CVE-2017-15957

CVE-2017-15957 affects Ingenious School Management System 2.3.0: the file my_profile.php allows a student or teacher to upload an arbitrary file. Public references (Exploit-DB, 0day) document an arbitrary file upload capability, with PoCs targeting the my_profile.php and uploads paths. The vulner...

CVE-2017-15957: Unrestricted Upload of File with Dangerous Type

myprofile.php in Ingenious School Management System 2.3.0 allows a student or teacher to upload an arbitrary file...

PT-2017-14310

Name of the Vulnerable Software and Affected Versions Ingenious School Management System version 2.3.0 Description The issue allows a student or teacher to upload an arbitrary file through the my profile.php script. Recommendations For Ingenious School Management System version 2.3.0, restrict...

This Week in Security News

Welcome to our weekly roundup, where we share what you need to know about the cybersecurity news and events that happened over the past few days. Below you’ll find a quick recap of topics followed by links to news articles and/or our blog posts providing additional insight. Be sure to check back...

indianschoolsalalah.com XSS vulnerability

Vulnerable URL: http://www.indianschoolsalalah.com/contact.php Details: Description| Value ---|--- Patched:| Yes, at Vulnerability type:| XSS Vulnerability status:| Publicly disclosed Alexa Rank| 1888826 VIP website status:| No Coordinated Disclosure Timeline: Description| Value ---|---...

harrisburg.il.schoolwebpages.com XSS vulnerability

Open Bug Bounty ID: OBB-323699 Description| Value ---|--- Affected Website:| harrisburg.il.schoolwebpages.com Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6....

cheraw.co.schoolwebpages.com XSS vulnerability

Open Bug Bounty ID: OBB-323688 Description| Value ---|--- Affected Website:| cheraw.co.schoolwebpages.com Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...

roundup.mt.schoolwebpages.com XSS vulnerability

Open Bug Bounty ID: OBB-323665 Description| Value ---|--- Affected Website:| roundup.mt.schoolwebpages.com Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...

denmark.sc.schoolwebpages.com XSS vulnerability

Open Bug Bounty ID: OBB-323661 Description| Value ---|--- Affected Website:| denmark.sc.schoolwebpages.com Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...

centralcity.il.schoolwebpages.com XSS vulnerability

Open Bug Bounty ID: OBB-323657 Description| Value ---|--- Affected Website:| centralcity.il.schoolwebpages.com Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6...

newcastlewineschool.com XSS vulnerability

Vulnerable URL: http://www.newcastlewineschool.com/calendarevents.php/%22--!%3E%20%3Cimg%20src=x%20onerror=alert%22openbugbounty%22%3E?eventdate=7-02-2017=02-2017 Details: Description| Value ---|--- Patched:| No Latest check for patch:| 02.01.2018 Vulnerability type:| XSS Vulnerability status:|...

lothianwineschool.com XSS vulnerability

Vulnerable URL: http://www.lothianwineschool.com/calendarevents.php/%22--!%3E%20%3Cimg%20src=x%20onerror=alert%22openbugbounty%22%3E?eventdate=19-1-2017=1-2017 Details: Description| Value ---|--- Patched:| No Latest check for patch:| 02.01.2018 Vulnerability type:| XSS Vulnerability status:|...

glasgowwineschool.com XSS vulnerability

Vulnerable URL: http://www.glasgowwineschool.com/calendarevents.php/'%22--!%3E%20%3Cimg%20src=x%20onerror=alert%22openbugbounty%22%3E?eventdate=28-09-2017=09-2017 Details: Description| Value ---|--- Patched:| No Latest check for patch:| 02.01.2018 Vulnerability type:| XSS Vulnerability status:|...

sussexwineschool.com XSS vulnerability

Vulnerable URL: http://www.sussexwineschool.com/calendarevents.php/'%22--!%3E%20%3Cimg%20src=x%20onerror=alert%22openbugbounty%22%3E?eventdate=17-10-2017=10-2017 Details: Description| Value ---|--- Patched:| No Latest check for patch:| 02.01.2018 Vulnerability type:| XSS Vulnerability status:|...

hertfordshirewineschool.com XSS vulnerability

Vulnerable URL: http://www.hertfordshirewineschool.com/calendarevents.php/'%22--!%3E%20%3Cimg%20src=x%20onerror=alert%22openbugbounty%22%3E?eventdate=12-10-2017=10-2017 Details: Description| Value ---|--- Patched:| No Latest check for patch:| 02.01.2018 Vulnerability type:| XSS Vulnerability...

school.rayongz.com Open Redirect vulnerability

Vulnerable URL: http://school.rayongz.com/redirect.php?url=https://openbugbounty.org Details: Description| Value ---|--- Patched:| Verification in progress Latest check for patch:| 02.01.2018 Vulnerability type:| Open Redirect Vulnerability status:| Publicly disclosed Alexa Rank| Unknown / Not...

starearlycollege.org XSS vulnerability

Vulnerable URL: http://starearlycollege.org/apps/news/shownews.jsp?RECID=426987=0=News Post CIA Internship - High School Seniors Scholarship Program - STAR Early College School Details: Description| Value ---|--- Patched:| Yes, at 15.10.2017 Latest check for patch:| 15.10.2017 22:31 GMT...

stjean.org XSS vulnerability

Vulnerable URL: http://www.stjean.org/apps/news/shownews.jsp?RECID=461679=0=News%20Post%20Summer%20Reading%20List%20-%20St.%20Jean%20Baptiste%20High%20School%3C/title%3E%3Csvg/onload=alert/XSSPOSED/%3E=true Details: Description| Value ---|--- Patched:| Yes, at 15.10.2017 Latest check for patch:|...

laurel.k12.de.us XSS vulnerability

Vulnerable URL: http://www.laurel.k12.de.us/apps/news/shownews.jsp?RECID=401890=0=true=News%20Post%202016-2017%20School%20Calendar;%20Approved%20by%20Laurel%20Board%20of%20Education,%20April%2020,%202016%20-%20Laurel%20School%20District%3C/title%3E%3Csvg/onload=alert/XSSPOSED/%3E Details:...

stowe.cps.edu XSS vulnerability

Vulnerable URL: http://www.stowe.cps.edu/apps/news/shownews.jsp?RECID=399354=0=News%20Post%20Parent%20Resources:%20Checking%20My%20Child%27s%20Grades%20and%20Attendance%20-%20Harriet%20Beecher%20Stowe%20Elementary%20School%3C/title%3E%3Csvg/onload=alert/XSSPOSED/%3E Details: Description| Value...