school-kronplatz.it XSS vulnerability

Open Bug Bounty ID: OBB-699187 Description| Value ---|--- Affected Website:| school-kronplatz.it Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| hidden until disclosure Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:|...

CVE-2018-18806

School Equipment Monitoring System 1.0 allows SQL injection via the login screen, related to include/user.vb...

CVE-2018-18799

School Attendance Monitoring System 1.0 has CSRF via event/controller.php?action=photos...

CVE-2018-18797

School Attendance Monitoring System 1.0 has CSRF via /user/user/edit.php...

CVE-2018-18793

School Event Management System 1.0 allows Arbitrary File Upload via event/controller.php?action=photos...

CVE-2018-18794

School Event Management System 1.0 allows CSRF via user/controller.php?action=edit...

CVE-2018-18797

School Attendance Monitoring System 1.0 has CSRF via /user/user/edit.php...

CVE-2018-18795

School Event Management System 1.0 has SQL Injection via the student/index.php or event/index.php id parameter...

CVE-2018-18799

School Attendance Monitoring System 1.0 has CSRF via event/controller.php?action=photos...

CVE-2018-18795

School Event Management System 1.0 has SQL Injection via the student/index.php or event/index.php id parameter...

Sql injection

School Equipment Monitoring System 1.0 allows SQL injection via the login screen, related to include/user.vb...

Cross site request forgery (csrf)

School Event Management System 1.0 allows CSRF via user/controller.php?action=edit...

Sql injection

School Event Management System 1.0 has SQL Injection via the student/index.php or event/index.php id parameter...

Design/Logic Flaw

School Event Management System 1.0 allows Arbitrary File Upload via event/controller.php?action=photos...

CVE-2018-18794

School Event Management System 1.0 allows CSRF via user/controller.php?action=edit...

CVE-2018-18793

CVE-2018-18793 affects School Event Management System 1.0. The vulnerability is an Arbitrary File Upload through the endpoint event/controller.php?action=photos, enabling uploading of arbitrary files via the photos handler. Public exploits and shell-upload references exist (Exploit-DB, PacketStor...

CVE-2018-18797

CVE-2018-18797 affects School Attendance Monitoring System 1.0. The vulnerability is a Cross-Site Request Forgery (CSRF) via /user/user/edit.php that enables an attacker to trigger admin data updates (e.g., account fields) by forged requests. Public exploit references (Exploit-DB, PacketStorm) an...

CVE-2018-18806

The CVE-2018-18806 vulnerability affects School Equipment Monitoring System 1.0. An SQL injection exists in the login flow, related to include/user.vb, enabling manipulation of the backend database according to sources such as NVD and CNVD. Public exploit content (Exploit-DB, ExploitPack, and 0da...

CVE-2018-18795

School Event Management System 1.0 has SQL Injection via the student/index.php or event/index.php id parameter...

CVE-2018-18795

CVE-2018-18795 corresponds to a SQL Injection vulnerability in School Event Management System 1.0. The flaw is triggered via the id parameter in the pages student/index.php and event/index.php, allowing an attacker to manipulate the backend database. Connected sources corroborate the same descrip...