CVE-2024-9659

CVE-2024-9659 affects School Management System for WordPress (WordPress plugin) up to version 91.5.0, where missing file type validation in mj_smgt_user_avatar_image_upload() allows unauthenticated arbitrary file uploads. The impact is described as potentially enabling remote code execution on th...

CVE-2024-9660

CVE-2024-9660 (School Management System for Wordpress) The WordPress plugin versions up to 91.5.0 are vulnerable to arbitrary file uploads due to missing file-type validation in mj_smgt_load_documets_new() and mj_smgt_load_documets(), enabling authenticated users with Student-level access and abo...

CVE-2024-12609

CVE-2024-12609 affects the WordPress plugin School Management System for Wordpress (

CVE-2024-12607

CVE-2024-12607 affects the WordPress plugin “School Management System for WordPress.” It is an SQL Injection via the id parameter of the mj_smgt_show_event_task AJAX action in all versions up to and including 92.0.0. Exploitation requires authenticated access at Custom level or higher, enabling a...

CVE-2017-14843

Mojoomla School Management System for WordPress is affected by a SQL injection via the id parameter. Root cause: insufficient input validation allowing attackers to inject arbitrary SQL. Impact (per CVSS data): high confidentiality, integrity, and availability impact with network access and low a...

CVE-2024-12610

CVE-2024-12610 affects the School Management System for Wordpress plugin for WordPress (≤ 93.0.0). Root cause: missing capability check on AJAX actions mj_smgt_remove_feetype and mj_smgt_remove_category_new, enabling unauthenticated attackers to delete arbitrary posts. Impact per sources: unautho...

CVE-2024-12611

CVE-2024-12611 affects the WordPress plugin “School Management System for Wordpress” (versions up to and including 93.0.0). The connected documents confirm a Reflected Cross-Site Scripting vulnerability via the title parameter arising from insufficient input sanitization and output escaping. The ...

CVE-2024-9658

CVE-2024-9658 affects the WordPress plugin “School Management System for Wordpress” up to version 93.0.0. The root causes are improper identity validation during updates to user data (email/password) via mj_smgt_update_user() and mj_smgt_add_admission(), and a local file inclusion vulnerability. ...