CVE-2025-46204

描述 Unifiedtransform v2.0 存在不正确的访问控制漏洞。任何用户（学生和教师）都可以通过 /course/edit/id 端点访问和修改课程详情。该功能本应仅供管理员使用。利用此漏洞可允许未经授权的人员篡改课程名称和类别，从而破坏数据完整性和管理控制。 供应商：Unifiedtransform 产品 学校管理软件 v2.0 受影响组件 负责课程权限的访问控制机制。 路由：GET /course/edit/id 控制器：CourseController 方法：edit 以及所有与编辑课程相关的其他端点和功能。 PoC/攻击向量 步骤1： 按照官方 GitHub...

CVE-2026-32932

Chamilo LMS is a learning management system. Prior to 1.11.38 and 2.0.0-RC.3, an Open Redirect vulnerability in the session course edit page allows an attacker to redirect an authenticated administrator to an arbitrary external URL after saving coach assignment changes. The redirect also leaks th...

CVE-2026-32932 Chamilo LMS has an Open Redirect via Unvalidated 'page' Parameter in Session Course Edit

Chamilo LMS is a learning management system. Prior to 1.11.38 and 2.0.0-RC.3, an Open Redirect vulnerability in the session course edit page allows an attacker to redirect an authenticated administrator to an arbitrary external URL after saving coach assignment changes. The redirect also leaks th...

CVE-2026-32932 Chamilo LMS has an Open Redirect via Unvalidated 'page' Parameter in Session Course Edit

Chamilo LMS is a learning management system. Prior to 1.11.38 and 2.0.0-RC.3, an Open Redirect vulnerability in the session course edit page allows an attacker to redirect an authenticated administrator to an arbitrary external URL after saving coach assignment changes. The redirect also leaks th...

CVE-2026-32932

Chamilo LMS (affected versions: < 1.11.38 and

EUVD-2025-26260

Malicious code in bioql PyPI...

CVE-2025-9679

A security vulnerability has been detected in itsourcecode Student Information System 1.0. This affects an unknown function of the file /courseedit1.php. Such manipulation of the argument ID leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed...

CVE-2025-9679

A security vulnerability has been detected in itsourcecode Student Information System 1.0. This affects an unknown function of the file /courseedit1.php. Such manipulation of the argument ID leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed...

Unifiedtransform 安全漏洞

Unifiedtransform is an open source school management software by Hasib Mahmud Individual Developer. A security vulnerability exists in Unifiedtransform version v2.0, which stems from the /course/edit/id endpoint vulnerability and could lead to remote elevation of privilege...

CVE-2021-26762

SQL injection vulnerability in PHPGurukul Student Record System 4.0 allows remote attackers to execute arbitrary SQL statements, via the cid parameter to edit-course.php...

Sourcecodester Pisay Online E-Learning System SQL Injection Vulnerability

Sourcecodester Pisay Online E-Learning System is an online e-learning system based on PHP and MySQL. A SQL injection vulnerability exists in Sourcecodester Pisay Online E-Learning System version 1.0. A remote attacker can exploit this vulnerability via the 'useremail', 'userpass', and 'id'...

Moodle 2.6.1 Cross Site Scripting

============================================================== Title ...| Moodle 2.6.1 Version .| Feb 27 2014 moodle-latest-26.zip Date ....| 27.02.2014 Found ...| HauntIT Blog Home ....| http://download.moodle.org ============================================================== + From admin user:...

eFront Community++ v3.6.10 - SQL Injection Vulnerability

Document Title: =============== eFront Community++ v3.6.10 - SQL Injection Vulnerability References Source: ==================== http://www.vulnerability-lab.com/getcontent.php?id=422 Release Date: ============= 2012-02-11 Vulnerability Laboratory ID VL-ID: ==================================== 42...