CVE-2023-49987

The School Fees Management System v1.0 is vulnerable to a cross-site scripting (XSS) flaw within the /management/term component. An attacker can execute arbitrary web scripts or HTML by injecting a crafted payload into the tname parameter, specifically during the process of adding or editing a pe...

CVE-2023-49986

A cross-site scripting (XSS) vulnerability exists in the School Fees Management System v1.0 within the /admin/parent component (specifically the add_new_parent function). Attackers can execute arbitrary web scripts or HTML by injecting a crafted payload into the name or email parameters. A user w...

CVE-2023-49985

School Fees Management System v1.0 is affected by a cross-site scripting (XSS) vulnerability within the /management/class component. The root cause is the improper neutralization of input, allowing an attacker to inject a crafted payload into the cname parameter. This enables the execution of arb...

CVE-2023-49983

A cross-site scripting (XSS) vulnerability exists in the /management/class component of School Fees Management System v1.0 . The flaw allows attackers to execute arbitrary web scripts or HTML by injecting a crafted payload into the name parameter. To exploit this, a user with appropriate permissi...

CVE-2023-49981

The vulnerability CVE-2023-49981 affects School Fees Management System v1.0 and is a directory listing flaw caused by an improper access control/logic that allows unauthenticated users to enumerate directories and sensitive files. The CVSS v3.1 base score is 7.5 (HIGH) with NETWORK attack vector,...

CVE-2023-49982

School Fees Management System v1.0 is vulnerable to broken access control within the /admin/management/users component (along with /ci_fms/admin/management/class, /term, and /settings). This flaw allows an authenticated user to escalate privileges and perform unauthorized Administrative actions ,...

CVE-2023-49984

School Fees Management System v1.0 is vulnerable to a cross-site scripting (XSS) vulnerability in the /management/settings component. Attackers can execute arbitrary web scripts or HTML by injecting a crafted payload into the name parameter. Other susceptible parameters in the same area include p...