CVE-2024-33911

The School Management 10.3.4 - 認証後SQLインジェクション エクスプロイトタイトル: The School Management 10.3.4 - 認証後SQLインジェクション 日付: 2024年4月29日 エクスプロイト作者: Ivan Spiridonov xbz0n ベンダーホームページ: https://theschool-management.com バージョン: 10.3.4 テスト環境: Ubuntu 22.04 CVE: CVE-2024-33911 脆弱性 The School...

WordPress The School Management plugin <= 5.4 - Authenticated (Custom+) SQL Injection via 'order[0][dir]' Parameter vulnerability

Authenticated Custom+ SQL Injection via 'order0dir' Parameter vulnerability discovered by j4ck13ch4n in WordPress Plugin The School Management – Education & Learning Management versions = 5.4...

EUVD-2026-59904

The The School Management – Education & Learning ERP plugin for WordPress is vulnerable to generic SQL Injection via 'order0dir' Parameter in all versions up to, and including, 5.4 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL...

CVE-2026-9767 The School Management <= 5.4 - Authenticated (Custom+) SQL Injection via 'order[0][dir]' Parameter

The The School Management – Education & Learning ERP plugin for WordPress is vulnerable to generic SQL Injection via 'order0dir' Parameter in all versions up to, and including, 5.4 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL...

CVE-2026-9767 The School Management <= 5.4 - Authenticated (Custom+) SQL Injection via 'order[0][dir]' Parameter

The The School Management – Education & Learning ERP plugin for WordPress is vulnerable to generic SQL Injection via 'order0dir' Parameter in all versions up to, and including, 5.4 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL...

CVE-2026-9767

CVE-2026-9767 affects The School Management – Education & Learning ERP plugin for WordPress up to version 5.4. The vulnerability is a generic SQL Injection via the parameter order[0][dir] in multiple AJAX handlers (e.g., wlsm-fetch-staff-classes, wlsm-fetch-notices, wlsm-fetch-subjects, wlsm-fetc...

CVE-2026-9767: Improper Neutralization of Special Elements used in an SQL Command

The The School Management – Education & Learning ERP plugin for WordPress is vulnerable to generic SQL Injection via 'order0dir' Parameter in all versions up to, and including, 5.4 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL...

CVE-2022-47430

CVE-2022-47430 affects The School Management – Education & Learning Management WordPress plugin (versions ≤ 4.1). Affects the plugin via an improper neutralization of SQL elements, enabling SQL Injection. Public records in the sources note the vulnerability severity varies: NVD indicates CVSS v3....