CVE-2024-45058

CVE-2024-45058 affects Portabilis Portábilis i-Educar prior to version 2.9. The issue resides in ieducar/intranet/educar_usuario_cad.php where a crafted POST to /intranet/educar_usuario_cad.php can change a user’s type by altering the nivel_usuario_ parameter, because the script does not verify t...

CVE-2024-45058 Privilege escalation in i-Educar

i-Educar is free, fully online school management software that can be used by school secretaries, teachers, coordinators, and area managers. Prior to the 2.9 branch, an attacker with only minimal viewing privileges in the settings section is able to change their user type to Administrator or...

CVE-2024-45058 Privilege escalation in i-Educar

i-Educar is free, fully online school management software that can be used by school secretaries, teachers, coordinators, and area managers. Prior to the 2.9 branch, an attacker with only minimal viewing privileges in the settings section is able to change their user type to Administrator or...

CVE-2024-45058 Privilege escalation in i-Educar

i-Educar is free, fully online school management software that can be used by school secretaries, teachers, coordinators, and area managers. Prior to the 2.9 branch, an attacker with only minimal viewing privileges in the settings section is able to change their user type to Administrator or...

CVE-2024-45057

The CVE-2024-45057 entry describes a Reflected Cross-Site Scripting (XSS) vulnerability in i-Educar prior to v2.9. The issue arises from insufficient validation/sanitization of user-controlled input in the dynamic generation of HTML fields, specifically in the file intranet/include/clsCampos.inc....

CVE-2024-45057 Reflected Cross-Site Scripting in i-Educar

i-Educar is free, fully online school management software that can be used by school secretaries, teachers, coordinators, and area managers. A Reflected Cross-Site Scripting XSS vulnerability was identified in the dynamic generation of HTML fields prior to the 2.9 branch. The file located at...

CVE-2024-45057 Reflected Cross-Site Scripting in i-Educar

i-Educar is free, fully online school management software that can be used by school secretaries, teachers, coordinators, and area managers. A Reflected Cross-Site Scripting XSS vulnerability was identified in the dynamic generation of HTML fields prior to the 2.9 branch. The file located at...

CVE-2024-45057 Reflected Cross-Site Scripting in i-Educar

i-Educar is free, fully online school management software that can be used by school secretaries, teachers, coordinators, and area managers. A Reflected Cross-Site Scripting XSS vulnerability was identified in the dynamic generation of HTML fields prior to the 2.9 branch. The file located at...

Portábilis i-Educar 安全漏洞

Portábilis i-Educar is an application from Portábilis. It can easily help you with basic and technical education. A security vulnerability exists in Portábilis i-Educar, which stems from the fact that lack of cleanup of user-controlled parameters used to dynamically generate HTML field values can...

PT-2024-31410 · I-Educar · I-Educar

Name of the Vulnerable Software and Affected Versions: i-Educar versions prior to 2.9 Description: A SQL Injection vulnerability was found in the ieducar/intranet/funcionario vinculo det.php file, which creates the query by concatenating the unsanitized GET parameter cod func, allowing the attack...

Portábilis i-Educar 安全漏洞

Portábilis i-Educar is an application from Portábilis. It can easily help you with basic and technical education. Portábilis i-Educar has a security vulnerability that stems from the ability to change its user type to administrator...

Portábilis i-Educar 安全漏洞

Portábilis i-Educar is an application from Portábilis. It can easily help you with basic and technical education. A security vulnerability exists in Portábilis i-Educar that stems from not validating user input...

PT-2024-31409 · I-Educar · I-Educar

Name of the Vulnerable Software and Affected Versions: i-Educar versions prior to 2.9 Description: The issue allows an attacker with minimal viewing privileges in the settings section to change their user type to Administrator or another type with super-permissions. This can be achieved through a...

WordPress Z Y N I T H plugin <= 7.4.9 - Unauthenticated Plugin Settings Change vulnerability

Unauthenticated Plugin Settings Change vulnerability discovered by Dave Jong Patchstack in WordPress Plugin Z Y N I T H versions = 7.4.9...

WordPress Z Y N I T H Plugin <= 7.4.9 is vulnerable to Settings Change

Software Z Y N I T H Type Plugin Vulnerable versions = 7.4.9 Fixed in N/A OWASP Top 10 A1: Broken Access Control Classification Settings Change CVE CVE-2024-43939 Patch priority Medium CVSS severity Medium 6.5 Developer Claim ownership PSID 7f62f3b06158 Credits Dave Jong Patchstack Required...

WordPress Z Y N I T H Plugin <= 7.4.9 is vulnerable to Settings Change

Software Z Y N I T H Type Plugin Vulnerable versions = 7.4.9 Fixed in N/A OWASP Top 10 A1: Broken Access Control Classification Settings Change CVE CVE-2024-43940 Patch priority Medium CVSS severity Medium 6.5 Developer Claim ownership PSID b82e28b179e8 Credits Dave Jong Patchstack Required...

CVE-2024-7427

CVE-2024-7427 is an XSS vulnerability in OpenText Network Node Manager i (NNMi). Affected NNMi versions are 2022.11, 2023.05, 23.4, and 24.2, with the root cause being improper neutralization of input during web page generation. Impact is Cross-Site Scripting (XSS); CVSS v4 base score is 4.8 (MED...

CVE-2024-7427 Potential Cross-Site Scripting vulnerability affect OpenText™ Network Node Manager i (NNMi).

Improper Neutralization of Input During Web Page Generation XSS or 'Cross-site Scripting' vulnerability in OpenText™ Network Node Manager i NNMi could allow Cross-Site Scripting XSS.This issue affects Network Node Manager i NNMi: 2022.11, 2023.05, 23.4, 24.2...

CVE-2024-7428 Potential Open Redirect issues affect OpenText™ Network Node Manager i (NNMi).

URL Redirection to Untrusted Site 'Open Redirect' vulnerability in OpenText™ Network Node Manager i NNMi allows URL Redirector Abuse.This issue affects Network Node Manager i NNMi: 2022.11, 2023.05, 23.4, 24.2...

CVE-2024-7428

OpenText Network Node Manager i (NNMi) is affected by a URL Redirection to Untrusted Site (Open Redirect) vulnerability. The issue targets NNMi versions 2022.11, 2023.05, 23.4, and 24.2 and is described as allowing URL redirector abuse. The root cause is an open redirect condition that enables re...