CVE-2024-54923

A SQL Injection vulnerability was found in /admin/editteacher.php in kashipara E-learning Management System v1.0, which allows remote attackers to execute arbitrary SQL commands to get unauthorized database access via the department parameter...

CVE-2024-54920

A SQL Injection vulnerability was found in /teachersignup.php of kashipara E-learning Management System v1.0, which allows remote attackers to execute arbitrary SQL command to get unauthorized database access via the firstname, lastname, and classid parameters...

CVE-2024-54933

Kashipara E-learning Management System v1.0 is vulnerable to SQL Injection in /admin/deletecontent.php...

CVE-2024-54934

Kashipara E-learning Management System v1.0 is vulnerable to SQL Injection in /admin/deleteclass.php...

CVE-2024-54934

The Kashipara E-learning Management System v1.0 is vulnerable to SQL Injection within the /admin/delete_class.php endpoint. This flaw allows an attacker to inject malicious SQL code, potentially compromising the underlying database. While no official patch is currently available, it is recommende...

PT-2024-36446 · Unknown · Kashipara E-Learning Management System

Name of the Vulnerable Software and Affected Versions: Kashipara E-learning Management System version 1.0 Description: The issue is related to a SQL Injection vulnerability in the /admin/delete teacher.php file. This vulnerability can be exploited through the delete teacher.php API endpoint. No...

CVE-2024-54923

A SQL Injection vulnerability exists in the kashipara E-learning Management System v1.0 within the /admin/edit_teacher.php endpoint. Remote attackers can exploit the department parameter to execute arbitrary SQL commands, potentially gaining unauthorized database access . While no official patch ...

CVE-2024-54936

A Stored Cross-Site Scripting XSS vulnerability was found in /sendmessage.php of Kashipara E-learning Management System v1.0. This vulnerability allows remote attackers to execute arbitrary scripts via the mymessage parameter...

CVE-2024-54930

Kashipara E-learning Management System v1.0 is vulnerable to SQL Injection in the /admin/delete_student.php endpoint. This vulnerability allows for potential exploitation of the underlying database. As a temporary workaround, it is recommended to restrict access to the affected endpoint and avoid...

CVE-2024-54919

CVE-2024-54919 affects Kashipara E-learning Management System v1.0, with a Stored Cross-Site Scripting (XSS) in /teacher_avatar.php exploitable via the filename parameter. The root cause is unvalidated/unsanitized user-supplied filename input, enabling an attacker to inject JavaScript that is sto...

CVE-2024-54937

The CVE-2024-54937 entry describes a Directory Listing issue in Kashipara E-Learning Management System v1.0. Affected component: the /admin/assets endpoint. Root cause: directory listing exposure allows remote attackers to access sensitive files and directories, impacting confidentiality. Exploit...

CVE-2024-54924

A SQL Injection vulnerability exists in the kashipara E-learning Management System v1.0 within the /admin/edit_content.php endpoint. The flaw allows remote attackers to execute arbitrary SQL commands to gain unauthorized database access by manipulating the title and content parameters. No patch i...

CVE-2024-54934: Improper Neutralization of Special Elements used in an SQL Command

Kashipara E-learning Management System v1.0 is vulnerable to SQL Injection in /admin/deleteclass.php...

CVE-2024-54933: Improper Neutralization of Special Elements used in an SQL Command

Kashipara E-learning Management System v1.0 is vulnerable to SQL Injection in /admin/deletecontent.php...

CVE-2024-54922: Improper Neutralization of Special Elements used in an SQL Command

A SQL Injection was found in /admin/edituser.php of kashipara E-learning Management System v1.0, which allows remote attackers to execute arbitrary SQL commands to get unauthorized database access via the firstname, lastname, and username parameters...

CVE-2024-54932: Improper Neutralization of Special Elements used in an SQL Command

Kashipara E-learning Management System v1.0 is vulnerable to SQL Injection in /admin/deletedepartment.php...

CVE-2024-54921: Improper Neutralization of Special Elements used in an SQL Command

A SQL Injection was found in /studentsignup.php in kashipara E-learning Management System v1.0, which allows remote attackers to execute arbitrary SQL commands to get unauthorized database access via the username, firstname, lastname, and classid parameters...

CVE-2024-54930: Improper Neutralization of Special Elements used in an SQL Command

Kashipara E-learning Management System v1.0 is vulnerable to SQL Injection in /admin/deletestudent.php...

CVE-2024-54921

A SQL Injection was found in /studentsignup.php in kashipara E-learning Management System v1.0, which allows remote attackers to execute arbitrary SQL commands to get unauthorized database access via the username, firstname, lastname, and classid parameters...

Kashipara E-learning Management System 安全漏洞

Kashipara E-learning Management System is a learning management system from Kashipara. A security vulnerability exists in Kashipara E-learning Management System v1.0, which stems from an SQL injection vulnerability in /admin/deletedepartment.php...