CVE-2025-52399-SQLi-Institute-of-Current-Students

CVE-2025-52399 - Institute-of-Current-Students 中的 SQL 注入 摘要 Institute-of-Current-Students 应用程序中的 loginlinkfaculty 端点存在 SQL 注入漏洞，漏洞通过 fid POST 参数触发。该参数在用于 SQL 查询之前未进行适当清理，允许远程攻击者执行任意 SQL 命令。 漏洞类型：SQL 注入 受影响组件：/loginlinkfaculty（POST） 受影响参数：fid 身份验证：不需要 影响：身份验证绕过、数据提取 测试环境：localhost 数据库：icsnew 版本：1....

CVE-2025-52399-SQLi-Institute-of-Current-Students

CVE-2025-52399 - Institute of Current Students 中的 SQL 注入漏洞 概述 Institute-of-Current-Students 应用程序中的 loginlinkfaculty 端点通过 fid POST 参数存在 SQL 注入漏洞。该参数在用于 SQL 查询之前未经过适当的清理，从而允许远程攻击者执行任意 SQL 命令。 漏洞类型：SQL 注入 受影响组件：/loginlinkfaculty POST 受影响参数：fid 身份验证：不需要 影响：身份验证绕过、数据提取 测试环境：Localhost 数据库：icsnew 版本：1.0...

CVE-2025-51411

🛡️ CVE 披露：CVE-2025-51411 — Institute-of-Current-Students 中的反射型 XSS 披露日期： 2025年7月25日 CVE ID： CVE-2025-51411 严重性： 中危 CVSS 6.1 🧩 概述 Institute-of-Current-Students v1.0 项目的 postquerypublic 端点存在一个反射型跨站脚本 XSS 漏洞。email 参数中的未经清理输入直接反射回响应 HTML 中，允许攻击者在访问恶意链接或提交精心构造请求的用户浏览器中执行任意 JavaScript。 此问题已被分配标识符...

CVE-2026-103113

A vulnerability was determined in OS4ED openSIS-Classic up to 9.3. The affected element is the function save action of the file modules/students/Student.php of the component General Information Tab. Executing a manipulation of the argument students can lead to sql injection. The attack may be...

CVE-2026-103113

The OS4ED openSIS-Classic software (up to version 9.3 ) is vulnerable to SQL injection in the General Information Tab component. The flaw exists within the save action function of the modules/students/Student.php file. An attacker can exploit this by manipulating the students argument, which may ...

EUVD-2026-89762

A vulnerability was determined in OS4ED openSIS-Classic up to 9.3. The affected element is the function save action of the file modules/students/Student.php of the component General Information Tab. Executing a manipulation of the argument students can lead to sql injection. The attack may be...

CVE-2026-93014 RosarioSIS before 12.9 Path Traversal in File Deletion via filename Parameter

RosarioSIS versions before 12.9 fail to validate the filename request parameter in Users and Students modules, allowing authenticated users to unlink allow-listed files via path traversal. Attackers can use parent-directory sequences to escape upload directories and delete CSS, XML, JSON resource...

CVE-2026-93014: Improper Limitation of a Pathname to a Restricted Directory

RosarioSIS versions before 12.9 fail to validate the filename request parameter in Users and Students modules, allowing authenticated users to unlink allow-listed files via path traversal. Attackers can use parent-directory sequences to escape upload directories and delete CSS, XML, JSON resource...

CVE-2026-19785: Improper Neutralization of Special Elements used in an SQL Command

A vulnerability has been found in francoisjacquet RosarioSIS up to 12.7.4. This vulnerability affects unknown code of the file modules/Students/includes/Medical.inc.php of the component Student Medical Module. Such manipulation of the argument table leads to sql injection. The attack may be...

CVE-2026-34239 Chamilo Authenticated Remote Code Execution

Chamilo version 1.11.40 and earlier are vulnerable to authenticated remote code execution in the main/inc/ajax/lang.ajax.php path. This endpoint is protected only by apiprotectcoursescripttrue, which means any authenticated user enrolled in a course student, teacher, DRH can reach it...

CVE-2026-11773

The Masteriyo LMS – LMS Course Builder, Quizzes & Certificates plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 2.2.1. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for...

CVE-2026-11773 Masteriyo LMS <= 2.2.1 - Missing Authorization to Authenticated (Student+) Arbitrary Course Announcement Modification

The Masteriyo LMS – LMS Course Builder, Quizzes & Certificates plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 2.2.1. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for...

EUVD-2026-36655

A vulnerability was detected in CodeAstro Student Attendance Management System 1.0. Impacted is an unknown function of the file /attendance-php/Admin/createStudents.php. Performing a manipulation of the argument admissionNumber results in sql injection. Remote exploitation of the attack is...

CVE-2026-12175

A vulnerability was detected in CodeAstro Student Attendance Management System 1.0. Impacted is an unknown function of the file /attendance-php/Admin/createStudents.php. Performing a manipulation of the argument admissionNumber results in sql injection. Remote exploitation of the attack is...

CVE-2026-12175 CodeAstro Student Attendance Management System createStudents.php sql injection

A vulnerability was detected in CodeAstro Student Attendance Management System 1.0. Impacted is an unknown function of the file /attendance-php/Admin/createStudents.php. Performing a manipulation of the argument admissionNumber results in sql injection. Remote exploitation of the attack is...

CVE-2026-12175 CodeAstro Student Attendance Management System createStudents.php sql injection

A vulnerability was detected in CodeAstro Student Attendance Management System 1.0. Impacted is an unknown function of the file /attendance-php/Admin/createStudents.php. Performing a manipulation of the argument admissionNumber results in sql injection. Remote exploitation of the attack is...

PT-2026-49100

Name of the Vulnerable Software and Affected Versions CodeAstro Student Attendance Management System version 1.0 Description An issue exists in the file '/attendance-php/Admin/createStudents.php' where manipulating the admissionNumber argument allows for SQL injection, which is a technique used t...

CVE-2026-47324: Improper Neutralization of Input During Web Page Generation

ProjectsAndPrograms school-management-system is vulnerable to Stored Cross‑Site Scripting XSS in multiple attributes of students and teachers objects. An authorized attacker e.g., a teacher or administrator can inject malicious JavaScript that is subsequently executed in other users’ browsers...

CVE-2026-9518

A vulnerability was identified in hemant6488 CodeIgniter-StudentManagementSystem. The impacted element is the function addStudent of the file viewstudents.php of the component Students Controller. The manipulation of the argument Name leads to cross site scripting. The attack is possible to be...

CVE-2026-42197

RELATE is a web-based courseware package. Versions prior to commit 555f0efb1c5bd7531c07cd73724d7e566a81f620 have a stored cross-site scripting vulnerability that allows any enrolled student to execute arbitrary JavaScript in an administrator's browser session, potentially leading to full admin...