School Fees Management System Security Breach

School Fees Management System is a tuition management system. A security vulnerability exists in School Fees Management System version 1.0. An attacker can exploit this vulnerability to execute arbitrary web script or HTML via a specially crafted payload that injects the name parameter...

CVE-2023-49986

A cross-site scripting (XSS) vulnerability exists in the School Fees Management System v1.0 within the /admin/parent component (specifically the add_new_parent function). Attackers can execute arbitrary web scripts or HTML by injecting a crafted payload into the name or email parameters. A user w...

CVE-2023-49987

The School Fees Management System v1.0 is vulnerable to a cross-site scripting (XSS) flaw within the /management/term component. An attacker can execute arbitrary web scripts or HTML by injecting a crafted payload into the tname parameter, specifically during the process of adding or editing a pe...

CVE-2023-49987

A cross-site scripting XSS vulnerability in the component /management/term of School Fees Management System v1.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the tname parameter...

CVE-2023-49987: Improper Neutralization of Input During Web Page Generation

A cross-site scripting XSS vulnerability in the component /management/term of School Fees Management System v1.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the tname parameter...

CVE-2023-49981

The vulnerability CVE-2023-49981 affects School Fees Management System v1.0 and is a directory listing flaw caused by an improper access control/logic that allows unauthenticated users to enumerate directories and sensitive files. The CVSS v3.1 base score is 7.5 (HIGH) with NETWORK attack vector,...

CVE-2023-49981

A directory listing vulnerability in School Fees Management System v1.0 allows attackers to list directories and sensitive files within the application without requiring authorization...

CVE-2023-49982

Broken access control in the component /admin/management/users of School Fees Management System v1.0 allows attackers to escalate privileges and perform Administrative actions, including adding and deleting user accounts...

CVE-2023-49984

School Fees Management System v1.0 is vulnerable to a cross-site scripting (XSS) vulnerability in the /management/settings component. Attackers can execute arbitrary web scripts or HTML by injecting a crafted payload into the name parameter. Other susceptible parameters in the same area include p...

CVE-2023-49982

School Fees Management System v1.0 is vulnerable to broken access control within the /admin/management/users component (along with /ci_fms/admin/management/class, /term, and /settings). This flaw allows an authenticated user to escalate privileges and perform unauthorized Administrative actions ,...

CVE-2023-49982

Broken access control in the component /admin/management/users of School Fees Management System v1.0 allows attackers to escalate privileges and perform Administrative actions, including adding and deleting user accounts...

CVE-2023-49982: Incorrect Authorization

Broken access control in the component /admin/management/users of School Fees Management System v1.0 allows attackers to escalate privileges and perform Administrative actions, including adding and deleting user accounts...

CVE-2023-49983: Improper Neutralization of Input During Web Page Generation

A cross-site scripting XSS vulnerability in the component /management/class of School Fees Management System v1.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the name parameter...

CVE-2023-49981

A directory listing vulnerability in School Fees Management System v1.0 allows attackers to list directories and sensitive files within the application without requiring authorization...

CVE-2023-49985

A cross-site scripting XSS vulnerability in the component /management/class of School Fees Management System v1.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the cname parameter...

CVE-2023-49984

A cross-site scripting XSS vulnerability in the component /management/settings of School Fees Management System v1.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the name parameter...

CVE-2023-49981: Missing Authorization

A directory listing vulnerability in School Fees Management System v1.0 allows attackers to list directories and sensitive files within the application without requiring authorization...

CVE-2023-49984: Improper Neutralization of Input During Web Page Generation

A cross-site scripting XSS vulnerability in the component /management/settings of School Fees Management System v1.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the name parameter...

CVE-2023-49985: Improper Neutralization of Input During Web Page Generation

A cross-site scripting XSS vulnerability in the component /management/class of School Fees Management System v1.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the cname parameter...

CVE-2023-49983

A cross-site scripting (XSS) vulnerability exists in the /management/class component of School Fees Management System v1.0 . The flaw allows attackers to execute arbitrary web scripts or HTML by injecting a crafted payload into the name parameter. To exploit this, a user with appropriate permissi...