4250 matches found
Cross site scripting
A stored cross-site scripting XSS vulnerability in /scas/?page=clubs/applicationform&id=7 of School Club Application System v0.1 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the firstname parameter...
School Club Application System 跨站脚本漏洞
School Club Application System is a school club application system by Carlo Montero Personal Developer. A security vulnerability exists in School Club Application System version 0.1, which originates from a stored cross-site scripting XSS vulnerability in /scas/?page=clubs/applicationform&id=7. A...
CVE-2022-29359
CVE-2022-29359 affects School Club Application System v0.1. It describes a stored XSS vulnerability in /scas/?page=clubs/application_form&id=7 (or id=7) where an attacker can inject a crafted payload via the firstname parameter to execute arbitrary web scripts/HTML. The issue is confirmed across ...
CVE-2022-29359
A stored cross-site scripting XSS vulnerability in /scas/?page=clubs/applicationform&id=7 of School Club Application System v0.1 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the firstname parameter...
School Dormitory Management System SQL Injection Vulnerability (CNVD-2022-66687)
School Dormitory Management System is a school dormitory management system. SQL injection vulnerability exists in School Dormitory Management System v1.0, which originates from /dms/admin/reports/dailycollection The report.php parameter lacks validation for external input SQL statements. An...
WordPress plugin School Management Pro 代码注入漏洞
WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on PHP and MySQL servers.WordPress plugin is an application plugin. A code injection vulnerability exists in th...
Researchers Find Backdoor in School Management Plugin for WordPress
Multiple versions of a WordPress plugin by the name of "School Management Pro" harbored a backdoor that could grant an adversary complete control over vulnerable websites. The issue, spotted in premium versions before 9.9.7, has been assigned the CVE identifier CVE-2022-1609 and is rated 10 out o...
CVE-2022-30886
School Dormitory Management System v1.0 was discovered to contain a SQL injection vulnerability via the month parameter at /dms/admin/reports/dailycollectionreport.php...
CVE-2022-30886
School Dormitory Management System v1.0 was discovered to contain a SQL injection vulnerability via the month parameter at /dms/admin/reports/dailycollectionreport.php...
Sql injection
School Dormitory Management System v1.0 was discovered to contain a SQL injection vulnerability via the month parameter at /dms/admin/reports/dailycollectionreport.php...
CVE-2022-30886
CVE-2022-30886 concerns a SQL injection in School Dormitory Management System v1.0, triggered via the month parameter in /dms/admin/reports/daily_collection_report.php. The vulnerability stems from unsanitized external input feeding a SQL query, enabling an attacker to potentially read/modify dat...
CVE-2022-30886
School Dormitory Management System v1.0 was discovered to contain a SQL injection vulnerability via the month parameter at /dms/admin/reports/dailycollectionreport.php...
WordPress School Management Pro premium plugin < 9.9.7 - Unauthenticated Remote Code Execution (RCE) via REST API
Unauthenticated Remote Code Execution RCE via REST API discovered by Jetpack Scan Team and WordPress elevated support team in WordPress School Management Pro premium plugin versions 9.9.7. Solution Update the WordPress School Management Pro premium plugin to the latest available version at least...
VulnCheck KEV: CVE-2022-1609
The School Management WordPress plugin before 9.9.7 contains an obfuscated backdoor injected in it's license checking code that registers a REST API handler, allowing an unauthenticated attacker to execute arbitrary PHP code on the site...
The School Management < 9.9.7 - Unauthenticated RCE via REST api
The plugin contains an obfuscated backdoor injected in it's license checking code that registers a REST API handler, allowing an unauthenticated attacker to execute arbitrary PHP code on the site. PoC curl -d 'blowfish=1' -d "blowf=system'id';" 'https://examples.com/wp-json/am-member/license'...
The School Management < 9.9.7 - Unauthenticated RCE via REST api
The plugin contains an obfuscated backdoor injected in it's license checking code that registers a REST API handler, allowing an unauthenticated attacker to execute arbitrary PHP code on the site. curl -d 'blowfish=1' -d "blowf=system'id';" 'https://examples.com/wp-json/am-member/license'...
raleighcharterhs.org Cross Site Scripting vulnerability OBB-2617376
Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...
pearsoncanadaschool.com Cross Site Scripting vulnerability OBB-2617325
Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...
School Dormitory Management 1.0 SQL Injection
Title: School Dormitory Management 1.0 SQLi Author: nu11secur1ty Date: 05.09.2022 Vendor: https://www.sourcecodester.com/users/tips23 Software: https://www.sourcecodester.com/php/15319/school-dormitory-management-system-phpoop-free-source-code.html Reference:...
School Dormitory Management System 1.0 SQL Injection
Exploit Title: School Dormitory Management System - 'month' SQL Injection Date: 08/05/2022 Exploit Author: Saud Alenazi Vendor Homepage: https://www.sourcecodester.com/ Software Link: https://www.sourcecodester.com/php/15319/school-dormitory-management-system-phpoop-free-source-code.html Version:...