CVE-2024-54922

A SQL Injection was found in /admin/edituser.php of kashipara E-learning Management System v1.0, which allows remote attackers to execute arbitrary SQL commands to get unauthorized database access via the firstname, lastname, and username parameters...

CVE-2024-54938

A Directory Listing issue was found in Kashipara E-Learning Management System v1.0, which allows remote attackers to access sensitive files and directories via /admin/uploads...

CVE-2024-54926

A SQL Injection vulnerability was found in /searchclass.php of kashipara E-learning Management System v1.0, which allows remote attackers to execute arbitrary SQL commands to get unauthorized database access via the schoolyear parameter...

CVE-2024-54925

A SQL Injection was found in /removesentmessage.php in kashipara E-learning Management System v1.0, which allows remote attackers to execute arbitrary SQL commands to get unauthorized database access via the id parameter...

CVE-2024-54933

CVE-2024-54933 affects Kashipara E-learning Management System v1.0, with a SQL Injection vulnerability in the endpoint /admin/delete_content.php. The connected sources confirm the vulnerable component but do not provide exploit details, exact vulnerable parameter(s), affected versions beyond v1.0...

CVE-2024-54938

Kashipara E-Learning Management System v1.0 suffers a Directory Listing issue exposed at /admin/uploads, enabling remote access to sensitive files/directories. CVE-2024-54938 is classified with high impact (CVSS 3.1: 7.5) and network attack vector; no in‑document details on exploit specifics or a...

CVE-2024-54919

A Stored Cross Site Scripting XSS was found in /teacheravatar.php of kashipara E-learning Management System v1.0. This vulnerability allows remote attackers to execute arbitrary java script via the filename parameter...

CVE-2024-54922

CVE-2024-54922 affects Kashipara E-learning Management System v1.0. A SQL Injection vulnerability exists in the web endpoint/workflow involving the file /admin/edit_user.php, impacting input parameters firstname , lastname , and username . The flaw allows remote attackers to execute arbitrary SQL...

CVE-2024-54924

A SQL Injection was found in /admin/editcontent.php in kashipara E-learning Management System v1.0, which allows remote attackers to execute arbitrary SQL commands to get unauthorized database access via the title and content parameters...

Kashipara E-learning Management System 安全漏洞

Kashipara E-learning Management System is a learning management system from Kashipara. A security vulnerability exists in Kashipara E-learning Management System v1.0, which stems from an SQL injection vulnerability in /admin/deletedepartment.php...

CVE-2024-54923

A SQL Injection vulnerability was found in /admin/editteacher.php in kashipara E-learning Management System v1.0, which allows remote attackers to execute arbitrary SQL commands to get unauthorized database access via the department parameter...

CVE-2024-54927

Kashipara E-learning Management System v1.0 is vulnerable to SQL Injection in /admin/deleteusers.php...

CVE-2024-54918

Kashipara E-learning Management System v1.0 is vulnerable to Remote Code Execution via File Upload in /teacheravatar.php...

CVE-2024-54931

A SQL Injection was found in /admin/deleteevent.php in kashipara E-learning Management System v1.0, which allows remote attackers to execute arbitrary SQL commands to get unauthorized database access via the id parameter...

CVE-2024-54929

KASHIPARA E-learning Management System v1.0 is vulnerable to SQL Injection in /admin/deletesubject.php...

CVE-2024-54919

A Stored Cross Site Scripting XSS was found in /teacheravatar.php of kashipara E-learning Management System v1.0. This vulnerability allows remote attackers to execute arbitrary java script via the filename parameter...

CVE-2024-54926

CVE-2024-54926: Kashipara E-learning Management System v1.0 has a SQL Injection in /search_class.php via the school_year parameter, enabling remote attackers to execute arbitrary SQL and access the database. The issue’s root cause is an unsafely handled input in the search_class.php endpoint, wit...

CVE-2024-54932

Kashipara E-learning Management System v1.0 is affected by a SQL Injection in the /admin/delete_department.php endpoint. The issue stems from improper handling of input in this admin function, enabling attacker-controlled SQL execution with potential high impact on confidentiality, integrity, and...

CVE-2024-54935

CVE-2024-54935 describes a Stored Cross-Site Scripting (XSS) in the Kashipara E-learning Management System v1.0. The vulnerability is in /send_message_teacher_to_student.php and is exploitable via the my_message parameter, enabling remote attackers to inject and execute arbitrary scripts. Impact ...

CVE-2024-54936

CVE-2024-54936 affects Kashipara E-learning Management System v1.0. The Stored XSS vulnerability exists in /send_message.php, exploitable via the my_message parameter, potentially enabling arbitrary script execution in a victim’s browser. Affected component: Kashipara E‑learning Management System...