Unrestricted file upload

A file upload vulnerability exists in Sourcecodester Engineers Online Portal in PHP via dashboardteacher.php, which allows changing the avatar through teacheravatar.php. Once an avatar gets uploaded it is getting uploaded to the /admin/uploads/ directory, and is accessible by all users. By...

Authorization

An incorrect access control vulnerability exists in Sourcecodester Engineers Online Portal in PHP in niamunozmonitoringsystem/admin/uploads. An attacker can leverage this vulnerability in order to bypass access controls and access all the files uploaded to the web server without the need of...

Sql injection

An SQL Injection vulnerability exists in Sourcecodester Engineers Online Portal in PHP via the login form inside of index.php, which can allow an attacker to bypass authentication...

CVE-2021-42666

A SQL Injection vulnerability exists in Sourcecodester Engineers Online Portal in PHP via the id parameter to quizquestion.php, which could let a malicious user extract sensitive data from the web server and in some cases use this vulnerability in order to get a remote code execution on the remot...

Cross site scripting

A Stored Cross Site Scripting XSS Vulneraibiilty exists in Sourcecodester Engineers Online Portal in PHP via the 1 Quiz title and 2 quiz description parameters to addquiz.php. An attacker can leverage this vulnerability in order to run javascript commands on the web server surfers behalf, which c...

CVE-2021-42669

A file upload vulnerability exists in Sourcecodester Engineers Online Portal in PHP via dashboardteacher.php, which allows changing the avatar through teacheravatar.php. Once an avatar gets uploaded it is getting uploaded to the /admin/uploads/ directory, and is accessible by all users. By...

CVE-2021-42665

An SQL Injection vulnerability exists in Sourcecodester Engineers Online Portal in PHP via the login form inside of index.php, which can allow an attacker to bypass authentication...

CVE-2021-42671

An incorrect access control vulnerability exists in Sourcecodester Engineers Online Portal in PHP in niamunozmonitoringsystem/admin/uploads. An attacker can leverage this vulnerability in order to bypass access controls and access all the files uploaded to the web server without the need of...

CVE-2021-42671

CVE-2021-42671 (and related CVEs 42669) describe an unauthorized access/control flaw in Sourcecodester Engineers Online Portal (PHP) within nia_munoz_monitoring_system/admin/uploads. The issue enables bypassing access controls to view all files uploaded to the web server without authentication or...

CVE-2021-42671

An incorrect access control vulnerability exists in Sourcecodester Engineers Online Portal in PHP in niamunozmonitoringsystem/admin/uploads. An attacker can leverage this vulnerability in order to bypass access controls and access all the files uploaded to the web server without the need of...

CVE-2021-42670

CVE-2021-42670 affects Sourcecodester Engineers Online Portal (PHP) with a SQL injection in the announcements_student.php id parameter. The vulnerability allows an attacker to manipulate SQL queries to extract data from the web server, with potential remote code execution in some scenarios as des...

CVE-2021-42669

CVE-2021-42669 is a PHP file-upload vulnerability in Sourcecodester Engineers Online Portal (via dashboard_teacher.php and avatar upload through teacher_avatar.php). An uploaded avatar is stored under /admin/uploads/ and is accessible to all users. Attackers can upload a PHP webshell containing ...

CVE-2021-42669

A file upload vulnerability exists in Sourcecodester Engineers Online Portal in PHP via dashboardteacher.php, which allows changing the avatar through teacheravatar.php. Once an avatar gets uploaded it is getting uploaded to the /admin/uploads/ directory, and is accessible by all users. By...

CVE-2021-42668

A SQL Injection vulnerability exists in Sourcecodester Engineers Online Portal in PHP via the id parameter in the myclassmates.php web page.. As a result, an attacker can extract sensitive data from the web server and in some cases can use this vulnerability in order to get a remote code executio...

CVE-2021-42668

The CVE-2021-42668 entry concerns an SQL Injection in Sourcecodester Engineers Online Portal (PHP) via the id parameter in my_classmates.php. Affects the vulnerable page and parameter, enabling an attacker to extract sensitive data from the web server; in some cases it can lead to remote code exe...

CVE-2021-42666

Sourcecodester Engineers Online Portal (PHP) is affected by CVE-2021-42666 due to an SQL injection in the id parameter of quiz_question.php. The vulnerability allows an attacker to extract sensitive data from the web server, and in some cases may lead to remote code execution on the server. Publi...

CVE-2021-42666

A SQL Injection vulnerability exists in Sourcecodester Engineers Online Portal in PHP via the id parameter to quizquestion.php, which could let a malicious user extract sensitive data from the web server and in some cases use this vulnerability in order to get a remote code execution on the remot...

CVE-2021-42665

An SQL Injection vulnerability exists in Sourcecodester Engineers Online Portal in PHP via the login form inside of index.php, which can allow an attacker to bypass authentication...

CVE-2021-42665

CVE-2021-42665 affects the Sourcecodester Engineers Online Portal (PHP) via the login.php form. The vulnerability is an SQL Injection in the authentication routine that can allow bypassing login without valid credentials. Affected component is the login mechanism (username/password fields), with ...

CVE-2021-42664

A Stored Cross Site Scripting XSS Vulneraibiilty exists in Sourcecodester Engineers Online Portal in PHP via the 1 Quiz title and 2 quiz description parameters to addquiz.php. An attacker can leverage this vulnerability in order to run javascript commands on the web server surfers behalf, which c...