CVE-2025-25614

The open-source school management software Unifiedtransform version 2.0 contains an Incorrect Access Control vulnerability. This flaw allows users with Teacher privileges to bypass intended restrictions and update the personal data of other teachers, a functionality that should be restricted to a...

CVE-2025-46203

The school management software Unifiedtransform v2.0 is vulnerable to Incorrect Access Control (CWE-266) within its Total Access Control Mechanism . Specifically, the editStudents() method in the UserController at the GET /students/edit/{id} endpoint fails to properly enforce permissions, allowin...

CVE-2024-53573

Unifiedtransform v2.X , an open-source school management software, is vulnerable to Incorrect Access Control (CWE-284). The flaw allows unauthorized users to access and manipulate endpoints reserved for administrative use, specifically affecting the teacher/edit/{id} endpoint. This could lead to ...

CVE-2025-25618

Unifiedtransform version 2.0 is vulnerable to Incorrect Access Control , which leads to Privilege Escalation . This flaw allows users with Teacher privileges to modify the Section Name and Room Number —actions that should be restricted to administrators. An attacker can exploit this by accessing ...

CVE-2025-25621

The Unifiedtransform school management software (v2.0) is vulnerable to Incorrect Access Control , allowing authenticated teachers to manipulate attendance records for other teachers. This occurs via the endpoint /courses/teacher/index?teacher_id=2&semester_id=1 by changing the teacher_id paramet...

CVE-2025-25616

The open-source school management software Unifiedtransform version 2.0 is vulnerable to Incorrect Access Control (CWE-284). This flaw allows students to bypass authorization to modify exam rules via the /exams/edit-rule?exam_rule_id=1 endpoint. By manipulating the exam_rule_id parameter, an atta...

CVE-2025-25615

Unifiedtransform 2.0 is vulnerable to an Incorrect Access Control flaw that allows users with teacher-level privileges to view attendance lists for all class sections. The root cause is a failure to restrict access to the attendance data, which should be limited to administrators. An attacker can...

CVE-2025-46204

The school management software Unifiedtransform v2.0 (and v2.X ) is vulnerable to an Incorrect Access Control issue. The root cause is a flaw in the access control mechanism responsible for course permissions, specifically within the CourseController 's edit() method. This allows any authenticate...

CVE-2025-25620

Unifiedtransform v2.0 is vulnerable to a Stored Cross-Site Scripting (XSS) vulnerability within the Create assignment function. An attacker with Teacher privileges can exploit this by creating an assignment and uploading a PDF file containing a malicious XSS payload. When other users, such as tho...