CVE-2021-42664

The CVE-2021-42664 entry corresponds to a stored XSS in Sourcecodester Engineers Online Portal (PHP). Affected page: add_quiz.php with vulnerable inputs quiz_title and quiz_description (description parameters). Exploitation allows injected JavaScript to execute in victims’ browsers, potentially e...

PT-2021-23651

Name of the Vulnerable Software and Affected Versions Sourcecodester Engineers Online Portal affected versions not specified Description A SQL injection issue exists via the id parameter to the "announcements student.php" web page, allowing a malicious user to extract sensitive data from the web...

PT-2021-23646

Name of the Vulnerable Software and Affected Versions Sourcecodester Engineers Online Portal affected versions not specified Description A security issue exists in the login form of the Sourcecodester Engineers Online Portal, specifically in the index.php file, allowing an attacker to bypass...

Engineers Online Portal Access Control Vulnerability

Sourcecodester Engineers Online Portal is an open source online portal. niamunozmonitoringsystem/admin/uploads of Sourcecodester Engineers Online Portal in PHP is vulnerable to An access control error vulnerability can be exploited to bypass access control and access all files uploaded to the web...

Engineers Online Portal Cross-Site Script Vulnerabilities

Sourcecodester Engineers Online Portal is an open source online portal. sourcecodester Engineers Online Portal in PHP is vulnerable to a cross-site scripting vulnerability. An attacker can exploit the vulnerability to run javascript commands via the addquiz.php quiz title and quiz description...

CVE-2021-42671: Direct Request

An incorrect access control vulnerability exists in Sourcecodester Engineers Online Portal in PHP in niamunozmonitoringsystem/admin/uploads. An attacker can leverage this vulnerability in order to bypass access controls and access all the files uploaded to the web server without the need of...

CVE-2021-42670: Improper Neutralization of Special Elements used in an SQL Command

A SQL injection vulnerability exists in Sourcecodester Engineers Online Portal in PHP via the id parameter to the announcementsstudent.php web page. As a result a malicious user can extract sensitive data from the web server and in some cases use this vulnerability in order to get a remote code...

CVE-2021-42666: Improper Neutralization of Special Elements used in an SQL Command

A SQL Injection vulnerability exists in Sourcecodester Engineers Online Portal in PHP via the id parameter to quizquestion.php, which could let a malicious user extract sensitive data from the web server and in some cases use this vulnerability in order to get a remote code execution on the remot...

PT-2021-23652

Name of the Vulnerable Software and Affected Versions Sourcecodester Engineers Online Portal affected versions not specified Description An incorrect access control issue exists in the Sourcecodester Engineers Online Portal in PHP, specifically in the nia munoz monitoring system/admin/uploads...

PT-2021-23650

Name of the Vulnerable Software and Affected Versions Sourcecodester Engineers Online Portal affected versions not specified Description A file upload issue exists, allowing attackers to change the avatar through teacher avatar.php in dashboard teacher.php. Uploaded files are stored in the...

PT-2021-23645

Name of the Vulnerable Software and Affected Versions Sourcecodester Engineers Online Portal affected versions not specified Description A Stored Cross Site Scripting XSS issue exists in the Sourcecodester Engineers Online Portal in PHP. This is due to the quiz title and quiz description paramete...

Engineers Online Portal SQL Injection Vulnerability

Sourcecodester Engineers Online Portal is an open source online portal. sourcecodester Engineers Online Portal in PHP is vulnerable to SQL injection. An attacker can exploit the vulnerability to extract sensitive data from the web server via the id parameter of quizquestion.php and, in some cases...

Engineers Online Portal SQL Injection Vulnerability

Sourcecodester Engineers Online Portal is an open source online portal. Sourcecodester Engineers Online Portal in PHP is vulnerable to SQL injection, which can be exploited by attackers to extract sensitive data from the web server via the announcesstudent.php id parameter of announcesstudent.php...

CVE-2021-42669: Unrestricted Upload of File with Dangerous Type

A file upload vulnerability exists in Sourcecodester Engineers Online Portal in PHP via dashboardteacher.php, which allows changing the avatar through teacheravatar.php. Once an avatar gets uploaded it is getting uploaded to the /admin/uploads/ directory, and is accessible by all users. By...

Engineers Online Portal SQL Injection Vulnerability

Sourcecodester Engineers Online Portal is an open source online portal. Sourcecodester Engineers Online Portal in PHP is vulnerable to SQL injection, which can be exploited by attackers to bypass authentication via the login form in index.php...

PT-2021-23649

Name of the Vulnerable Software and Affected Versions Sourcecodester Engineers Online Portal affected versions not specified Description A SQL Injection issue exists in the Sourcecodester Engineers Online Portal in PHP, specifically via the id parameter in the "my classmates.php" web page. This...

CVE-2021-42668: Improper Neutralization of Special Elements used in an SQL Command

A SQL Injection vulnerability exists in Sourcecodester Engineers Online Portal in PHP via the id parameter in the myclassmates.php web page.. As a result, an attacker can extract sensitive data from the web server and in some cases can use this vulnerability in order to get a remote code executio...

CVE-2021-42665: Improper Neutralization of Special Elements used in an SQL Command

An SQL Injection vulnerability exists in Sourcecodester Engineers Online Portal in PHP via the login form inside of index.php, which can allow an attacker to bypass authentication...

CVE-2021-42664: Improper Neutralization of Input During Web Page Generation

A Stored Cross Site Scripting XSS Vulneraibiilty exists in Sourcecodester Engineers Online Portal in PHP via the 1 Quiz title and 2 quiz description parameters to addquiz.php. An attacker can leverage this vulnerability in order to run javascript commands on the web server surfers behalf, which c...

PT-2021-23647

Name of the Vulnerable Software and Affected Versions Sourcecodester Engineers Online Portal affected versions not specified Description A SQL Injection issue exists in the Sourcecodester Engineers Online Portal in PHP, specifically via the id parameter to "quiz question.php". This could allow a...