30 matches found
CVE-2024-31547
Computer Laboratory Management System v1.0 is vulnerable to SQL Injection due to the improper neutralization of special elements used in an SQL command. The flaw exists specifically in the "id" parameter of the /admin/item/view_item.php API endpoint. Exploitation of this vulnerability could allow...
CVE-2024-3376
CVE-2024-3376 affects SourceCodester Computer Laboratory Management System 1.0. The vulnerability is in the config.php file, where manipulation of the url parameter leads to execution after redirect, enabling remote initiation of an attack. Exploit details are publicly disclosed per the sources. ...
CVE-2024-40443
A SQL Injection vulnerability exists in the SourceCodester Computer Laboratory Management System (also referred to as Simple Laboratory Management System) v1.0 using PHP and MySQL . The flaw is located in the delete_users function within the Useres.php file. A remote attacker can exploit this vul...
CVE-2025-45956
The Sourcecodester Computer Laboratory Management System v1.0 is vulnerable to a SQL injection flaw in the manage_damage.php file. An authenticated attacker can exploit the **
CVE-2024-3251
Summary: CVE-2024-3251 affects SourceCodester Computer Laboratory Management System 1.0. Affected component: the file path /admin/?page=borrow/view_borrow where manipulating the id parameter allows SQL injection. The vulnerability is described as exploitable remotely, with the public disclosure o...
CVE-2024-31545
Computer Laboratory Management System v1.0 is vulnerable to SQL Injection due to improper neutralization of special elements in the id parameter of the /admin/?page=user/manage_user&id=6 API endpoint. An attacker could potentially inject malicious SQL code through this variable. As a temporary wo...
CVE-2024-3139
CVE-2024-3139 affects SourceCodester Computer Laboratory Management System 1.0. The vulnerability lies in the save_users function (/classes/Users.php?f=save), where the id argument is used in file path/authorization logic without proper validation, enabling improper authorization. A remote attack...
CVE-2024-31546
The Sourcecodester Computer Laboratory Management System v1.0 is vulnerable to SQL Injection due to the improper neutralization of special elements in an SQL command. This vulnerability is triggered via the id parameter of the /admin/damage/view_damage.php endpoint. An attacker could exploit this...
CVE-2024-3316
The CVE-2024-3316 entry concerns SourceCodester Computer Laboratory Management System 1.0. Affected functionality is the file /admin/category/view_category.php where manipulating the id parameter causes SQL injection. The issue is exploitable remotely and the exploit has been publicly disclosed, ...
CVE-2024-34224
The Computer Laboratory Management System using PHP and MySQL 1.0 (specifically version 1.0) is vulnerable to a Cross Site Scripting (XSS) flaw. The vulnerability exists in the /php-lms/classes/Users.php?f=save endpoint, where the application fails to properly neutralize the firstname , middlenam...
CVE-2024-54818
SourceCodester Computer Laboratory Management System 1.0 is vulnerable to Incorrect Access Control through the endpoint /php-lms/admin/?page=user/list. The vulnerability allows for improper preservation of permissions, potentially granting unauthorized access to sensitive administrative functions...
CVE-2024-41332
CVE-2024-41332 affects Sourcecodester Computer Laboratory Management System v1.0. The issue is an incorrect access control in the delete_category function that lets authenticated users with low privileges arbitrarily delete categories. Public references indicate a privilege-escalation path via a ...
CVE-2024-3314
CVE-2024-3314 affects SourceCodester Computer Laboratory Management System 1.0. The vulnerability is due to SQL injection in the file /classes/Users.php, enabling remote exploitation. Documented impact includes high confidentiality, integrity, and availability concerns. Multiple sources (NVD, Red...
CVE-2024-3315
The CVE-2024-3315 flaw affects SourceCodester Computer Laboratory Management System 1.0, specifically an unknown function in classes/user.php where manipulating the id parameter enables SQL injection. The issue can be exploited remotely, and exploitation has been disclosed publicly (VDB-259386). ...
CVE-2024-3131
CVE-2024-3131 affects SourceCodester Computer Laboratory Management System v1.0. The vulnerability resides in /classes/Master.php?f=save_category where manipulating the id parameter leads to SQL injection, enabling remote exploitation. Public exploitation and disclosure have been reported. The CV...
CVE-2024-34225
The Computer Laboratory Management System (version 1.0) is vulnerable to a Cross-Site Scripting (XSS) vulnerability located in the php-lms/admin/?page=system_info endpoint. The root cause allows remote attackers to inject arbitrary web scripts or HTML through the name and shortname parameters. As...
CVE-2024-8347
CVE-2024-8347 affects SourceCodester Computer Laboratory Management System 1.0. The vulnerable component is the delete_record function in /classes/Master.php?f=delete_record, where manipulation of the id parameter leads to SQL injection. The issue enables remote exploitation and the exploit has b...
CVE-2024-34480
SourceCodester Computer Laboratory Management System 1.0 has a SQL Injection vulnerability in admin/category/view_category.php?id. The issue is described across multiple sources, with CVSS 3.1/4.6? Actually CVSS 3.1 vector: AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, base score 9.8 (CRITICAL). The vulne...
CVE-2024-8348
CVE-2024-8348 affects SourceCodester Computer Laboratory Management System 1.0, specifically the delete_category function in /classes/Master.php?f=delete_category. The vulnerability is an SQL injection triggered by manipulating the id parameter, and is exploitable remotely. Multiple sources confi...
CVE-2024-3140
The CVE-2024-3140 entry concerns SourceCodester Computer Laboratory Management System 1.0. The vulnerability lies in the /classes/Users.php?f=save path, where manipulation of the middlename argument enables cross-site scripting (XSS). Exploitation is remote, and public disclosures exist (VDB-2589...
CVE-2024-31586
A Cross Site Scripting (XSS) vulnerability exists in Computer Laboratory Management System version 1.0 . The root cause is the improper neutralization of input during web page generation, specifically via the Borrower Name , Department , and Remarks parameters. A remote attacker can exploit this ...
CVE-2024-3377
CVE-2024-3377 affects SourceCodester Computer Laboratory Management System 1.0. The vulnerability resides in the /classes/SystemSettings.php?f=update_settings code, where the manipulation of the argument name enables cross-site scripting (XSS). The issue can be triggered remotely and the exploit ...
CVE-2024-35583
The Sourcecodester Laboratory Management System v1.0 is vulnerable to a cross-site scripting (XSS) issue (CWE-79). An attacker can execute arbitrary web scripts or HTML by injecting a crafted payload into the Remarks input field. To mitigate this risk, it is recommended to validate and sanitize u...
CVE-2024-3695
CVE-2024-3695 affects SourceCodester Computer Laboratory Management System 1.0. The vulnerability is in the /classes/Users.php file, where manipulating the id argument enables cross-site scripting (XSS). This can be triggered remotely and, per the CVE record, the exploit has been disclosed public...
CVE-2024-8346
The CVE-2024-8346 instance concerns SourceCodester Computer Laboratory Management System 1.0. The vulnerability resides in the function update_settings_info of /classes/SystemSettings.php?f=update_settings, where manipulation of the name argument enables SQL injection. This flaw can be exploited ...
CVE-2024-35582
Sourcecodester Laboratory Management System v1.0 is susceptible to a cross-site scripting (XSS) vulnerability. An attacker can execute arbitrary web scripts or HTML by injecting a crafted payload into the Department input field. As a remediation, it is recommended to restrict input to the Departm...
CVE-2024-31544
The Computer Laboratory Management System v1.0 is affected by a stored cross-site scripting (XSS) vulnerability. An attacker can execute arbitrary JavaScript code by injecting malicious payloads into the remarks, borrower_name, or faculty_department parameters at the /classes/Master.php?f=save_re...
CVE-2024-34479
Vulnerability overview for CVE-2024-34479: Affects SourceCodester Computer Laboratory Management System 1.0. The flaw resides in the classes/Master.php id parameter, enabling SQL Injection due to insufficient input handling. Reported impact in the sources indicates full confidentiality, integrity...
CVE-2024-35581
The Sourcecodester Laboratory Management System v1.0 is vulnerable to a cross-site scripting (XSS) flaw (CWE-94). Attackers can execute arbitrary web scripts or HTML by injecting a crafted payload into the Borrower Name input field. To mitigate this risk, it is recommended to validate and sanitiz...