT-2022-14138

Name of the Vulnerable Software and Affected Versions Student Information System version 1.0 Description A problematic issue was found in the Student Information System, affecting the "admin/?page=students" endpoint of the Student Roll module. The manipulation with the input alert1 leads to...

CVE-2022-1819: Improper Neutralization of Input During Web Page Generation

A vulnerability, which was classified as problematic, was found in Student Information System 1.0. Affected is admin/?page=students of the Student Roll module. The manipulation with the input leads to authenticated cross site scripting. Exploit details have been disclosed to the public...

CVE-2022-28924

An information disclosure vulnerability in UniverSIS-Students before v1.5.0 allows attackers to obtain sensitive information via a crafted GET request to the endpoint /api/students/me/courses/...

CVE-2022-28924

An information disclosure vulnerability in UniverSIS-Students before v1.5.0 allows attackers to obtain sensitive information via a crafted GET request to the endpoint /api/students/me/courses/...

CVE-2022-28924

An information disclosure vulnerability in UniverSIS-Students before v1.5.0 allows attackers to obtain sensitive information via a crafted GET request to the endpoint /api/students/me/courses/...

Information disclosure

An information disclosure vulnerability in UniverSIS-Students before v1.5.0 allows attackers to obtain sensitive information via a crafted GET request to the endpoint /api/students/me/courses/...

CVE-2022-28924

An information disclosure vulnerability in UniverSIS-Students before v1.5.0 allows attackers to obtain sensitive information via a crafted GET request to the endpoint /api/students/me/courses/...

CVE-2022-28924

An information disclosure vulnerability in UniverSIS-Students before v1.5.0 allows attackers to obtain sensitive information via a crafted GET request to the endpoint /api/students/me/courses/...

CVE-2022-28924

The CVE-2022-28924 entry concerns UniverSIS-Students prior to v1.5.0, where a crafted GET request to /api/students/me/courses/ can disclose sensitive information. The vulnerability is an information disclosure flaw in the API endpoint, enabling attackers to access data without proper authorizatio...

PT-2022-19315

Name of the Vulnerable Software and Affected Versions UniverSIS-Students versions prior to 1.5.0 Description The issue allows attackers to obtain sensitive information via a crafted GET request to the endpoint "/api/students/me/courses/". Recommendations For versions prior to 1.5.0, update to...

CVE-2022-28924: Exposure of Resource to Wrong Sphere

An information disclosure vulnerability in UniverSIS-Students before v1.5.0 allows attackers to obtain sensitive information via a crafted GET request to the endpoint /api/students/me/courses/...

Moodle Privilege escalation in quiz web services

In Moodle 3.x, quiz web services allow students to see quiz results when it is prohibited in the settings...

Moodle Portfolio forum caller class allows a user to download any file

An issue was discovered in Moodle 3.x. Students who posted on forums and exported the posts to portfolios can download any stored Moodle file by changing the download URL...

GHSA-VXMV-74RF-VQGP Moodle Portfolio forum caller class allows a user to download any file

An issue was discovered in Moodle 3.x. Students who posted on forums and exported the posts to portfolios can download any stored Moodle file by changing the download URL...

GHSA-XJX9-7C29-PWMM Moodle Improper Privilege Management

An issue was discovered in Moodle 3.x. Students who submitted assignments and exported them to portfolios can download any stored Moodle file by changing the download URL...

Moodle Secure layout contained an insecure link in Boost theme

A vulnerability was found in moodle before versions 3.6.3 and 3.5.5. There was a link to site home within the the Boost theme's secure layout, meaning students could navigate out of the page...

Cross-site Scripting (XSS) - Stored

Description Stored XSS found due to long name summarize Proof of Concept 1.First, access the latest version of the demo environment. https://www.rosariosis.org/demonstration/index.php 2.Then log in with your teacher account teacher/teacher 3.After logging in, access to add an assignment. 4.Then...