CVE-2025-25953

The Serosoft Solutions Pvt Ltd Academia Student Information System (SIS) EagleR version 1.0.118 is vulnerable to an Azure JWT access token exposure . This flaw allows authenticated attackers to escalate privileges and gain unauthorized access to sensitive information . To mitigate this risk until...

CVE-2025-25952

The Serosoft Solutions Pvt Ltd Academia Student Information System (SIS) EagleR version 1.0.118 is vulnerable to an Insecure Direct Object References (IDOR) flaw in the /getStudemtAllDetailsById?studentId=XX component. An attacker can exploit this by sending a crafted API request to access sensit...

CVE-2025-27583

Serosoft Solutions Pvt Ltd Academia Student Information System (SIS) EagleR v1.0.118 contains an incorrect access control vulnerability in the /rest/staffResource/findAllUsersAcrossOrg component. This flaw allows an attacker to create and modify user accounts , including the ability to create an ...

CVE-2025-25950

Serosoft Solutions Pvt Ltd Academia Student Information System (SIS) EagleR v1.0.118 is vulnerable to incorrect access control in the /rest/staffResource/update component. This flaw allows an attacker to create and modify user accounts , including the creation of an Administrator account . While ...

CVE-2025-25951

The Serosoft Solutions Pvt Ltd Academia Student Information System (SIS) EagleR version 1.0.118 is affected by an information disclosure vulnerability in the /rest/cb/executeBasicSearch component. This flaw allows attackers to gain unauthorized access to sensitive user information . No specific p...

CVE-2025-27584

A stored cross-site scripting (XSS) vulnerability exists in Serosoft Solutions Pvt Ltd Academia Student Information System (SIS) EagleR v1.0.118 . The flaw is caused by the improper neutralization of input during web page generation, specifically within the First Name parameter at the /rest/staff...

CVE-2025-27585

Serosoft Solutions Pvt Ltd Academia Student Information System (SIS) EagleR v1.0.118 is vulnerable to a stored cross-site scripting (XSS) vulnerability. The flaw exists in the Print Name parameter at the /rest/staffResource/update API endpoint, where an attacker can inject a crafted payload to ex...