CVE-2023-5011: Improper Neutralization of Special Elements used in an SQL Command

Student Information System v1.0 is vulnerable to multiple Authenticated SQL Injection vulnerabilities. The 'coursename' parameter of the marks.php resource does not validate the characters received and they are sent unfiltered to the database...

PT-2023-31466

Name of the Vulnerable Software and Affected Versions Student Information System version 1.0 Description The issue concerns multiple Authenticated SQL Injection vulnerabilities. Specifically, the id parameter of the "marks.php" resource does not validate the characters received, and they are sent...

PT-2023-31471

Name of the Vulnerable Software and Affected Versions Student Information System version 1.0 Description The issue concerns multiple Authenticated SQL Injection vulnerabilities. Specifically, the coursecode parameter of the "marks.php" resource does not validate the characters received and they a...

CVE-2023-5008

Student Information System v1.0 is vulnerable to an unauthenticated SQL Injection vulnerability on the 'regno' parameter of index.php page, allowing an external attacker to dump all the contents of the database contents and bypass the login control...

CVE-2023-5008 Student Information System v1.0 - Unauthenticated SQL Injection

Student Information System v1.0 is vulnerable to an unauthenticated SQL Injection vulnerability on the 'regno' parameter of index.php page, allowing an external attacker to dump all the contents of the database contents and bypass the login control...

CVE-2023-4122

Student Information System v1.0 is vulnerable to an Insecure File Upload vulnerability on the 'photo' parameter of my-profile page, allowing an authenticated attacker to obtain Remote Code Execution on the server hosting the application...

CVE-2023-4122

Student Information System v1.0 is vulnerable to an Insecure File Upload vulnerability on the 'photo' parameter of my-profile page, allowing an authenticated attacker to obtain Remote Code Execution on the server hosting the application...

CVE-2023-4122 Student Information System v1.0 - Insecure File Upload

Student Information System v1.0 is vulnerable to an Insecure File Upload vulnerability on the 'photo' parameter of my-profile page, allowing an authenticated attacker to obtain Remote Code Execution on the server hosting the application...

CVE-2023-4122 Student Information System v1.0 - Insecure File Upload

Student Information System v1.0 is vulnerable to an Insecure File Upload vulnerability on the 'photo' parameter of my-profile page, allowing an authenticated attacker to obtain Remote Code Execution on the server hosting the application...

Student Information System SQL Injection Vulnerability

Student Information System is a web-based application platform by Carlo Montero, a personal developer. It can help a university or college to manage student information and academic records. Student Information System v1.0 suffers from a SQL injection vulnerability that stems from the presence of...

Student Information System Code Issue Vulnerability

Student Information System is a web-based application platform by Carlo Montero, a personal developer. It can help a university or college to manage student information and academic records. A code issue vulnerability exists in Student Information System v1.0 that stems from vulnerability to an...

CVE-2023-5008: Improper Neutralization of Special Elements used in an SQL Command

Student Information System v1.0 is vulnerable to an unauthenticated SQL Injection vulnerability on the 'regno' parameter of index.php page, allowing an external attacker to dump all the contents of the database contents and bypass the login control...

CVE-2023-4122: Unrestricted Upload of File with Dangerous Type

Student Information System v1.0 is vulnerable to an Insecure File Upload vulnerability on the 'photo' parameter of my-profile page, allowing an authenticated attacker to obtain Remote Code Execution on the server hosting the application...

Path traversal

In the module "SoNice Retour" soniceretour up to version 2.1.0 from Common-Services for PrestaShop, a guest can download personal information without restriction by performing a path traversal attack. Due to a lack of permissions control and a lack of control in the path name construction, a gues...

CVE-2023-45382

In the module "SoNice Retour" soniceretour up to version 2.1.0 from Common-Services for PrestaShop, a guest can download personal information without restriction by performing a path traversal attack. Due to a lack of permissions control and a lack of control in the path name construction, a gues...

7 common mistakes companies make when creating an incident response plan and how to avoid them

Cisco Talos recently covered the basics of NIS2, a new set of requirements for cybersecurity and security incident disclosures set to take effect next year in the European Union. As part of these new guidelines, organizations with operations in the EU must have up-to-date "incident handling"...

CVE-2023-38965

Lost and Found Information System 1.0 allows account takeover via username and password to a /classes/Users.php?f=save URI...

CVE-2023-38965

Lost and Found Information System 1.0 allows account takeover via username and password to a /classes/Users.php?f=save URI...

Default credentials

Lost and Found Information System 1.0 allows account takeover via username and password to a /classes/Users.php?f=save URI...

CVE-2023-38965

CVE-2023-38965 affects Lost and Found Information System v1.0. The vulnerability is an insecure direct object reference at the API endpoint /classes/Users.php?f=save, which allows account takeover by supplying a crafted username and password (IDOR). Public references include Exploit-DB and Packet...