CVE-2025-25621

CVE-2025-25621 Unifiedtransform v2.0 には不適切なアクセス制御の脆弱性があり、教師がエンドポイント /courses/teacher/index?teacherid=2&semesterid=1 を介して同僚の教師の出席を取ることが可能です。 ベンダー: Unifiedtransform PoC ステップ 1: 教師としてアプリケーションにログインします。 ステップ 2: エンドポイント /courses/teacher/index?teacherid=2&semesterid=1 に移動します Teacher ID を変更します。 ステップ 3:...

CVE-2023-51801

CVE-2023-51801 Simple Student Attendance System v.1.0 - 複数のSQLインジェクション脆弱性 - studentform.php および classform.php 説明 :Simple Student Attendance System v.1.0 には、認証済みの攻撃者によって悪用される可能性のある複数のSQLインジェクション脆弱性があります。これらの脆弱性は studentform.php および classform.php に存在し、「id」パラメータを介して任意のSQLコマンドを実行することが可能です。...

CVE-2024-39250

Plantilla de nuclei para PoC CVE-2024-39250 Efrotech http://www.efrotech.com/ desarrolla TimeTrax https://etimetrax.com/, un programa de seguimiento de asistencia de recursos humanos, y encontré una vulnerabilidad de inyección SQL no autenticada. Es fácil ejecutar el vector de ataque, así que cre...

CVE-2023-51802

CVE-2023-51802 Simple Student Attendance System v.1.0 - 出席レポートにおけるクロスサイトスクリプティング XSS の脆弱性 説明 : Simple Student Attendance System v.1.0 のクロスサイトスクリプティング脆弱性により、リモート攻撃者が attendancereport コンポーネント内の "page" または "classmonth" パラメータに細工したペイロードを介して任意のコードを実行できる可能性があります。 脆弱な製品バージョン : Simple Student Attendance...

CVE-2025-25615

CVE-2025-25615 Unifiedtransform v2.0 は、不適切なアクセス制御の脆弱性があり、教師がすべてのクラスセクションの出席リストを閲覧できる状態にあります。 開発元: Unifiedtransform PoC ステップ 1: 教師としてアプリケーションにログインします。 ステップ 2: 次のエンドポイントにアクセスします: /attendances/view?classid=1&sectionid=2&courseid=1 classid および sectionid パラメータを変更すると、異なるセクションにアクセスできます。 ステップ 3:...

CVE-2026-37749

CVE-2026-37749 — CodeAstro Simple Attendance Management System 1.0 - Inyección SQL Detalles...

EUVD-2026-72175

A security flaw has been discovered in Projectwolds Online Attendance System 1.0. Affected by this issue is some unknown functionality of the file profile.php. The manipulation of the argument email results in cross site scripting. The attack may be performed from remote. The exploit has been...

CVE-2026-86226

A security flaw has been discovered in Projectwolds Online Attendance System 1.0. Affected by this issue is some unknown functionality of the file profile.php. The manipulation of the argument email results in cross site scripting. The attack may be performed from remote. The exploit has been...

CVE-2026-86226

Projectwolds Online Attendance System 1.0 contains a cross-site scripting (XSS) vulnerability in the file profile.php , triggered by manipulation of the email argument. The flaw allows a remote attacker with low privileges to inject scripts if a user interacts with the crafted request. The CVSS 3...

CVE-2026-86226 Projectwolds Online Attendance System profile.php cross site scripting

A security flaw has been discovered in Projectwolds Online Attendance System 1.0. Affected by this issue is some unknown functionality of the file profile.php. The manipulation of the argument email results in cross site scripting. The attack may be performed from remote. The exploit has been...

PT-2026-86573

Name of the Vulnerable Software and Affected Versions Projectwolds Online Attendance System version 1.0 Description A remote cross-site scripting issue exists in the profile.php file. The flaw allows for the manipulation of the email variable to execute malicious scripts in the context of the...

CVE-2026-15493

A vulnerability was detected in Akpali9 Attendance-Management-System up to 70b91fe38f4195b701a45f0edcd4f42d5f64aeee. This issue affects some unknown processing of the file absent.php. Performing a manipulation of the argument exportdate results in cross site scripting. It is possible to initiate...

EUVD-2026-43215

A vulnerability was detected in Akpali9 Attendance-Management-System up to 70b91fe38f4195b701a45f0edcd4f42d5f64aeee. This issue affects some unknown processing of the file absent.php. Performing a manipulation of the argument exportdate results in cross site scripting. It is possible to initiate...

CVE-2026-15493

The CVE-2026-15493 entry concerns Akpali9 Attendance-Management-System. Vulnerability context: absent.php processing is affected, enabling cross-site scripting via manipulation of the export_date argument. Impact is stated as remote initiation with low to moderate risk indicators depending on the...

CVE-2026-15478

A flaw has been found in IceHRM up to 35.0.1. This impacts an unknown function of the file core/src/Reports/User/Reports/EmployeeAttendanceReport.php of the component UserReport Endpoint. Executing a manipulation of the argument employeeList can lead to sql injection. The attack can be launched...

CVE-2026-15478

IceHRM

CVE-2026-15478 IceHRM UserReport Endpoint EmployeeAttendanceReport.php sql injection

A flaw has been found in IceHRM up to 35.0.1. This impacts an unknown function of the file core/src/Reports/User/Reports/EmployeeAttendanceReport.php of the component UserReport Endpoint. Executing a manipulation of the argument employeeList can lead to sql injection. The attack can be launched...

EUVD-2026-43053

Improperly Controlled Modification of Dynamically-Determined Object Attributes vulnerability in Drupal Flag attendance field allows Object Injection. This issue affects Flag attendance field versions: from 0.0.0 to 1.2...

CVE-2026-55809

Improperly Controlled Modification of Dynamically-Determined Object Attributes vulnerability in Drupal Flag attendance field allows Object Injection. This issue affects Flag attendance field versions: from 0.0.0 to 1.2...

CVE-2026-55809

The CVE-2026-55809 issue affects the Drupal Flag attendance field module, with vulnerable versions 0.0.0 through 1.2. The root cause is improper control of modification of dynamically-determined object attributes, with data stored as PHP-serialized strings. If malicious data is written to the fie...