CVE-2024-41332

Incorrect access control in the deletecategory function of Sourcecodester Computer Laboratory Management System v1.0 allows authenticated attackers with low-level privileges to arbitrarily delete categories...

CVE-2024-31586

CVE-2024-31586 affects Computer Laboratory Management System v1.0. The vulnerability is a Cross Site Scripting (XSS) flaw that allows a remote attacker to execute arbitrary code via the Borrower Name, Department, and Remarks parameters. The reported impact is limited to the ability to run code wi...

CVE-2024-31545

Computer Laboratory Management System v1.0 is vulnerable to SQL Injection via the "id" parameter of /admin/?page=user/manageuser&id=6...

CVE-2024-31546

Computer Laboratory Management System v1.0 is vulnerable to SQL Injection via the "id" parameter of /admin/damage/viewdamage.php...

CVE-2024-31544

A stored cross-site scripting XSS vulnerability in Computer Laboratory Management System v1.0 allows attackers to execute arbitrary JavaScript code by including malicious payloads into “remarks”, “borrowername”, “facultydepartment” parameters in /classes/Master.php?f=saverecord...

CVE-2024-31544

CVE-2024-31544 applies to the Computer Laboratory Management System v1.0. The vulnerability is a stored cross-site scripting (XSS) flaw that allows an attacker to inject arbitrary JavaScript through the fields “remarks”, “borrower_name” and “faculty_department” in the API endpoint /classes/Master...

CVE-2024-3377 SourceCodester Computer Laboratory Management System cross site scripting

A vulnerability classified as problematic was found in SourceCodester Computer Laboratory Management System 1.0. This vulnerability affects unknown code of the file /classes/SystemSettings.php?f=updatesettings. The manipulation of the argument name leads to cross site scripting. The attack can be...

CVE-2024-3316

The CVE-2024-3316 entry concerns SourceCodester Computer Laboratory Management System 1.0. Affected functionality is the file /admin/category/view_category.php where manipulating the id parameter causes SQL injection. The issue is exploitable remotely and the exploit has been publicly disclosed, ...