CVE-2021-26201

The CVE-2021-26201 issue affects the CASAP Automated Enrollment System (CASAP) Login Panel, with an authentication bypass achieved via SQL injection in the username field. The vulnerability is documented for CASAP versions around 1.0 (and references to 1.1 in exploit materials), enabling an attac...

CVE-2021-3294

CVE-2021-3294 concerns the CASAP Automated Enrollment System 1.0. The vulnerability is a Stored Cross-Site Scripting (XSS) in users.php, arising from insufficient validation of user data in the “First Name” field, enabling an attacker to steal cookies and redirect victims to a malicious site. Pub...

CVE-2021-27332

The CVE-2021-27332 entry is confirmed to describe a Cross-site scripting (XSS) vulnerability in SourceCodester CASAP Automated Enrollment System v1.0. The vulnerability allows remote attackers to inject arbitrary web script or HTML via the class_name parameter to update_class.php. The Red Hat, CN...

CVE-2021-26223

CVE-2021-26223 affects the SourceCodester CASAP Automated Enrollment System v1.0. The vulnerability is an SQL injection in the parameter id of view_pay.php, enabling remote attackers to execute arbitrary SQL statements. The issue is described as network-exposed with low attack complexity and no a...

CVE-2021-26227

The CVE-2021-26227 entry describes a Cross-Site Scripting (XSS) vulnerability in SourceCodester CASAP Automated Enrollment System v1.0. The affected component is the edit_stud.php flow, where attacker-controlled student information parameters can be manipulated to inject arbitrary web script/HTML...

CVE-2021-40261

CVE-2021-40261 refers to multiple reflected XSS vulnerabilities in SourceCodester CASAP Automated Enrollment System 1.0. The connected sources describe that the vulnerability arises from lack of input validation in the web application, enabling an attacker to execute client-side code. The affecte...

CVE-2021-26228

CVE-2021-26228 concerns SourceCodester CASAP Automated Enrollment System v1.0, where an SQL injection via the id parameter to edit_class1.php allows remote attackers to execute arbitrary SQL statements. The vulnerability arises from improper sanitization of user-supplied input in the edit_class1....

CVE-2021-27129

The CVE-2021-27129 entry concerns the CASAP Automated Enrollment System version 1.0, which has a cross-site scripting (XSS) vulnerability via the Students > Edit > ROUTE parameter. The affected component is the web application; the root cause is input handling of the ROUTE parameter leading...

CVE-2021-26229

The CVE-2021-26229 entry concerns SourceCodester CASAP Automated Enrollment System v1.0, with an SQL injection vulnerability in edit_stud.php exploitable via the id parameter. The defect allows remote attackers to execute arbitrary SQL statements; exploitation data indicates a high/severe impact ...

CVE-2021-26226

CVE-2021-26226 describes an SQL injection in SourceCodester CASAP Automated Enrollment System v1.0, exploitable via the id parameter to edit_user.php. The vulnerability arises from improper input handling that allows attackers to inject arbitrary SQL statements, potentially impacting authenticati...

CVE-2021-26230

The CVE-2021-26230 entry describes a Cross-Site Scripting (XSS) vulnerability in the SourceCodester CASAP Automated Enrollment System v1.0. Attackers can inject arbitrary web script or HTML via user information submitted to save_user.php, enabling remote exploitation. Connected records corroborat...