Open-School 3.0/Community Edition 2.3 - Cross-Site Scripting

Open-School 3.0, and Community Edition 2.3, allows cross-site scripting via the osv/index.php?r=students/guardians/create id parameter. id: CVE-2019-14696 info: name: Open-School 3.0/Community Edition 2.3 - Cross-Site Scripting author: pikpikcu severity: medium description: Open-School 3.0, and...

EUVD-2014-8951

Malware in sbrugna...

EUVD-2019-5893

Malware in sbrugna...

EUVD-2014-8952

Malware in sbrugna...

EUVD-2009-4178

Malware in sbrugna...

CVE-2019-14696

Open-School 3.0, and Community Edition 2.3, allows XSS via the osv/index.php?r=students/guardians/create id parameter...

CVE-2019-14754

Open-School 3.0, and Community Edition 2.3, allows SQL Injection via the index.php?r=students/students/document id parameter...

CVE-2014-9127

Open-School Community Edition 2.2 does not properly restrict access to the export functionality, which allows remote authenticated users to obtain sensitive information via the r parameter with the value export to index.php...

CVE-2014-9126

Multiple cross-site scripting XSS vulnerabilities in Open-School Community Edition 2.2 allow remote attackers to inject arbitrary web script or HTML via the YIICSRFTOKEN HTTP cookie or the StudentDocument, StudentCategories, StudentPreviousDatas parameters to index.php...

Cross site scripting

Multiple cross-site scripting XSS vulnerabilities in Open-School Community Edition 2.2 allow remote attackers to inject arbitrary web script or HTML via the YIICSRFTOKEN HTTP cookie or the StudentDocument, StudentCategories, StudentPreviousDatas parameters to index.php...

Open redirect

Open-School Community Edition 2.2 does not properly restrict access to the export functionality, which allows remote authenticated users to obtain sensitive information via the r parameter with the value export to index.php...

CVE-2014-9127

Open-School Community Edition 2.2 is affected by CVE-2014-9127: an access control bypass in the export feature allows remote authenticated users to view sensitive data via the r parameter set to export on index.php. The issue enables partial confidentiality impact as described in the CVE entry, w...

CVE-2014-9127

Open-School Community Edition 2.2 does not properly restrict access to the export functionality, which allows remote authenticated users to obtain sensitive information via the r parameter with the value export to index.php...

CVE-2014-9126

CVE-2014-9126 affects Open-School Community Edition 2.2. The vulnerability is described as multiple cross-site scripting (XSS) issues that allow remote attackers to inject arbitrary script/HTML via the YII_CSRF_TOKEN HTTP cookie or through the StudentDocument, StudentCategories, and StudentPrevio...

CVE-2014-9126

Multiple cross-site scripting XSS vulnerabilities in Open-School Community Edition 2.2 allow remote attackers to inject arbitrary web script or HTML via the YIICSRFTOKEN HTTP cookie or the StudentDocument, StudentCategories, StudentPreviousDatas parameters to index.php...

PT-2020-7769

Name of the Vulnerable Software and Affected Versions: Open-School Community Edition version 2.2 Description: The issue allows remote attackers to inject arbitrary web script or HTML, potentially leading to cross-site scripting XSS attacks. This can be achieved via the YII CSRF TOKEN HTTP cookie ...

PT-2020-7770

Name of the Vulnerable Software and Affected Versions: Open-School Community Edition version 2.2 Description: The issue concerns improper access restriction to the export functionality. Remote authenticated users can obtain sensitive information by exploiting this weakness. Specifically, the "r"...

CVE-2014-9126: Improper Neutralization of Input During Web Page Generation

Multiple cross-site scripting XSS vulnerabilities in Open-School Community Edition 2.2 allow remote attackers to inject arbitrary web script or HTML via the YIICSRFTOKEN HTTP cookie or the StudentDocument, StudentCategories, StudentPreviousDatas parameters to index.php...

CVE-2014-9127: Exposure of Sensitive Information to an Unauthorized Actor

Open-School Community Edition 2.2 does not properly restrict access to the export functionality, which allows remote authenticated users to obtain sensitive information via the r parameter with the value export to index.php...

Open-School Community Edition Cross-Site Scripting Vulnerability

Open-School is a web-based school management software. The software offers online billing, attendance and online library.Open-School Community Edition is the community edition of Open-School. A cross-site scripting vulnerability exists in Open-School Community Edition version 2.2. The vulnerabili...