CVE-2023-26579 Missing Authentication In IDAttend’s IDWeb Application

Missing authentication in the DeleteStaff method in IDAttend’s IDWeb application 3.1.013 allows deletion of staff information by unauthenticated attackers...

CVE-2023-26578 Arbitrary File Upload to Web Root In IDAttend’s IDWeb Application

Arbitrary file upload to web root in the IDAttend’s IDWeb application 3.1.013 allows authenticated attackers to upload dangerous files to web root such as ASP or ASPX, gaining command execution on the affected server...

CVE-2023-26576 Missing Authentication In IDAttend’s IDWeb Application

Missing authentication in the SearchStudentsRFID method in IDAttend’s IDWeb application 3.1.052 and earlier allows extraction sensitive student data by unauthenticated attackers...

CVE-2023-26575 Missing Authentication In IDAttend’s IDWeb Application

Missing authentication in the SearchStudentsStaff method in IDAttend’s IDWeb application 3.1.052 and earlier allows extraction sensitive student and teacher data by unauthenticated attackers...

CVE-2023-26574

CVE-2023-26574 concerns the IDAttend IDWeb application (versions 3.1.052 and earlier). The root cause is a missing authentication check in the SearchStudents method, allowing unauthenticated attackers to extract sensitive student data. Impact, per sources, is elevated by the ability to access con...

CVE-2023-26572 Unauthenticated SQL Injection In IDAttend’s IDWeb Application

Unauthenticated SQL injection in the GetExcursionList method in IDAttend’s IDWeb application 3.1.052 and earlier allows extraction or modification of all data by unauthenticated attackers...

CVE-2023-26571 Missing Authentication In IDAttend’s IDWeb Application

Missing authentication in the SetStudentNotes method in IDAttend’s IDWeb application 3.1.052 and earlier allows modification of student data by unauthenticated attackers...

CVE-2023-26568 Unauthenticated SQL Injection In IDAttend’s IDWeb Application

Unauthenticated SQL injection in the GetStudentGroupStudents method in IDAttend’s IDWeb application 3.1.052 and earlier allows extraction or modification of all data by unauthenticated attackers...

PT-2023-21033 · Idweb · Idweb

Name of the Vulnerable Software and Affected Versions: IDWeb application versions 3.1.052 and earlier Description: The issue is related to an unauthenticated SQL injection in the GetRoomChanges method, allowing unauthenticated attackers to extract or modify all data. Recommendations: For versions...

PT-2023-20749 · Idweb · Idweb

Name of the Vulnerable Software and Affected Versions: IDWeb application versions 3.1.052 and earlier Description: The issue concerns an unauthenticated SQL injection in the GetExcursionDetails method. This allows unauthenticated attackers to extract or modify all data. Recommendations: For...

PT-2023-20748 · Idweb · Idweb

Name of the Vulnerable Software and Affected Versions: IDWeb application versions 3.1.052 and earlier Description: The issue concerns an unauthenticated SQL injection in the GetVisitors method, allowing unauthenticated attackers to extract or modify all data. Recommendations: For versions 3.1.052...

PT-2023-16923 · Idweb · Idweb

Name of the Vulnerable Software and Affected Versions: IDWeb application versions 3.1.052 and earlier Description: The issue is related to reflected cross-site scripting in the StudentSearch component, allowing attackers to hijack a user's browsing session if the user clicks on a malicious link...

PT-2023-20743 · Idattend · Idweb

Name of the Vulnerable Software and Affected Versions: IDAttend's IDWeb application versions 3.1.052 and earlier Description: The issue allows attackers to hijack the browsing session of the logged-in user through stored cross-site scripting in the IDWeb application. Recommendations: For versions...

PT-2023-20750 · Idweb · Idweb

Name of the Vulnerable Software and Affected Versions: IDWeb application versions 3.1.052 and earlier Description: The issue concerns an unauthenticated SQL injection in the GetCurrentPeriod method, allowing unauthenticated attackers to extract or modify all data. Recommendations: For versions...

PT-2023-20744 · Idweb · Idweb

Name of the Vulnerable Software and Affected Versions: IDWeb application version 3.1.013 Description: The issue allows authenticated attackers to upload arbitrary files to the web root, including dangerous files such as ASP or ASPX, which can lead to command execution on the affected server...