Cross-site Scripting (XSS) - Reflected in gibbonedu/core

Description There's a reflected xss in the tab parameter in both the student dashboard and the staff dashboard Proof of Concept Visit http://localhost/gibon/index.php?tab=asd%3C/script%3E%3Csvg/onload=alert1%3E Impact This vulnerability is result to xss which then can be used to achieve more thin...

CVE-2021-40695

It was possible for a student to view their quiz grade before it had been released, using a quiz web service...

CVE-2021-40695

CVE-2021-40695 concerns Moodle's quiz service where a student could view their quiz grade before it was officially released. The available connected sources confirm this is an information disclosure impacting Moodle quiz grading workflows, with the root cause described only at a high level as a f...

Student Management System 1.0 - SQLi Authentication Bypass

Exploit Title: Student Management System 1.0 - SQLi Authentication Bypass Date: 2020-07-06 Exploit Author: Enes Özeser Vendor Homepage: https://www.sourcecodester.com/php/14268/student-management-system.html Version: 1.0 Tested on: Windows & WampServer CVE: CVE-2020-23935 1- Go to following url...

GHSA-WF5P-F5XR-C4JJ SQL Injection in rosariosis

An unauthenticated SQL Injection vulnerability in Rosario Student Information System aka rosariosis before 8.1.1 allows remote attackers to execute PostgreSQL statements e.g., SELECT, INSERT, UPDATE, and DELETE through /Side.php via the syear parameter...

SQL Injection in rosariosis

An unauthenticated SQL Injection vulnerability in Rosario Student Information System aka rosariosis before 8.1.1 allows remote attackers to execute PostgreSQL statements e.g., SELECT, INSERT, UPDATE, and DELETE through /Side.php via the syear parameter...

Rosario Student Information System SQL Injection Vulnerability

The Rosario Student Information System is a free student information system used for school administration, and a SQL injection vulnerability exists in the Rosario Student Information System, which can be exploited to execute Postgre SQL statements via the /Side.php parameter via the syear...

CVE-2021-44427

An unauthenticated SQL Injection vulnerability in Rosario Student Information System aka rosariosis before 8.1.1 allows remote attackers to execute PostgreSQL statements e.g., SELECT, INSERT, UPDATE, and DELETE through /Side.php via the syear parameter...

CVE-2021-44427

An unauthenticated SQL Injection vulnerability in Rosario Student Information System aka rosariosis before 8.1.1 allows remote attackers to execute PostgreSQL statements e.g., SELECT, INSERT, UPDATE, and DELETE through /Side.php via the syear parameter...

CVE-2021-44427

An unauthenticated SQL Injection vulnerability in Rosario Student Information System aka rosariosis before 8.1.1 allows remote attackers to execute PostgreSQL statements e.g., SELECT, INSERT, UPDATE, and DELETE through /Side.php via the syear parameter...

CVE-2021-44427

An unauthenticated SQL Injection vulnerability in Rosario Student Information System aka rosariosis before 8.1.1 allows remote attackers to execute PostgreSQL statements e.g., SELECT, INSERT, UPDATE, and DELETE through /Side.php via the syear parameter...

CVE-2021-44427

CVE-2021-44427 is an unauthenticated SQL injection in Rosario Student Information System (rosariosis) before 8.1.1. The vulnerability allows remote attackers to execute PostgreSQL statements (e.g., SELECT, INSERT, UPDATE, DELETE) via the /Side.php endpoint using the syear parameter. Affected soft...

PT-2021-24089

Name of the Vulnerable Software and Affected Versions: Rosario Student Information System versions prior to 8.1.1 Description: The issue allows remote attackers to execute PostgreSQL statements, such as SELECT, INSERT, UPDATE, and DELETE, through the /Side.php endpoint via the syear parameter. Th...

CVE-2021-44427: Improper Neutralization of Special Elements used in an SQL Command

An unauthenticated SQL Injection vulnerability in Rosario Student Information System aka rosariosis before 8.1.1 allows remote attackers to execute PostgreSQL statements e.g., SELECT, INSERT, UPDATE, and DELETE through /Side.php via the syear parameter...

CVE-2021-24873

The Tutor LMS WordPress plugin before 1.9.11 does not sanitise and escape user input before outputting back in attributes in the Student Registration page, leading to a Reflected Cross-Site Scripting issue...

Cross site scripting

The Tutor LMS WordPress plugin before 1.9.11 does not sanitise and escape user input before outputting back in attributes in the Student Registration page, leading to a Reflected Cross-Site Scripting issue...

CVE-2021-24873 Tutor LMS < 1.9.11 - Reflected Cross-Site Scripting

The Tutor LMS WordPress plugin before 1.9.11 does not sanitise and escape user input before outputting back in attributes in the Student Registration page, leading to a Reflected Cross-Site Scripting issue...

PT-2021-16347

Name of the Vulnerable Software and Affected Versions: Tutor LMS WordPress plugin versions prior to 1.9.11 Description: The issue is related to a Reflected Cross-Site Scripting problem. It occurs because the plugin does not properly sanitise and escape user input before outputting it back in...

CVE-2021-24873: Improper Neutralization of Input During Web Page Generation

The Tutor LMS WordPress plugin before 1.9.11 does not sanitise and escape user input before outputting back in attributes in the Student Registration page, leading to a Reflected Cross-Site Scripting issue...

WordPress WPSchoolPress 2.1.16 Cross Site Scripting

Exploit Title: WordPress Plugin WPSchoolPress 2.1.16 - 'Multiple' Cross Site Scripting XSS Date: 20/08/2021 Exploit Author: Davide Taraschi Vendor Homepage: https://wpschoolpress.com/ Software Link: https://wpschoolpress.com/free-download/ Version: up to 2.1.17 non included Tested on: Ubuntu 20.0...