Kashipara E-learning Management System Security Vulnerabilities

Kashipara E-learning Management System is a learning management system from Kashipara. A security vulnerability exists in Kashipara E-learning Management System v1.0, which stems from an SQL injection vulnerability in /admin/deletedepartment.php...

Kashipara E-learning Management System Security Vulnerabilities

Kashipara E-learning Management System is a learning management system from Kashipara. A security vulnerability exists in Kashipara E-learning Management System v1.0. An attacker can exploit this vulnerability to execute arbitrary SQL commands to access the database via the department parameter...

Kashipara E-learning Management System Security Vulnerabilities

Kashipara E-learning Management System is a learning management system from Kashipara. A security vulnerability exists in Kashipara E-learning Management System v1.0, which originates from a SQL injection vulnerability in /admin/deleteteacher.php...

Kashipara E-learning Management System Security Vulnerabilities

Kashipara E-learning Management System is a learning management system from Kashipara. A security vulnerability exists in Kashipara E-learning Management System v1.0. An attacker can exploit the vulnerability to access the database by executing arbitrary SQL commands via the title and content...

Kashipara E-learning Management System Security Vulnerabilities

Kashipara E-learning Management System is a learning management system from Kashipara. A security vulnerability exists in Kashipara E-learning Management System v1.0, which originates from an SQL injection vulnerability in /admin/deleteusers.php...

CVE-2024-54933

Kashipara E-learning Management System v1.0 is vulnerable to SQL Injection in /admin/deletecontent.php...

Kashipara E-learning Management System Security Vulnerabilities

Kashipara E-learning Management System is a learning management system from Kashipara. A security vulnerability exists in Kashipara E-learning Management System v1.0. An attacker can exploit the vulnerability to access sensitive files and directories via /admin/uploads...

CVE-2024-54936

CVE-2024-54936 affects Kashipara E-learning Management System v1.0. The Stored XSS vulnerability exists in /send_message.php, exploitable via the my_message parameter, potentially enabling arbitrary script execution in a victim’s browser. Affected component: Kashipara E‑learning Management System...

CVE-2024-54930

The Kashipara E-learning Management System v1.0 is vulnerable to SQL Injection (CWE-89) within the /admin/delete_student.php endpoint. This vulnerability stems from improper neutralization of special elements used in SQL commands. Exploitation could lead to significant impacts on confidentiality ...

CVE-2024-54935

CVE-2024-54935 describes a Stored Cross-Site Scripting (XSS) in the Kashipara E-learning Management System v1.0. The vulnerability is in /send_message_teacher_to_student.php and is exploitable via the my_message parameter, enabling remote attackers to inject and execute arbitrary scripts. Impact ...

CVE-2024-54923

A SQL Injection vulnerability exists in the kashipara E-learning Management System v1.0 within the /admin/edit_teacher.php endpoint. The flaw is caused by improper neutralization of the department parameter, which allows remote attackers to execute arbitrary SQL commands and gain unauthorized dat...

CVE-2024-54933

Kashipara E-learning Management System v1.0 is vulnerable to SQL Injection in the /admin/delete_content.php endpoint. This vulnerability occurs because the application fails to properly neutralize special elements used in SQL commands, potentially allowing an attacker to inject malicious code. Wh...

CVE-2024-54918

Kashipara E-learning Management System v1.0 is vulnerable to Remote Code Execution (RCE) due to an unrestricted file upload vulnerability in the /teacher_avatar.php endpoint. An attacker can exploit this flaw by uploading arbitrary files to execute malicious code on the target system. No patch is...

CVE-2024-54925

The kashipara E-learning Management System v1.0 is vulnerable to a SQL Injection flaw within the /remove_sent_message.php file. This vulnerability is caused by improper neutralization of special elements in the id parameter, which allows remote attackers to execute arbitrary SQL commands. Success...

CVE-2024-54922

A SQL Injection vulnerability exists in the kashipara E-learning Management System v1.0 within the /admin/edit_user.php file. Remote attackers can exploit the firstname, lastname, and username parameters to execute arbitrary SQL commands, leading to unauthorized database access and the exposure o...

CVE-2024-54931

A SQL Injection vulnerability exists in the kashipara E-learning Management System v1.0 within the /admin/delete_event.php endpoint. The root cause is the improper neutralization of special elements used in an SQL command via the id parameter. This flaw allows remote attackers to execute arbitrar...

CVE-2024-54924

A SQL Injection vulnerability exists in the kashipara E-learning Management System v1.0 within the /admin/edit_content.php endpoint. The flaw allows remote attackers to execute arbitrary SQL commands to obtain unauthorized database access by manipulating the title and content parameters. While no...

CVE-2024-54938

A Directory Listing issue was identified in Kashipara E-Learning Management System v1.0 . This vulnerability allows remote attackers to access sensitive files and directories by interacting with the /admin/uploads API endpoint. The impact includes unauthorized viewing of important files. While no...

CVE-2024-54937

The CVE-2024-54937 entry describes a Directory Listing issue in Kashipara E-Learning Management System v1.0. Affected component: the /admin/assets endpoint. Root cause: directory listing exposure allows remote attackers to access sensitive files and directories, impacting confidentiality. Exploit...

CVE-2024-54919

CVE-2024-54919 affects Kashipara E-learning Management System v1.0, with a Stored Cross-Site Scripting (XSS) in /teacher_avatar.php exploitable via the filename parameter. The root cause is unvalidated/unsanitized user-supplied filename input, enabling an attacker to inject JavaScript that is sto...