Open-School 3.0 / Community Edition 2.3 Cross Site Scripting

Exploit Title: title Date: 2019 08 06 Exploit Author: Greg.Priest Vendor Homepage: https://open-school.org/ Software Link: Version: Open-School 3.0/Community Edition 2.3 Tested on: Windows/Linux CVE : CVE-2019-14696 Open-School 3.0, and Community Edition 2.3, allows XSS via the...

Open-School Cross-Site Scripting Vulnerability

Open-School is a web-based school management software. The software offers online billing, attendance and online library.Open-School Community Edition is the community edition of Open-School. A cross-site scripting vulnerability exists in Open-School version 3.0 and Community Edition version 2.3...

CVE-2019-14696

Open-School 3.0, and Community Edition 2.3, allows XSS via the osv/index.php?r=students/guardians/create id parameter...

CVE-2019-14696

Open-School 3.0, and Community Edition 2.3, allows XSS via the osv/index.php?r=students/guardians/create id parameter...

Design/Logic Flaw

Open-School 3.0, and Community Edition 2.3, allows XSS via the osv/index.php?r=students/guardians/create id parameter...

CVE-2019-14696

CVE-2019-14696 affects Open-School 3.0 and Community Edition 2.3, exposing a Cross-Site Scripting (XSS) flaw. The vulnerability occurs in the GET parameter osv/index.php?r=students/guardians/create id, allowing injection of arbitrary JavaScript in the victim’s browser. This could enable session h...

CVE-2019-14696

Open-School 3.0, and Community Edition 2.3, allows XSS via the osv/index.php?r=students/guardians/create id parameter...

Wanted: Cybersecurity Imagery

Eli Sugarman of the Hewlettt Foundation laments about the sorry state of cybersecurity imagery: The state of cybersecurity imagery is, in a word, abysmal. A simple Google Image search for the term proves the point: It's all white men in hoodies hovering menacingly over keyboards, green...

admin-indiana-school-deaf.schoolsitepro.com Cross Site Scripting vulnerability

Security Researcher Gh05tPT Helped patch 6846 vulnerabilities Received 10 Coordinated Disclosure badges Received 48 recommendations , a holder of 10 badges for responsible and coordinated disclosure, found a security vulnerability affecting admin-indiana-school-deaf.schoolsitepro.com website and...

PHP Scripts Mall School College Portal with ERP Script Cross-Site Scripting Vulnerability

PHP Scripts Mall School College Portal with ERP Script is a school management system from PHP Scripts Mall India. A cross-site scripting vulnerability exists in /pro-school/index.php?student/message/sendreply/ in PHP Scripts Mall School College Portal with ERP Script 2.6.1 and earlier versions. T...

CVE-2019-1010028

phpscriptsmall.com School College Portal with ERP Script 2.6.1 and earlier is affected by: Cross Site Scripting XSS. The impact is: Attack administrators and teachers, students and more. The component is: /pro-school/index.php?student/message/sendreply/. The attack vector is:...

CVE-2019-1010028

phpscriptsmall.com School College Portal with ERP Script 2.6.1 and earlier is affected by: Cross Site Scripting XSS. The impact is: Attack administrators and teachers, students and more. The component is: /pro-school/index.php?student/message/sendreply/. The attack vector is:...

Cross site scripting

phpscriptsmall.com School College Portal with ERP Script 2.6.1 and earlier is affected by: Cross Site Scripting XSS. The impact is: Attack administrators and teachers, students and more. The component is: /pro-school/index.php?student/message/sendreply/. The attack vector is:...

CVE-2019-1010028

CVE-2019-1010028 affects phpscriptsmall.com School College Portal with ERP Script 2.6.1 and earlier. The vulnerability is a Cross Site Scripting (XSS) issue in the component /pro-school/index.php?student/message/send_reply/ . The attack vector shown is a crafted image tag payload, e.g. . Affected...

CVE-2019-1010028

phpscriptsmall.com School College Portal with ERP Script 2.6.1 and earlier is affected by: Cross Site Scripting XSS. The impact is: Attack administrators and teachers, students and more. The component is: /pro-school/index.php?student/message/sendreply/. The attack vector is:...

WordPress School Management plugin < 57.0 - Cross-Site Request Forgery (CSRF) and Stored Cross-Site Scripting (XSS) vulnerabilities

Cross-Site Request Forgery CSRF and Stored Cross-Site Scripting XSS vulnerabilities found by m0ns7er in WordPress School Management plugin versions 57.0. Solution Update the WordPress School Management plugin to the latest available version at least 57.0...

School Management < 57.0 - CSRF and Stored XSS

CSRF and Stored XSS Cross Site Scripting Edit WPScanTeam: June 17th - Issue Reported to Envato June 17th - Envato Support confirmed they are investigating the issue June 28th - New version released, fixing the XSS but not the CSRF. Envato notified July 5th - Demo fixed, new version to be released...

CVE-2019-13294

AROX School-ERP Pro has a command execution vulnerability. importstud.php and uploadfille.php do not have session control. Therefore an unauthenticated user can execute a command on the system...

CVE-2019-13294

AROX School-ERP Pro has a command execution vulnerability. importstud.php and uploadfille.php do not have session control. Therefore an unauthenticated user can execute a command on the system...

CVE-2019-13294

Technical specifics (affected version, root cause, patch, or exploitation details) are not provided in the supplied documents; monitor for official updates from Red Hat, NVD, and CVE records.