PT-2022-14138

Name of the Vulnerable Software and Affected Versions Student Information System version 1.0 Description A problematic issue was found in the Student Information System, affecting the "admin/?page=students" endpoint of the Student Roll module. The manipulation with the input alert1 leads to...

CVE-2022-26633

Simple Student Quarterly Result/Grade System v1.0 was discovered to contain a SQL injection vulnerability via /sqgs/Actions.php...

CVE-2022-26633

Simple Student Quarterly Result/Grade System v1.0 was discovered to contain a SQL injection vulnerability via /sqgs/Actions.php...

CVE-2022-26633

Simple Student Quarterly Result/Grade System v1.0 was discovered to contain a SQL injection vulnerability via /sqgs/Actions.php...

Sql injection

Simple Student Quarterly Result/Grade System v1.0 was discovered to contain a SQL injection vulnerability via /sqgs/Actions.php...

CVE-2022-26633

Simple Student Quarterly Result/Grade System v1.0 was discovered to contain a SQL injection vulnerability via /sqgs/Actions.php...

CVE-2022-26633

CVE-2022-26633 affects the Simple Student Quarterly Result/Grade System v1.0. The connected documents confirm a SQL injection vulnerability exploitable via the path /sqgs/Actions.php. The vulnerability is described consistently across multiple sources (NVD and Red Hat, etc.). There is no detailed...

PT-2022-17967

Name of the Vulnerable Software and Affected Versions Simple Student Quarterly Result/Grade System version 1.0 Description A SQL injection issue was found in the Simple Student Quarterly Result/Grade System via the "/sqgs/Actions.php" API endpoint. Recommendations For Simple Student Quarterly...

Simple Student Quarterly Result/Grade System SQL注入漏洞

Simple Student Quarterly Result/Grade System is a student quarterly grade management system from the individual developer Carlo Montero. A security vulnerability exists in Simple Student Quarterly Result/Grade System version 1.0, which stems from an SQL injection vulnerability...

CVE-2022-26633: Improper Neutralization of Special Elements used in an SQL Command

Simple Student Quarterly Result/Grade System v1.0 was discovered to contain a SQL injection vulnerability via /sqgs/Actions.php...

Moodle Reveals Student Information Meant To Be Anonymous

The blind-marking implementation in Moodle through 2.3.11, 2.4.x before 2.4.10, 2.5.x before 2.5.6, and 2.6.x before 2.6.3 allows remote authenticated users to de-anonymize student identities by 1 using a screen reader or 2 reading the HTML source...

Moodle does not properly restrict access

The wiki subsystem in Moodle through 2.3.11, 2.4.x before 2.4.9, 2.5.x before 2.5.5, and 2.6.x before 2.6.2 does not properly restrict 1 view and 2 edit access, which allows remote authenticated users to perform wiki operations by leveraging the student role and using the Recent Activity block to...

GHSA-GRVW-QQ2J-R898 Moodle multiple cross-site scripting (XSS) vulnerabilities

Multiple cross-site scripting XSS vulnerabilities in the survey module in Moodle through 2.6.11, 2.7.x before 2.7.11, 2.8.x before 2.8.9, and 2.9.x before 2.9.3 allow remote authenticated users to inject arbitrary web script or HTML by leveraging the student role and entering a crafted survey...

GHSA-MM9Q-3847-M48X Moodle allows attackers to enter additional answer attempts

The lesson module in Moodle through 2.6.11, 2.7.x before 2.7.10, 2.8.x before 2.8.8, and 2.9.x before 2.9.2 allows remote authenticated users to bypass intended access restrictions and enter additional answer attempts by leveraging the student role...

Moodle multiple cross-site scripting (XSS) vulnerabilities

Multiple cross-site scripting XSS vulnerabilities in the survey module in Moodle through 2.6.11, 2.7.x before 2.7.11, 2.8.x before 2.8.9, and 2.9.x before 2.9.3 allow remote authenticated users to inject arbitrary web script or HTML by leveraging the student role and entering a crafted survey...

Moodle allows attackers to obtain sensitive course-structure information

lib/navigationlib.php in Moodle through 2.5.9, 2.6.x before 2.6.11, 2.7.x before 2.7.8, and 2.8.x before 2.8.6 allows remote authenticated users to obtain sensitive course-structure information by leveraging access to a student account with a suspended enrolment...

Moodle cross-site scripting (XSS) vulnerability

Cross-site scripting XSS vulnerability in mod/quiz/report/statistics/statisticsquestiontable.php in Moodle through 2.5.9, 2.6.x before 2.6.9, 2.7.x before 2.7.6, and 2.8.x before 2.8.4 allows remote authenticated users to inject arbitrary web script or HTML by leveraging the student role for a...

GHSA-59J6-8G7W-PRF7 Moodle exposes hidden grades to students

lib/classes/gradesexternal.php in Moodle 2.7.x before 2.7.3 does not consider the moodle/grade:viewhidden capability before displaying hidden grades, which allows remote authenticated users to obtain sensitive information by leveraging the student role to access the getgrades web service...

Moodle exposes hidden grades to students

lib/classes/gradesexternal.php in Moodle 2.7.x before 2.7.3 does not consider the moodle/grade:viewhidden capability before displaying hidden grades, which allows remote authenticated users to obtain sensitive information by leveraging the student role to access the getgrades web service...

GHSA-R3FC-HX6Q-G6CQ Moodle allows attackers to discover student e-mail addresses

user/index.php in Moodle through 2.6.11, 2.7.x before 2.7.13, 2.8.x before 2.8.11, 2.9.x before 2.9.5, and 3.0.x before 3.0.3 grants excessive authorization on the basis of the moodle/course:viewhiddenuserfields capability, which allows remote authenticated users to discover student e-mail...