CVE-2024-31610

File Upload vulnerability in the function for employees to upload avatars in Code-Projects Simple School Management System v1.0 allows attackers to run arbitrary code via upload of crafted file...

CVE-2024-31610

File Upload vulnerability in the function for employees to upload avatars in Code-Projects Simple School Management System v1.0 allows attackers to run arbitrary code via upload of crafted file...

CVE-2024-31610

CVE-2024-31610 affects Code-Projects Simple School Management System v1.0. The issue is a File Upload vulnerability in the avatar upload function that allows an attacker to execute arbitrary code by uploading a crafted file. Reported metrics indicate a network attack vector with low privileges re...

Code-Projects Simple School Management System 安全漏洞

Code-Projects Simple School Management System is an open source school management system from Code-Projects. A security vulnerability exists in Code-Projects Simple School Management System v1.0, which originates from a file upload vulnerability in the upload avatars feature. An attacker can...

centennialhighschool.org Cross Site Scripting vulnerability OBB-3918023

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

Unifiedtransform 安全漏洞

Unifiedtransform is an open source school management software from Sourceforge Open Source. It allows for comprehensive and efficient management of school operations. A security vulnerability exists in Unifiedtransform v2.X, which stems from vulnerability to stored cross-site scripting XSS attack...

Gibbon School Platform Authenticated PHP Deserialization Vulnerability

A Remote Code Execution vulnerability in Gibbon online school platform version 26.0.00 and lower allows remote authenticated users to conduct PHP deserialization attacks via columnOrder in a POST request to the endpoint /modules/System%20Admin/importrun.php&type=externalAssessment&step=4. As it...

Gibbon School Platform 26.0.00 Remote Code Execution

This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'Gibbon School Platform Authenticated PHP Deserialization Vulnerability', 'Description' = %q A Remote Code Execution vulnerability in Gibbon onlin...

gosfieldschool.org.uk Cross Site Scripting vulnerability OBB-3900038

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

CVE-2024-24724

Gibbon through 26.0.00 allows /modules/School%20Admin/messengerSettings.php Server Side Template Injection leading to Remote Code Execution because input is passed to the Twig template engine messengerSettings.php without sanitization...

Smart School 6.4.1 - SQL Injection

Exploit Title: Smart School 6.4.1 - SQL Injection Exploit Author: CraCkEr Date: 28/09/2023 Vendor: QDocs - qdocs.net Vendor Homepage: https://smart-school.in/ Software Link: https://demo.smart-school.in/ Tested on: Windows 10 Pro Impact: Database Access CVE: CVE-2023-5495 CWE: CWE-89 - CWE-74 -...

Smart School 6.4.1 - SQL Injection Vulnerability

Exploit Title: Smart School 6.4.1 - SQL Injection Exploit Author: CraCkEr Vendor: QDocs - qdocs.net Vendor Homepage: https://smart-school.in/ Software Link: https://demo.smart-school.in/ Tested on: Windows 10 Pro Impact: Database Access CVE: CVE-2023-5495 CWE: CWE-89 - CWE-74 - CWE-707 Greetings...

Trove of UK Student Records Exposed in School Software Server Leak

By Waqas Hundreds of thousands of UK student records exposed in software firm's server leak putting names, grades, and photos at risk - Learn more about the school software breach and how to protect your child's information. This is a post from HackRead.com Read the original post: Trove of UK...

catalogueconfucius.neoma-bs.fr Cross Site Scripting vulnerability OBB-3890407

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

‘Malicious Activity’ Hits the University of Cambridge’s Medical School

Multiple university departments linked to the Clinical School Computing Service have been inaccessible for a month. The university has not revealed the nature of the “malicious activity.”...

galileo.vigoco.k12.in.us Cross Site Scripting vulnerability OBB-3888345

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

sangeradult.sanger.k12.ca.us Cross Site Scripting vulnerability OBB-3884218

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

CVE-2023-49981

A directory listing vulnerability in School Fees Management System v1.0 allows attackers to list directories and sensitive files within the application without requiring authorization...

CVE-2023-49981

A directory listing vulnerability in School Fees Management System v1.0 allows attackers to list directories and sensitive files within the application without requiring authorization...

CVE-2023-49982

Broken access control in the component /admin/management/users of School Fees Management System v1.0 allows attackers to escalate privileges and perform Administrative actions, including adding and deleting user accounts...