CVE-2018-18797

School Attendance Monitoring System 1.0 has CSRF via /user/user/edit.php...

CVE-2018-18795

School Event Management System 1.0 has SQL Injection via the student/index.php or event/index.php id parameter...

CVE-2018-18795

School Event Management System 1.0 has SQL Injection via the student/index.php or event/index.php id parameter...

CVE-2018-18799

School Attendance Monitoring System 1.0 has CSRF via event/controller.php?action=photos...

Sql injection

School Equipment Monitoring System 1.0 allows SQL injection via the login screen, related to include/user.vb...

Cross site request forgery (csrf)

School Event Management System 1.0 allows CSRF via user/controller.php?action=edit...

Sql injection

School Event Management System 1.0 has SQL Injection via the student/index.php or event/index.php id parameter...

Design/Logic Flaw

School Event Management System 1.0 allows Arbitrary File Upload via event/controller.php?action=photos...

CVE-2018-18793

CVE-2018-18793 affects School Event Management System 1.0. The vulnerability is an Arbitrary File Upload through the endpoint event/controller.php?action=photos, enabling uploading of arbitrary files via the photos handler. Public exploits and shell-upload references exist (Exploit-DB, PacketStor...

CVE-2018-18806

The CVE-2018-18806 vulnerability affects School Equipment Monitoring System 1.0. An SQL injection exists in the login flow, related to include/user.vb, enabling manipulation of the backend database according to sources such as NVD and CNVD. Public exploit content (Exploit-DB, ExploitPack, and 0da...

CVE-2018-18794

School Event Management System 1.0 allows CSRF via user/controller.php?action=edit...

CVE-2018-18797

CVE-2018-18797 affects School Attendance Monitoring System 1.0. The vulnerability is a Cross-Site Request Forgery (CSRF) via /user/user/edit.php that enables an attacker to trigger admin data updates (e.g., account fields) by forged requests. Public exploit references (Exploit-DB, PacketStorm) an...

CVE-2018-18795

CVE-2018-18795 corresponds to a SQL Injection vulnerability in School Event Management System 1.0. The flaw is triggered via the id parameter in the pages student/index.php and event/index.php, allowing an attacker to manipulate the backend database. Connected sources corroborate the same descrip...

CVE-2018-18795

School Event Management System 1.0 has SQL Injection via the student/index.php or event/index.php id parameter...

CVE-2018-18794

The CVE-2018-18794 entry corresponds to a Cross-Site Request Forgery (CSRF) vulnerability in School Event Management System 1.0. Public documents detail CSRF via user/controller.php?action=edit and related admin-update flows. Exploitation evidence shows abuse of session state (checking ACCOUNT_ID...

CVE-2018-18799

School Attendance Monitoring System 1.0 has CSRF via event/controller.php?action=photos...

Headmaster caught mining cryptocurrency at school; gets fired

By Uzair Amir A Chinese school headmaster Lei Hua was caught mining cryptocurrency using the school's electricity. As a result, he had to lose his job. It happened at Puman Middle School in Hunan province of China. Initially, teachers complained about the loud noise that continued day and night...

School Event Management System 1.0 - Cross-Site Request Forgery (Update Admin) Vulnerability

Exploit for php platform in category web applications Exploit Title: School Event Management System 1.0 - Cross-Site Request Forgery Update Admin Exploit Author: Ihsan Sencan Vendor Homepage: https://www.sourcecodester.com/users/janobe Software Link:...

School Equipment Monitoring System 1.0 SQL Injection

Exploit Title: School Equipment Monitoring System 1.0 - 'login' SQL Injection Dork: N/A Date: 2018-10-29 Exploit Author: Ihsan Sencan Vendor Homepage: https://www.sourcecodester.com/users/janobe Software Link: https://www.sourcecodester.com/sites/default/files/download/janobe/sems0.zip Version: 1...

School Equipment Monitoring System 1.0 - login SQL Injection Vulnerability

Exploit for php platform in category web applications Exploit Title: School Equipment Monitoring System 1.0 - 'login' SQL Injection Exploit Author: Ihsan Sencan Vendor Homepage: https://www.sourcecodester.com/users/janobe Software Link:...