387 matches found
Information disclosure
An information disclosure vulnerability in UniverSIS-Students before v1.5.0 allows attackers to obtain sensitive information via a crafted GET request to the endpoint /api/students/me/courses/...
CVE-2022-28924
An information disclosure vulnerability in UniverSIS-Students before v1.5.0 allows attackers to obtain sensitive information via a crafted GET request to the endpoint /api/students/me/courses/...
CVE-2022-28924
The CVE-2022-28924 entry concerns UniverSIS-Students prior to v1.5.0, where a crafted GET request to /api/students/me/courses/ can disclose sensitive information. The vulnerability is an information disclosure flaw in the API endpoint, enabling attackers to access data without proper authorizatio...
Moodle Privilege escalation in quiz web services
In Moodle 3.x, quiz web services allow students to see quiz results when it is prohibited in the settings...
GHSA-VXMV-74RF-VQGP Moodle Portfolio forum caller class allows a user to download any file
An issue was discovered in Moodle 3.x. Students who posted on forums and exported the posts to portfolios can download any stored Moodle file by changing the download URL...
Moodle Portfolio forum caller class allows a user to download any file
An issue was discovered in Moodle 3.x. Students who posted on forums and exported the posts to portfolios can download any stored Moodle file by changing the download URL...
GHSA-XJX9-7C29-PWMM Moodle Improper Privilege Management
An issue was discovered in Moodle 3.x. Students who submitted assignments and exported them to portfolios can download any stored Moodle file by changing the download URL...
Moodle Secure layout contained an insecure link in Boost theme
A vulnerability was found in moodle before versions 3.6.3 and 3.5.5. There was a link to site home within the the Boost theme's secure layout, meaning students could navigate out of the page...
Cross-site Scripting (XSS) - Stored
Description Stored XSS found due to long name summarize Proof of Concept 1.First, access the latest version of the demo environment. https://www.rosariosis.org/demonstration/index.php 2.Then log in with your teacher account teacher/teacher 3.After logging in, access to add an assignment. 4.Then...
Sourcecodester Online Event Booking and Reservation System Cross-Site Scripting Vulnerability
Sourcecodester Online Event Booking and Reservation System is developed using PHP, MySQL database, HTML, CSS, Javascript, Bootstrap and AdminLTE. The system can be accessed by 3 types of users, namely system administrators, students and faculty. sourcecodester Online Event Booking and Reservation...
Sourcecodester Online Event Booking and Reservation System SQL Injection Vulnerability
Sourcecodester Online Event Booking and Reservation System is developed using PHP, MySQL database, HTML, CSS, Javascript, Bootstrap and AdminLTE. The system can be accessed by three types of users, namely system administrators, students, and instructors. sourcecodester Online Event Booking and...
CVE-2021-35601
Vulnerability in the PeopleSoft Enterprise CS SA Integration Pack product of Oracle PeopleSoft component: Students Administration. Supported versions that are affected are 9.0 and 9.2. Easily exploitable vulnerability allows low privileged attacker with access to the physical communication segmen...
CVE-2021-35601
Vulnerability in the PeopleSoft Enterprise CS SA Integration Pack product of Oracle PeopleSoft component: Students Administration. Supported versions that are affected are 9.0 and 9.2. Easily exploitable vulnerability allows low privileged attacker with access to the physical communication segmen...
CVE-2021-24562
The LMS by LifterLMS – Online Course, Membership & Learning Management System Plugin for WordPress plugin before 4.21.2 was affected by an IDOR issue, allowing students to see other student answers and grades...
jwtXploiter - A Tool To Test Security Of Json Web Token
A tool to test security of JSON Web Tokens. Test a JWT against all known CVEs; Tamper with the token payload: changes claims and subclaims values. Exploit known vulnerable header claims kid, jku, x5u Verify a token Retrieve the public key of your target's ssl connection and try to use it in a key...
CVE-2021-27129
CASAP Automated Enrollment System version 1.0 contains a cross-site scripting XSS vulnerability through the Students Edit ROUTE parameter...
CVE-2021-27129
CASAP Automated Enrollment System version 1.0 contains a cross-site scripting XSS vulnerability through the Students Edit ROUTE parameter...
Cross site scripting
CASAP Automated Enrollment System version 1.0 contains a cross-site scripting XSS vulnerability through the Students Edit ROUTE parameter...
CVE-2021-27129
The CVE-2021-27129 entry concerns the CASAP Automated Enrollment System version 1.0, which has a cross-site scripting (XSS) vulnerability via the Students > Edit > ROUTE parameter. The affected component is the web application; the root cause is input handling of the ROUTE parameter leading...