CVE-2024-28096

CVE-2024-28096 affects Schoolbox: stored cross-site scripting in the Class functionality before version 23.1.3. An authenticated attacker can perform security actions in the context of affected users due to the vulnerability in the Class feature. Mitigation: update to version 23.1.3 or later (rec...

CVE-2024-28096 Stored Cross-site Scripting in Class functionality in Schoolbox

Class functionality in Schoolbox application before version 23.1.3 is vulnerable to stored cross-site scripting allowing authenticated attacker to perform security actions in the context of the affected users...

CVE-2024-28095 Stored Cross-site Scripting in News functionality in Schoolbox

News functionality in Schoolbox application before version 23.1.3 is vulnerable to stored cross-site scripting allowing authenticated attacker to perform security actions in the context of the affected users...

CVE-2024-28095

CVE-2024-28095 affects Schoolbox: stored cross-site scripting in the News functionality for versions prior to 23.1.3. The flaw originates in News where user input can be stored and executed in an authenticated user’s context, enabling the attacker to perform security actions. A patch is available...

CVE-2024-28095 Stored Cross-site Scripting in News functionality in Schoolbox

News functionality in Schoolbox application before version 23.1.3 is vulnerable to stored cross-site scripting allowing authenticated attacker to perform security actions in the context of the affected users...

CVE-2024-28094 Blind SQL Injection in Chat functionality in Schoolbox

Chat functionality in Schoolbox application before version 23.1.3 is vulnerable to blind SQL Injection enabling the authenticated attackers to read, modify, and delete database records...

CVE-2024-28094

CVE-2024-28094 affects the Schoolbox application’s chat functionality prior to version 23.1.3. The issue is a blind SQL Injection that authenticated attackers can exploit to read, modify, and delete database records. Multiple sources confirm the vulnerability in Schoolbox before 23.1.3 and indica...

CVE-2024-28094 Blind SQL Injection in Chat functionality in Schoolbox

Chat functionality in Schoolbox application before version 23.1.3 is vulnerable to blind SQL Injection enabling the authenticated attackers to read, modify, and delete database records...

Schoolbox SQL Injection Vulnerability

Schoolbox is an online learning platform from Schoolbox Australia. A SQL injection vulnerability exists in Schoolbox versions prior to 23.1.3, which stems from vulnerability to a blind SQL injection attack that allows an authenticated attacker to read, modify, and delete database records...

Schoolbox Cross-Site Scripting Vulnerability

Schoolbox is an online learning platform from Schoolbox Australia. A cross-site scripting vulnerability exists in Schoolbox versions prior to 23.1.3, which stems from a cross-site scripting vulnerability in the Calendar feature that allows an authenticated attacker to perform a secure operation i...

Schoolbox Cross-Site Scripting Vulnerability

Schoolbox is an online learning platform from Schoolbox Australia. A cross-site scripting vulnerability exists in Schoolbox versions prior to 23.1.3, which stems from a cross-site scripting vulnerability in the Classes feature that would allow an authenticated attacker to perform a secure operati...

Schoolbox Cross-Site Scripting Vulnerability

Schoolbox is an online learning platform from Schoolbox Australia. A cross-site scripting vulnerability exists in Schoolbox versions prior to 23.1.3, which stems from a cross-site scripting vulnerability in the News feature that allows an authenticated attacker to perform a secure operation in an...

PT-2024-22264 · Schoolbox · Schoolbox

Name of the Vulnerable Software and Affected Versions: Schoolbox versions prior to 23.1.3 Description: The issue concerns stored cross-site scripting in the calendar functionality, allowing an authenticated attacker to perform security actions in the context of affected users. Recommendations: Fo...

PT-2024-22263 · Schoolbox · Schoolbox

Name of the Vulnerable Software and Affected Versions: Schoolbox versions prior to 23.1.3 Description: The issue concerns stored cross-site scripting in the Class functionality of the Schoolbox application. This allows an authenticated attacker to perform security actions in the context of affect...

PT-2024-22261 · Schoolbox · Schoolbox

Name of the Vulnerable Software and Affected Versions: Schoolbox versions prior to 23.1.3 Description: The issue concerns a blind SQL Injection vulnerability in the chat functionality of the Schoolbox application. This vulnerability allows authenticated attackers to read, modify, and delete...

CVE-2024-28097: Improper Neutralization of Input During Web Page Generation

Calendar functionality in Schoolbox application before version 23.1.3 is vulnerable to stored cross-site scripting allowing authenticated attacker to perform security actions in the context of the affected users...

CVE-2024-28096: Improper Neutralization of Input During Web Page Generation

Class functionality in Schoolbox application before version 23.1.3 is vulnerable to stored cross-site scripting allowing authenticated attacker to perform security actions in the context of the affected users...

CVE-2024-28095: Improper Neutralization of Input During Web Page Generation

News functionality in Schoolbox application before version 23.1.3 is vulnerable to stored cross-site scripting allowing authenticated attacker to perform security actions in the context of the affected users...

CVE-2024-28094: Improper Neutralization of Special Elements used in an SQL Command

Chat functionality in Schoolbox application before version 23.1.3 is vulnerable to blind SQL Injection enabling the authenticated attackers to read, modify, and delete database records...

CVE-2022-3059 SQL injection in Schoolbox version 21.0.2, by Schoolbox Pty Ltd

The application was vulnerable to multiple instances of SQL injection authenticated and unauthenticated through a vulnerable parameter. Due to the stacked query support, complex SQL commands could be crafted and injected into the vulnerable parameter and using a sleep based inferential SQL...