CVE-2024-34240

QDOCS Smart School version 7.0.0 is vulnerable to a Cross-Site Scripting (XSS) flaw in administrative functions used for adding or updating records. This vulnerability allows an attacker to achieve arbitrary code execution on the system. As a workaround, users should consider disabling admin func...

CVE-2024-8784

CVE-2024-8784 affects QDocs Smart School Management System 7.0.0, specifically the Chat component at /user/chat/mynewuser. The vulnerability arises from manipulation of the POST parameter users[] that leads to SQL injection (exploitation described as remote). Publicly disclosed exploit exists; im...

CVE-2023-5495

CVE-2023-5495 affects QDocs Smart School 6.4.1. The vulnerability is a SQL injection in the HTTP POST Request Handler, triggered by manipulating the POST parameters searchdata[0][title], searchdata[0][searchfield], and searchdata[0][searchvalue] sent to /course/filterRecords/. Root cause: input d...

CVE-2025-60500

QDocs Smart School Management System 7.1 contains a logic flaw in its media upload feature, specifically within the Download Center > Upload Share Content component. Authenticated users with accountant , admin , or superadmin roles can bypass file-type restrictions by simultaneously providing ...

CVE-2025-41107

The CVE-2025-41107 entry describes a Stored XSS in Smart School 7.0 caused by insufficient validation of user input in a POST to /online_admission, affecting fields such as firstname, lastname, guardian_name, etc. The issue could allow a remote attacker to craft input that is processed by an auth...