1190 matches found
CVE-2024-1834 SourceCodester Simple Student Attendance System ?page=attendance&class_id=1 cross site scripting
A vulnerability was found in SourceCodester Simple Student Attendance System 1.0. It has been classified as problematic. This affects an unknown part of the file ?page=attendance&classid=1. The manipulation of the argument classdate with the input 2024-02-23%22%3E%3Cscript%3Ealert1%3C/script%3E...
Simple Student Attendance System Cross-Site Scripting Vulnerability
Simple Student Attendance System is a simple student attendance system. A cross-site scripting vulnerability exists in SourceCodester Simple Student Attendance System version 1.0, which stems from the presence of an unknown section of the page that uses special inputs to cause cross-site scriptin...
PT-2024-18349 · Sourcecodester · Sourcecodester Simple Student Attendance System
Name of the Vulnerable Software and Affected Versions: SourceCodester Simple Student Attendance System version 1.0 Description: A vulnerability was found in the SourceCodester Simple Student Attendance System, which has been classified as problematic. This issue affects an unknown part of the fil...
CVE-2024-26145 Uninvited user is able to join and mark the attendance of the the private event
Discourse Calendar adds the ability to create a dynamic calendar in the first post of a topic on Discourse. Uninvited users are able to gain access to private events by crafting a request to update their attendance. This problem is resolved in commit dfc4fa15f340189f177a1d1ab2cc94ffed3c1190. As a...
CVE-2024-26145 Uninvited user is able to join and mark the attendance of the the private event
Discourse Calendar adds the ability to create a dynamic calendar in the first post of a topic on Discourse. Uninvited users are able to gain access to private events by crafting a request to update their attendance. This problem is resolved in commit dfc4fa15f340189f177a1d1ab2cc94ffed3c1190. As a...
CVE-2024-26145 Uninvited user is able to join and mark the attendance of the the private event
Discourse Calendar adds the ability to create a dynamic calendar in the first post of a topic on Discourse. Uninvited users are able to gain access to private events by crafting a request to update their attendance. This problem is resolved in commit dfc4fa15f340189f177a1d1ab2cc94ffed3c1190. As a...
ChurchCRM Security Breach
ChurchCRM is an open source CRM system for churches. A security vulnerability exists in ChurchCRM version 5.5.0, which is caused by a reflected cross-site scripting vulnerability in the type parameter of the EventAttendance.php page...
PT-2024-21299 · Discourse · Discourse Calendar
Name of the Vulnerable Software and Affected Versions: Discourse Calendar affected versions not specified Description: The issue allows uninvited users to gain access to private events by crafting a request to update their attendance. This is related to the dynamic calendar feature in the first...
CVE-2024-25627
Alf.io is a free and open source event attendance management system. An administrator on the alf.io application is able to upload HTML files that trigger JavaScript payloads. As such, an attacker gaining administrative access to the alf.io application may be able to persist access by planting an...
CVE-2024-25628
Alf.io is a free and open source event attendance management system. In versions prior to 2.0-M4-2402 users can access the admin area even after being invalidated/deleted. This issue has been addressed in version 2.0-M4-2402. All users are advised to upgrade. There are no known workarounds for th...
Use after free
Alf.io is a free and open source event attendance management system. An administrator on the alf.io application is able to upload HTML files that trigger JavaScript payloads. As such, an attacker gaining administrative access to the alf.io application may be able to persist access by planting an...
CVE-2024-25627
CVE-2024-25627 affects Alf.io. The vulnerability is an XSS via HTML file upload that requires administrative access to trigger a JavaScript payload, enabling persistence if an attacker gains admin rights. Affected software is Alf.io prior to version 2.0-M4-2402; the issue has been addressed in ve...
CVE-2024-25628
CVE-2024-25628 affects Alf.io, an open source event attendance management system. The vulnerability is described as insufficient session expiration: in versions prior to 2.0-M4-2402, users can access the admin area even after being invalidated or deleted. The issue has been addressed in version 2...
CVE-2024-25302
Sourcecodester Event Student Attendance System 1.0, allows SQL Injection via the 'student' parameter...
CVE-2024-25302
Sourcecodester Event Student Attendance System 1.0, allows SQL Injection via the 'student' parameter...
Sql injection
Sourcecodester Event Student Attendance System 1.0, allows SQL Injection via the 'student' parameter...
PT-2024-20872 · Sourcecodester · Sourcecodester Student Attendance Management System
Name of the Vulnerable Software and Affected Versions: Sourcecodester Event Student Attendance System version 1.0 Description: The issue allows SQL Injection via the student parameter. This could potentially lead to unauthorized access or manipulation of database content. There is no information...
CVE-2024-25302
Sourcecodester Event Student Attendance System 1.0, allows SQL Injection via the 'student' parameter...
Event Student Attendance System SQL Injection Vulnerability
Event Student Attendance System is a student event attendance system by the individual developer Remy Andrade. An SQL injection vulnerability exists in Event Student Attendance System version 1.0, which originates from allowing SQL injection via the student parameter...