7 matches found
CVE-2026-35678
漏洞研究报告：All Eduplus 学生 ERP 不安全的直接对象引用（IDOR） 研究人员：Vinay Sharma 1. 执行摘要 本报告详细介绍了在 Eduplus 学生 ERP 平台中发现的一个高严重性安全漏洞，具体位于学生学习者门户（learnerapi.pceterp.in）中。该应用程序在考试表单提交端点上存在通用不安全的直接对象引用（IDOR）漏洞，允许任何已认证用户（学生）通过操纵表单标识符来检索任何其他学生的敏感个人和财务数据。 该漏洞允许大规模收集学生记录数据，包括个人身份信息（PII）和详细的财务交易审计跟踪。 2. 漏洞详情 目标主机：...
PT-2026-55780
Name of the Vulnerable Software and Affected Versions SourceCodester Class and Exam Timetabling System version 1.0 Description An issue exists in the /edit exam.php file where improper handling of the ID argument allows for SQL injection. This flaw enables a remote attacker to manipulate database...
CVE-2025-25616
The open-source school management software Unifiedtransform version 2.0 is vulnerable to Incorrect Access Control (CWE-284). This flaw allows students to bypass authorization to modify exam rules via the /exams/edit-rule?exam_rule_id=1 endpoint. By manipulating the exam_rule_id parameter, an atta...
PT-2024-26255 · Unknown · Campcodes Complete Web-Based School Management System
Name of the Vulnerable Software and Affected Versions: Campcodes Complete Web-Based School Management System version 1.0 Description: A SQL injection issue allows an attacker to execute arbitrary SQL commands via the name parameter in the "/model/update exam.php" API endpoint. Recommendations: Fo...
The vulnerability of the LearnDash plugin’s interface in the WordPress content management system allows a hacker to gain unauthorized access to protected information.
The vulnerability of the LearnDash plugin’s interface in the WordPress content management system is related to insufficient protection of operational data during the processing of the sfwd-question and ld-exam endpoints. Exploiting this vulnerability can allow an attacker, operating remotely, to...
PT-2023-8521 · WordPress · Learndash Lms
Name of the Vulnerable Software and Affected Versions: LearnDash LMS plugin for WordPress versions up to, and including, 4.10.1 Description: The issue is related to Sensitive Information Exposure, which can be exploited via API, allowing unauthenticated attackers to obtain access to quizzes. The...
