CVE-2024-4824

CVE-2024-4824 affects School ERP Pro+Responsive 1.0. The vulnerability is an SQL injection in the /SchoolERP/office_admin/ page via parameters such as groups_id, examname, classes_id, es_voucherid, es_class, etc., allowing a remote attacker to execute crafted queries and potentially retrieve all ...

CVE-2024-4822

The CVE-2024-4822 vulnerability affects School ERP Pro+Responsive 1.0, enabling cross-site scripting via the username and password parameters in /index.php. The root cause is a reflected XSS that can partially hijack a victim’s browser session. Multiple sources (CVE records and PT-2024-33031) cor...

CVE-2024-4823

CVE-2024-4823 affects School ERP Pro+Responsive 1.0. The XSS flaw occurs in the index path /schoolerp/office_admin/ via parameters es_bankacc, es_bank_name, es_bank_pin, es_checkno, es_teller_number, dc1, and dc2. An authenticated user can receive a crafted JavaScript payload, enabling partial br...