CVE-2021-42665

An SQL Injection vulnerability exists in Sourcecodester Engineers Online Portal in PHP via the login form inside of index.php, which can allow an attacker to bypass authentication...

CVE-2021-42665: Improper Neutralization of Special Elements used in an SQL Command

An SQL Injection vulnerability exists in Sourcecodester Engineers Online Portal in PHP via the login form inside of index.php, which can allow an attacker to bypass authentication...

CVE-2021-42670: Improper Neutralization of Special Elements used in an SQL Command

A SQL injection vulnerability exists in Sourcecodester Engineers Online Portal in PHP via the id parameter to the announcementsstudent.php web page. As a result a malicious user can extract sensitive data from the web server and in some cases use this vulnerability in order to get a remote code...

CVE-2021-42671: Direct Request

An incorrect access control vulnerability exists in Sourcecodester Engineers Online Portal in PHP in niamunozmonitoringsystem/admin/uploads. An attacker can leverage this vulnerability in order to bypass access controls and access all the files uploaded to the web server without the need of...

CVE-2021-42664: Improper Neutralization of Input During Web Page Generation

A Stored Cross Site Scripting XSS Vulneraibiilty exists in Sourcecodester Engineers Online Portal in PHP via the 1 Quiz title and 2 quiz description parameters to addquiz.php. An attacker can leverage this vulnerability in order to run javascript commands on the web server surfers behalf, which c...

CVE-2021-42666: Improper Neutralization of Special Elements used in an SQL Command

A SQL Injection vulnerability exists in Sourcecodester Engineers Online Portal in PHP via the id parameter to quizquestion.php, which could let a malicious user extract sensitive data from the web server and in some cases use this vulnerability in order to get a remote code execution on the remot...

CVE-2021-42668: Improper Neutralization of Special Elements used in an SQL Command

A SQL Injection vulnerability exists in Sourcecodester Engineers Online Portal in PHP via the id parameter in the myclassmates.php web page.. As a result, an attacker can extract sensitive data from the web server and in some cases can use this vulnerability in order to get a remote code executio...

CVE-2021-42669: Unrestricted Upload of File with Dangerous Type

A file upload vulnerability exists in Sourcecodester Engineers Online Portal in PHP via dashboardteacher.php, which allows changing the avatar through teacheravatar.php. Once an avatar gets uploaded it is getting uploaded to the /admin/uploads/ directory, and is accessible by all users. By...