CVSS: 7.5EPSS: 0%CPEs: 1EXPL: 1CVE-2024-6191 – itsourcecode Student Management System Login Page login.php sql injection
https://notcve.org/view.php?id=CVE-2024-6191
A vulnerability classified as critical has been found in itsourcecode Student Management System 1.0. This affects an unknown part of the file login.php of the component Login Page. The manipulation of the argument user leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. • https://github.com/HryspaHodor/CVE/issues/3 https://vuldb.com/?ctiid.269163 https://vuldb.com/?id.269163 https://vuldb.com/?submit.359009 • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') •
CVSS: 7.5EPSS: 0%CPEs: 1EXPL: 1CVE-2024-5047 – SourceCodester Student Management System controller.php unrestricted upload
https://notcve.org/view.php?id=CVE-2024-5047
A vulnerability classified as critical has been found in SourceCodester Student Management System 1.0. Affected is an unknown function of the file /student/controller.php. The manipulation of the argument photo leads to unrestricted upload. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. • https://github.com/I-Schnee-I/cev/blob/main/SourceCodester%20Student%20Management%20System%201.0%20controller.php%20Unrestricted%20Upload.md https://vuldb.com/?ctiid.264744 https://vuldb.com/?id.264744 https://vuldb.com/?submit.335633 • CWE-434: Unrestricted Upload of File with Dangerous Type •
CVSS: 4.8EPSS: 0%CPEs: 1EXPL: 0CVE-2023-41616
https://notcve.org/view.php?id=CVE-2023-41616
A reflected cross-site scripting (XSS) vulnerability in the Search Student function of Student Management System v1.2.3 and before allows attackers to execute arbitrary Javascript in the context of a victim user's browser via a crafted payload. Una vulnerabilidad de Cross-Site Scripting (XSS) reflejada en la función Buscar Estudiantes del Student Management System v1.2.3 y anteriores permite a los atacantes ejecutar Javascript arbitrario en el contexto del navegador de un usuario víctima a través de un payload manipulado. • https://medium.com/%40guravtushar231/reflected-xss-in-admin-panel-7a459dcb9476 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 9.8EPSS: 0%CPEs: 1EXPL: 1CVE-2023-3008 – ningzichun Student Management System login.php sql injection
https://notcve.org/view.php?id=CVE-2023-3008
A vulnerability classified as critical has been found in ningzichun Student Management System 1.0. This affects an unknown part of the file login.php. The manipulation of the argument user/pass leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. • https://github.com/Xor-Gerke/webray.com.cn/blob/main/cve/student-management-system/sql_inject.md https://vuldb.com/?ctiid.230355 https://vuldb.com/?id.230355 • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') •
CVSS: 9.8EPSS: 0%CPEs: 1EXPL: 1CVE-2023-3007 – ningzichun Student Management System Password Reset resetPassword.php password recovery
https://notcve.org/view.php?id=CVE-2023-3007
A vulnerability was found in ningzichun Student Management System 1.0. It has been rated as critical. Affected by this issue is some unknown functionality of the file resetPassword.php of the component Password Reset Handler. The manipulation of the argument sid leads to weak password recovery. The attack may be launched remotely. • https://github.com/Xor-Gerke/webray.com.cn/blob/main/cve/student-management-system/password_reset.md https://vuldb.com/?ctiid.230354 https://vuldb.com/?id.230354 • CWE-640: Weak Password Recovery Mechanism for Forgotten Password •