CVE-2026-37749

CVE-2026-37749 — CodeAstro Simple Attendance Management System 1.0 - SQLインジェクション 詳細...

CVE-2025-25615

CVE-2025-25615 Unifiedtransform v2.0 存在不正确的访问控制漏洞，允许教师查看所有班级的考勤列表。 厂商：Unifiedtransform PoC 步骤1： 以教师身份登录应用程序。 步骤2： 访问以下端点： /attendances/view?classid=1&sectionid=2&courseid=1 （修改 classid 和 sectionid 参数以访问不同的班级。） 步骤3： 查看任意班级的考勤情况。 影响： 这允许未经授权访问所有班级的考勤数据，而该功能本应仅限于管理员使用。这可能导致隐私泄露和数据滥用。 漏洞类型： 不正确的访问控制...

CVE-2025-25621

CVE-2025-25621 Unifiedtransform v2.0 é vulnerável a Controle de Acesso Incorreto, permitindo que professores registrem presença de colegas professores através do endpoint /courses/teacher/index?teacherid=2&semesterid=1. Fornecedor: Unifiedtransform PoC Passo 1: Faça login na aplicação como...

CVE-2024-39250

CVE-2024-39250 PoC nuclei टेम्पलेट Efrotech का http://www.efrotech.com/ TimeTrax https://etimetrax.com/ एक ह्यूमन रिसोर्सेज उपस्थिति ट्रैकिंग प्रोग्राम है, और मुझे एक बिना प्रमाणीकरण वाली SQL इंजेक्शन भेद्यता मिली। हमला वेक्टर को निष्पादित करना आसान है, इसलिए मैंने एक nuclei टेम्पलेट बनाया।...

CVE-2023-51802

CVE-2023-51802 Simple Student Attendance System v.1.0 - attendancereport में क्रॉस-साइट स्क्रिप्टिंग XSS कमजोरियाँ विवरण : Simple Student Attendance System v.1.0 में क्रॉस साइट स्क्रिप्टिंग कमजोरी एक दूरस्थ हमलावर को attendancereport घटक में "page" या "classmonth" पैरामीटर में एक क्राफ्टेड पेलोड ...

CVE-2023-51801

CVE-2023-51801 Simple Student Attendance System v.1.0 - ثغرات حقن SQL متعددة - studentform.php و classform.php الوصف :Simple Student Attendance System v.1.0 عرضة لثغرات حقن SQL متعددة يمكن استغلالها من قبل مهاجمين مُصادَقين. توجد هذه الثغرات في studentform.php و classform.php، مما يسمح بتنفيذ أوا...

CVE-2026-15493

A vulnerability was detected in Akpali9 Attendance-Management-System up to 70b91fe38f4195b701a45f0edcd4f42d5f64aeee. This issue affects some unknown processing of the file absent.php. Performing a manipulation of the argument exportdate results in cross site scripting. It is possible to initiate...

EUVD-2026-43215

A vulnerability was detected in Akpali9 Attendance-Management-System up to 70b91fe38f4195b701a45f0edcd4f42d5f64aeee. This issue affects some unknown processing of the file absent.php. Performing a manipulation of the argument exportdate results in cross site scripting. It is possible to initiate...

CVE-2026-15493

The CVE-2026-15493 entry concerns Akpali9 Attendance-Management-System. Vulnerability context: absent.php processing is affected, enabling cross-site scripting via manipulation of the export_date argument. Impact is stated as remote initiation with low to moderate risk indicators depending on the...

CVE-2026-15478

A flaw has been found in IceHRM up to 35.0.1. This impacts an unknown function of the file core/src/Reports/User/Reports/EmployeeAttendanceReport.php of the component UserReport Endpoint. Executing a manipulation of the argument employeeList can lead to sql injection. The attack can be launched...

CVE-2026-15478

IceHRM

CVE-2026-15478 IceHRM UserReport Endpoint EmployeeAttendanceReport.php sql injection

A flaw has been found in IceHRM up to 35.0.1. This impacts an unknown function of the file core/src/Reports/User/Reports/EmployeeAttendanceReport.php of the component UserReport Endpoint. Executing a manipulation of the argument employeeList can lead to sql injection. The attack can be launched...

EUVD-2026-43053

Improperly Controlled Modification of Dynamically-Determined Object Attributes vulnerability in Drupal Flag attendance field allows Object Injection. This issue affects Flag attendance field versions: from 0.0.0 to 1.2...

CVE-2026-55809

Improperly Controlled Modification of Dynamically-Determined Object Attributes vulnerability in Drupal Flag attendance field allows Object Injection. This issue affects Flag attendance field versions: from 0.0.0 to 1.2...

CVE-2026-55809

The CVE-2026-55809 issue affects the Drupal Flag attendance field module, with vulnerable versions 0.0.0 through 1.2. The root cause is improper control of modification of dynamically-determined object attributes, with data stored as PHP-serialized strings. If malicious data is written to the fie...

CVE-2026-55809 Flag attendance field - Critical - PHP object injection - SA-CONTRIB-2026-049

Improperly Controlled Modification of Dynamically-Determined Object Attributes vulnerability in Drupal Flag attendance field allows Object Injection. This issue affects Flag attendance field versions: from 0.0.0 to 1.2...

CVE-2026-45780

Discourse is an open-source discussion platform. Prior to 2026.6.0, 2026.5.1, 2026.4.2, and 2026.1.5, EventSerializer could expose invited group names, sample invitees, and attendance statistics to users who could view the topic but were not entitled to view the private event invitee list. This...

CVE-2026-45780

Discourse is an open-source discussion platform. Prior to 2026.6.0, 2026.5.1, 2026.4.2, and 2026.1.5, EventSerializer could expose invited group names, sample invitees, and attendance statistics to users who could view the topic but were not entitled to view the private event invitee list. This...

CVE-2026-45780 Discourse: Private event sample invitees are serialized to non-invited event viewers

Discourse is an open-source discussion platform. Prior to 2026.6.0, 2026.5.1, 2026.4.2, and 2026.1.5, EventSerializer could expose invited group names, sample invitees, and attendance statistics to users who could view the topic but were not entitled to view the private event invitee list. This...

PT-2026-56994

Name of the Vulnerable Software and Affected Versions Discourse versions prior to 2026.6.0 Discourse versions prior to 2026.5.1 Discourse versions prior to 2026.4.2 Discourse versions prior to 2026.1.5 Description The EventSerializer could expose invited group names, sample invitees, and attendan...