CVE-2022-32118

The CVE-2022-32118 entry concerns Arox School ERP Pro v1.0, where a cross-site scripting (XSS) vulnerability exists in the backoffice.inc.php file, exploitable via the dispatchcategory parameter. The issue is triggered by unsanitized input passed to dispatchcategory, enabling potentially crafted ...

CVE-2022-32119

Arox School ERP Pro v1.0 is affected by multiple arbitrary file upload vulnerabilities, exposed via the Add Photo function (photogalleries.inc.php) and the import staff Excel function (1finance_master.inc.php). The issue is documented across multiple sources (NVD, Red Hat, etc.), all describing a...

CVE-2020-37090

CVE-2020-37090 affects School ERP Pro 1.0. The vulnerability resides in the message-attachment file upload, which can be exploited to upload arbitrary PHP files, enabling remote code execution on the server. Root cause evidenced in the connected PT-2026-5840 entry: inadequate validation/verificat...

CVE-2020-37084

CVE-2020-37084 affects School ERP Pro 1.0. An authenticated administrator can upload arbitrary PHP files as profile photos by bypassing file extension checks, via improper validation in pre-editstudent.inc.php, enabling remote code execution on the server. The vulnerability is tied to the admin p...

CVE-2020-37088

CVE-2020-37088 affects School ERP Pro 1.0: an unauthenticated file disclosure via download.php by manipulating the document parameter with directory traversal to read arbitrary files, exposing sensitive configuration files and credentials. Root cause: improper validation of the document parameter...

CVE-2020-37089

CVE-2020-37089 concerns School ERP Pro 1.0 with a SQL injection in the es_messagesid parameter. The vulnerability can be exploited by sending crafted SQL via GET requests , potentially allowing attackers to extract, modify, or delete data . Root cause: improper handling of user-controlled input i...