CVE-2022-28079

College Management System v1.0 was discovered to contain a SQL injection vulnerability via the course_code parameter.

CVE-2022-30404

College Management System v1.0 is vulnerable to SQL Injection via /College_Management_System/admin/display-teacher.php?teacher_id=.

CVE-2022-39179

College Management System v1.0 - Authenticated remote code execution.An admin user (the authentication can be bypassed using SQL Injection that mentioned in my other report) can upload.php file that contains malicious code via student.php file.

CVE-2022-39180

College Management System v1.0 - SQL Injection (SQLi).By inserting SQL commands to the username and password fields in the login.php page

CVE-2022-32420

College Management System v1.0 was discovered to contain a remote code execution (RCE) vulnerability via /College/admin/teacher.php. This vulnerability is exploited via a crafted PHP file.