Vendor CVEs
Kashipara
All CVEs
159 total · sorted by risk| CVE | Vendor / Product | Sev | Risk | CVSS | EPSS | KEV | Published | Description |
|---|---|---|---|---|---|---|---|---|
| CVE-2024-42796 | 0.00 | — | 0.00 | Sep 16, 2024 | An Incorrect Access Control vulnerability was found in /music/ajax.php?action=delete_genre in Kashipara Music Management System v1.0. This vulnerability allows an unauthenticated attacker to delete the valid music genre entries. | |||
| CVE-2024-42798 | 0.00 | — | 0.00 | Sep 16, 2024 | An Incorrect Access Control vulnerability was found in /music/index.php?page=user_list and /music/index.php?page=edit_user in Kashipara Music Management System v1.0. This allows a low privileged attacker to take over the administrator account. | |||
| CVE-2024-42794 | 0.00 | — | 0.00 | Sep 16, 2024 | Kashipara Music Management System v1.0 is vulnerable to Incorrect Access Control via /music/ajax.php?action=save_user. | |||
| CVE-2024-42795 | 0.00 | — | 0.00 | Sep 16, 2024 | An Incorrect Access Control vulnerability was found in /music/view_user.php?id=3 and /music/controller.php?page=edit_user&id=3 in Kashipara Music Management System v1.0. This vulnerability allows an unauthenticated attacker to view valid user details. | |||
| CVE-2024-42793 | 0.00 | — | 0.00 | Aug 28, 2024 | A Cross-Site Request Forgery (CSRF) vulnerability was found in Kashipara Music Management System v1.0 via a crafted request to the /music/ajax.php?action=save_user page. | |||
| CVE-2024-41236 | 0.00 | — | 0.00 | Aug 28, 2024 | A SQL injection vulnerability in /smsa/admin_login.php in Kashipara Responsive School Management System v3.2.0 allows an attacker to execute arbitrary SQL commands via the "username" parameter of the Admin Login Page | |||
| CVE-2024-42790 | 0.00 | — | 0.00 | Aug 26, 2024 | A Reflected Cross Site Scripting (XSS) vulnerability was found in "/music/index.php?page=test" in Kashipara Music Management System v1.0. This vulnerability allows remote attackers to execute arbitrary code via the "page" parameter. | |||
| CVE-2024-42788 | 0.00 | — | 0.00 | Aug 26, 2024 | A Stored Cross Site Scripting (XSS) vulnerability was found in "/music/ajax.php?action=save_music" in Kashipara Music Management System v1.0. This vulnerability allows remote attackers to execute arbitrary code via "title" & "artist" parameter fields. | |||
| CVE-2024-42789 | 0.00 | — | 0.01 | Aug 26, 2024 | A Reflected Cross Site Scripting (XSS) vulnerability was found in "/music/controller.php?page=test" in Kashipara Music Management System v1.0. This vulnerability allows remote attackers to execute arbitrary code via the "page" parameter. | |||
| CVE-2024-42791 | 0.00 | — | 0.01 | Aug 26, 2024 | A Cross-Site Request Forgery (CSRF) vulnerability was found in Kashipara Music Management System v1.0 via /music/ajax.php?action=delete_genre. | |||
| CVE-2024-42787 | 0.00 | — | 0.00 | Aug 26, 2024 | A Stored Cross Site Scripting (XSS) vulnerability was found in "/music/ajax.php?action=save_playlist" in Kashipara Music Management System v1.0. This vulnerability allows remote attackers to execute arbitrary code via "title" & "description" parameter fields. | |||
| CVE-2024-42792 | 0.00 | — | 0.00 | Aug 26, 2024 | A Cross-Site Request Forgery (CSRF) vulnerability was found in Kashipara Music Management System v1.0 via /music/ajax.php?action=delete_playlist page. | |||
| CVE-2024-42765 | 0.00 | — | 0.01 | Aug 23, 2024 | A SQL injection vulnerability in "/login.php" of the Kashipara Bus Ticket Reservation System v1.0 allows remote attackers to execute arbitrary SQL commands and bypass Login via the "email" or "password" Login page parameters. | |||
| CVE-2024-42764 | 0.00 | — | 0.00 | Aug 23, 2024 | Kashipara Bus Ticket Reservation System v1.0 is vulnerable to Cross Site Request Forgery (CSRF) via /deleteTicket.php. | |||
| CVE-2024-42766 | 0.00 | — | 0.00 | Aug 23, 2024 | Kashipara Bus Ticket Reservation System v1.0 0 is vulnerable to Incorrect Access Control via /deleteTicket.php. | |||
| CVE-2024-42772 | 0.00 | — | 0.00 | Aug 22, 2024 | An Incorrect Access Control vulnerability was found in /admin/rooms.php in Kashipara Hotel Management System v1.0, which allows an unauthenticated attacker to view valid hotel room entries in administrator section. | |||
| CVE-2024-42762 | 0.00 | — | 0.00 | Aug 22, 2024 | A Stored Cross Site Scripting (XSS) vulnerability was found in "/history.php" in Kashipara Bus Ticket Reservation System v1.0, which allows remote attackers to execute arbitrary code via the Name, Phone, and Email parameter fields. | |||
| CVE-2024-42771 | 0.00 | — | 0.00 | Aug 22, 2024 | A Stored Cross Site Scripting (XSS) vulnerability was found in " /admin/edit_room_controller.php" of the Kashipara Hotel Management System v1.0, which allows remote attackers to execute arbitrary code via "room_name" parameter. | |||
| CVE-2024-42775 | 0.00 | — | 0.00 | Aug 22, 2024 | An Incorrect Access Control vulnerability was found in /admin/add_room_controller.php in Kashipara Hotel Management System v1.0, which allows an unauthenticated attacker to add the valid hotel room entries in the administrator section via the direct URL access. | |||
| CVE-2024-42763 | 0.00 | — | 0.00 | Aug 22, 2024 | A Reflected Cross Site Scripting (XSS) vulnerability was found in the "/schedule.php" page of the Kashipara Bus Ticket Reservation System v1.0, which allows remote attackers to execute arbitrary code via the "bookingdate" parameter. | |||
| CVE-2024-42773 | 0.00 | — | 0.00 | Aug 22, 2024 | An Incorrect Access Control vulnerability was found in /admin/edit_room_controller.php in Kashipara Hotel Management System v1.0, which allows an unauthenticated attacker to edit the valid hotel room entries in the administrator section. | |||
| CVE-2024-42770 | 0.00 | — | 0.00 | Aug 22, 2024 | A Stored Cross Site Scripting (XSS) vulnerability was found in "/core/signup_user.php" of Kashipara Hotel Management System v1.0, which allows remote attackers to execute arbitrary code via the "user_email" parameter. | |||
| CVE-2024-42768 | 0.00 | — | 0.00 | Aug 22, 2024 | A Cross-Site Request Forgery (CSRF) vulnerability was found in Kashipara Hotel Management System v1.0 via /admin/delete_room.php. | |||
| CVE-2024-42774 | 0.00 | — | 0.00 | Aug 22, 2024 | An Incorrect Access Control vulnerability was found in /admin/delete_room.php in Kashipara Hotel Management System v1.0, which allows an unauthenticated attacker to delete valid hotel room entries in the administrator section. | |||
| CVE-2024-42769 | 0.00 | — | 0.00 | Aug 22, 2024 | A Reflected Cross Site Scripting (XSS) vulnerability was found in "/core/signup_user.php " of Kashipara Hotel Management System v1.0, which allows remote attackers to execute arbitrary code via "user_fname" and "user_lname" parameters. | |||
| CVE-2024-42776 | 0.00 | — | 0.01 | Aug 22, 2024 | Kashipara Hotel Management System v1.0 is vulnerable to Incorrect Access Control via /admin/users.php. | |||
| CVE-2024-42761 | 0.00 | — | 0.00 | Aug 22, 2024 | A Stored Cross Site Scripting (XSS) vulnerability was found in "/admin_schedule.php" in Kashipara Bus Ticket Reservation System v1.0, which allows remote attackers to execute arbitrary code via scheduleDurationPHP parameter. | |||
| CVE-2024-42767 | 0.00 | — | 0.01 | Aug 22, 2024 | Kashipara Hotel Management System v1.0 is vulnerable to Unrestricted File Upload RCE via /admin/add_room_controller.php. | |||
| CVE-2024-42781 | 0.00 | — | 0.01 | Aug 21, 2024 | A SQL injection vulnerability in "/music/ajax.php?action=login" of Kashipara Music Management System v1.0 allows remote attackers to execute arbitrary SQL commands and bypass Login via the email parameter. | |||
| CVE-2024-42782 | 0.00 | — | 0.00 | Aug 21, 2024 | A SQL injection vulnerability in "/music/ajax.php?action=find_music" in Kashipara Music Management System v1.0 allows an attacker to execute arbitrary SQL commands via the "search" parameter. | |||
| CVE-2024-42784 | 0.00 | — | 0.01 | Aug 21, 2024 | A SQL injection vulnerability in "/music/controller.php?page=view_music" in Kashipara Music Management System v1.0 allows an attacker to execute arbitrary SQL commands via the "id" parameter. | |||
| CVE-2024-42785 | 0.00 | — | 0.01 | Aug 21, 2024 | A SQL injection vulnerability in /music/index.php?page=view_playlist in Kashipara Music Management System v1.0 allows an attacker to execute arbitrary SQL commands via the "id" parameter. | |||
| CVE-2024-42779 | 0.00 | — | 0.01 | Aug 21, 2024 | An Unrestricted file upload vulnerability was found in "/music/ajax.php?action=save_music" in Kashipara Music Management System v1.0. This allows attackers to execute arbitrary code via uploading a crafted PHP file. | |||
| CVE-2024-42780 | 0.00 | — | 0.01 | Aug 21, 2024 | An Unrestricted file upload vulnerability was found in "/music/ajax.php?action=save_genre" in Kashipara Music Management System v1.0. This allows attackers to execute arbitrary code via uploading a crafted PHP file. | |||
| CVE-2024-42783 | 0.00 | — | 0.00 | Aug 21, 2024 | Kashipara Music Management System v1.0 is vulnerable to SQL Injection via /music/manage_playlist_items.php. An attacker can execute arbitrary SQL commands via the "pid" parameter. | |||
| CVE-2024-42778 | 0.00 | — | 0.01 | Aug 21, 2024 | An Unrestricted file upload vulnerability was found in "/music/ajax.php?action=save_playlist" in Kashipara Music Management System v1.0. This allows attackers to execute arbitrary code via uploading a crafted PHP file. | |||
| CVE-2024-42786 | 0.00 | — | 0.01 | Aug 21, 2024 | A SQL injection vulnerability in "/music/view_user.php" in Kashipara Music Management System v1.0 allows an attacker to execute arbitrary SQL commands via the "id" parameter of View User Profile Page. | |||
| CVE-2024-42777 | 0.00 | — | 0.01 | Aug 21, 2024 | An Unrestricted file upload vulnerability was found in "/music/ajax.php?action=signup" of Kashipara Music Management System v1.0, which allows attackers to execute arbitrary code via uploading a crafted PHP file. | |||
| CVE-2024-41238 | 0.00 | — | 0.00 | Aug 8, 2024 | A SQL injection vulnerability in /smsa/student_login.php in Kashipara Responsive School Management System v1.0 allows an attacker to execute arbitrary SQL commands via the "username" parameter. | |||
| CVE-2024-41244 | 0.00 | — | 0.00 | Aug 7, 2024 | An Incorrect Access Control vulnerability was found in /smsa/view_class.php in Kashipara Responsive School Management System v3.2.0, which allows remote unauthenticated attackers to view CLASS details. | |||
| CVE-2024-41243 | 0.00 | — | 0.01 | Aug 7, 2024 | An Incorrect Access Control vulnerability was found in /smsa/view_marks.php in Kashipara Responsive School Management System v3.2.0, which allows remote unauthenticated attackers to view MARKS details. | |||
| CVE-2024-41249 | 0.00 | — | 0.01 | Aug 7, 2024 | An Incorrect Access Control vulnerability was found in /smsa/view_subject.php in Kashipara Responsive School Management System v3.2.0, which allows remote unauthenticated attackers to view SUBJECT details. | |||
| CVE-2024-41248 | 0.00 | — | 0.01 | Aug 7, 2024 | An Incorrect Access Control vulnerability was found in /smsa/add_subject.php and /smsa/add_subject_submit.php in Kashipara Responsive School Management System v3.2.0, which allows remote unauthenticated attackers to add a new subject entry. | |||
| CVE-2024-41241 | 0.00 | — | 0.00 | Aug 7, 2024 | A Reflected Cross Site Scripting (XSS) vulnerability was found in " /smsa/admin_login.php" in Kashipara Responsive School Management System v3.2.0, which allows remote attackers to execute arbitrary code via "error" parameter. | |||
| CVE-2024-41240 | 0.00 | — | 0.00 | Aug 7, 2024 | A Reflected Cross Site Scripting (XSS) vulnerability was found in " /smsa/teacher_login.php" in Kashipara Responsive School Management System v3.2.0, which allows remote attackers to execute arbitrary code via the "error" parameter. | |||
| CVE-2024-41242 | 0.00 | — | 0.00 | Aug 7, 2024 | A Reflected Cross Site Scripting (XSS) vulnerability was found in /smsa/student_login.php in Kashipara Responsive School Management System v3.2.0, which allows remote attackers to execute arbitrary code via "error" parameter. | |||
| CVE-2024-41251 | 0.00 | — | 0.00 | Aug 7, 2024 | An Incorrect Access Control vulnerability was found in /smsa/admin_teacher_register_approval.php and /smsa/admin_teacher_register_approval_submit.php in Kashipara Responsive School Management System v3.2.0, which allows remote unauthenticated attackers to view and approve… | |||
| CVE-2024-41239 | 0.00 | — | 0.00 | Aug 7, 2024 | A Stored Cross Site Scripting (XSS) vulnerability was found in "/smsa/add_class_submit.php" in Responsive School Management System v3.2.0, which allows remote attackers to execute arbitrary code via "class_name" parameter field. | |||
| CVE-2024-41245 | 0.00 | — | 0.01 | Aug 7, 2024 | An Incorrect Access Control vulnerability was found in /smsa/view_teachers.php in Kashipara Responsive School Management System v3.2.0, which allows remote unauthenticated attackers to view TEACHER details. | |||
| CVE-2024-41246 | 0.00 | — | 0.01 | Aug 7, 2024 | An Incorrect Access Control vulnerability was found in /smsa/admin_dashboard.php in Kashipara Responsive School Management System v3.2.0, which allows remote unauthenticated attackers to view administrator dashboard. |
- CVE-2024-42796Sep 16, 2024risk 0.00cvss —epss 0.00
An Incorrect Access Control vulnerability was found in /music/ajax.php?action=delete_genre in Kashipara Music Management System v1.0. This vulnerability allows an unauthenticated attacker to delete the valid music genre entries.
- CVE-2024-42798Sep 16, 2024risk 0.00cvss —epss 0.00
An Incorrect Access Control vulnerability was found in /music/index.php?page=user_list and /music/index.php?page=edit_user in Kashipara Music Management System v1.0. This allows a low privileged attacker to take over the administrator account.
- CVE-2024-42794Sep 16, 2024risk 0.00cvss —epss 0.00
Kashipara Music Management System v1.0 is vulnerable to Incorrect Access Control via /music/ajax.php?action=save_user.
- CVE-2024-42795Sep 16, 2024risk 0.00cvss —epss 0.00
An Incorrect Access Control vulnerability was found in /music/view_user.php?id=3 and /music/controller.php?page=edit_user&id=3 in Kashipara Music Management System v1.0. This vulnerability allows an unauthenticated attacker to view valid user details.
- CVE-2024-42793Aug 28, 2024risk 0.00cvss —epss 0.00
A Cross-Site Request Forgery (CSRF) vulnerability was found in Kashipara Music Management System v1.0 via a crafted request to the /music/ajax.php?action=save_user page.
- CVE-2024-41236Aug 28, 2024risk 0.00cvss —epss 0.00
A SQL injection vulnerability in /smsa/admin_login.php in Kashipara Responsive School Management System v3.2.0 allows an attacker to execute arbitrary SQL commands via the "username" parameter of the Admin Login Page
- CVE-2024-42790Aug 26, 2024risk 0.00cvss —epss 0.00
A Reflected Cross Site Scripting (XSS) vulnerability was found in "/music/index.php?page=test" in Kashipara Music Management System v1.0. This vulnerability allows remote attackers to execute arbitrary code via the "page" parameter.
- CVE-2024-42788Aug 26, 2024risk 0.00cvss —epss 0.00
A Stored Cross Site Scripting (XSS) vulnerability was found in "/music/ajax.php?action=save_music" in Kashipara Music Management System v1.0. This vulnerability allows remote attackers to execute arbitrary code via "title" & "artist" parameter fields.
- CVE-2024-42789Aug 26, 2024risk 0.00cvss —epss 0.01
A Reflected Cross Site Scripting (XSS) vulnerability was found in "/music/controller.php?page=test" in Kashipara Music Management System v1.0. This vulnerability allows remote attackers to execute arbitrary code via the "page" parameter.
- CVE-2024-42791Aug 26, 2024risk 0.00cvss —epss 0.01
A Cross-Site Request Forgery (CSRF) vulnerability was found in Kashipara Music Management System v1.0 via /music/ajax.php?action=delete_genre.
- CVE-2024-42787Aug 26, 2024risk 0.00cvss —epss 0.00
A Stored Cross Site Scripting (XSS) vulnerability was found in "/music/ajax.php?action=save_playlist" in Kashipara Music Management System v1.0. This vulnerability allows remote attackers to execute arbitrary code via "title" & "description" parameter fields.
- CVE-2024-42792Aug 26, 2024risk 0.00cvss —epss 0.00
A Cross-Site Request Forgery (CSRF) vulnerability was found in Kashipara Music Management System v1.0 via /music/ajax.php?action=delete_playlist page.
- CVE-2024-42765Aug 23, 2024risk 0.00cvss —epss 0.01
A SQL injection vulnerability in "/login.php" of the Kashipara Bus Ticket Reservation System v1.0 allows remote attackers to execute arbitrary SQL commands and bypass Login via the "email" or "password" Login page parameters.
- CVE-2024-42764Aug 23, 2024risk 0.00cvss —epss 0.00
Kashipara Bus Ticket Reservation System v1.0 is vulnerable to Cross Site Request Forgery (CSRF) via /deleteTicket.php.
- CVE-2024-42766Aug 23, 2024risk 0.00cvss —epss 0.00
Kashipara Bus Ticket Reservation System v1.0 0 is vulnerable to Incorrect Access Control via /deleteTicket.php.
- CVE-2024-42772Aug 22, 2024risk 0.00cvss —epss 0.00
An Incorrect Access Control vulnerability was found in /admin/rooms.php in Kashipara Hotel Management System v1.0, which allows an unauthenticated attacker to view valid hotel room entries in administrator section.
- CVE-2024-42762Aug 22, 2024risk 0.00cvss —epss 0.00
A Stored Cross Site Scripting (XSS) vulnerability was found in "/history.php" in Kashipara Bus Ticket Reservation System v1.0, which allows remote attackers to execute arbitrary code via the Name, Phone, and Email parameter fields.
- CVE-2024-42771Aug 22, 2024risk 0.00cvss —epss 0.00
A Stored Cross Site Scripting (XSS) vulnerability was found in " /admin/edit_room_controller.php" of the Kashipara Hotel Management System v1.0, which allows remote attackers to execute arbitrary code via "room_name" parameter.
- CVE-2024-42775Aug 22, 2024risk 0.00cvss —epss 0.00
An Incorrect Access Control vulnerability was found in /admin/add_room_controller.php in Kashipara Hotel Management System v1.0, which allows an unauthenticated attacker to add the valid hotel room entries in the administrator section via the direct URL access.
- CVE-2024-42763Aug 22, 2024risk 0.00cvss —epss 0.00
A Reflected Cross Site Scripting (XSS) vulnerability was found in the "/schedule.php" page of the Kashipara Bus Ticket Reservation System v1.0, which allows remote attackers to execute arbitrary code via the "bookingdate" parameter.
- CVE-2024-42773Aug 22, 2024risk 0.00cvss —epss 0.00
An Incorrect Access Control vulnerability was found in /admin/edit_room_controller.php in Kashipara Hotel Management System v1.0, which allows an unauthenticated attacker to edit the valid hotel room entries in the administrator section.
- CVE-2024-42770Aug 22, 2024risk 0.00cvss —epss 0.00
A Stored Cross Site Scripting (XSS) vulnerability was found in "/core/signup_user.php" of Kashipara Hotel Management System v1.0, which allows remote attackers to execute arbitrary code via the "user_email" parameter.
- CVE-2024-42768Aug 22, 2024risk 0.00cvss —epss 0.00
A Cross-Site Request Forgery (CSRF) vulnerability was found in Kashipara Hotel Management System v1.0 via /admin/delete_room.php.
- CVE-2024-42774Aug 22, 2024risk 0.00cvss —epss 0.00
An Incorrect Access Control vulnerability was found in /admin/delete_room.php in Kashipara Hotel Management System v1.0, which allows an unauthenticated attacker to delete valid hotel room entries in the administrator section.
- CVE-2024-42769Aug 22, 2024risk 0.00cvss —epss 0.00
A Reflected Cross Site Scripting (XSS) vulnerability was found in "/core/signup_user.php " of Kashipara Hotel Management System v1.0, which allows remote attackers to execute arbitrary code via "user_fname" and "user_lname" parameters.
- CVE-2024-42776Aug 22, 2024risk 0.00cvss —epss 0.01
Kashipara Hotel Management System v1.0 is vulnerable to Incorrect Access Control via /admin/users.php.
- CVE-2024-42761Aug 22, 2024risk 0.00cvss —epss 0.00
A Stored Cross Site Scripting (XSS) vulnerability was found in "/admin_schedule.php" in Kashipara Bus Ticket Reservation System v1.0, which allows remote attackers to execute arbitrary code via scheduleDurationPHP parameter.
- CVE-2024-42767Aug 22, 2024risk 0.00cvss —epss 0.01
Kashipara Hotel Management System v1.0 is vulnerable to Unrestricted File Upload RCE via /admin/add_room_controller.php.
- CVE-2024-42781Aug 21, 2024risk 0.00cvss —epss 0.01
A SQL injection vulnerability in "/music/ajax.php?action=login" of Kashipara Music Management System v1.0 allows remote attackers to execute arbitrary SQL commands and bypass Login via the email parameter.
- CVE-2024-42782Aug 21, 2024risk 0.00cvss —epss 0.00
A SQL injection vulnerability in "/music/ajax.php?action=find_music" in Kashipara Music Management System v1.0 allows an attacker to execute arbitrary SQL commands via the "search" parameter.
- CVE-2024-42784Aug 21, 2024risk 0.00cvss —epss 0.01
A SQL injection vulnerability in "/music/controller.php?page=view_music" in Kashipara Music Management System v1.0 allows an attacker to execute arbitrary SQL commands via the "id" parameter.
- CVE-2024-42785Aug 21, 2024risk 0.00cvss —epss 0.01
A SQL injection vulnerability in /music/index.php?page=view_playlist in Kashipara Music Management System v1.0 allows an attacker to execute arbitrary SQL commands via the "id" parameter.
- CVE-2024-42779Aug 21, 2024risk 0.00cvss —epss 0.01
An Unrestricted file upload vulnerability was found in "/music/ajax.php?action=save_music" in Kashipara Music Management System v1.0. This allows attackers to execute arbitrary code via uploading a crafted PHP file.
- CVE-2024-42780Aug 21, 2024risk 0.00cvss —epss 0.01
An Unrestricted file upload vulnerability was found in "/music/ajax.php?action=save_genre" in Kashipara Music Management System v1.0. This allows attackers to execute arbitrary code via uploading a crafted PHP file.
- CVE-2024-42783Aug 21, 2024risk 0.00cvss —epss 0.00
Kashipara Music Management System v1.0 is vulnerable to SQL Injection via /music/manage_playlist_items.php. An attacker can execute arbitrary SQL commands via the "pid" parameter.
- CVE-2024-42778Aug 21, 2024risk 0.00cvss —epss 0.01
An Unrestricted file upload vulnerability was found in "/music/ajax.php?action=save_playlist" in Kashipara Music Management System v1.0. This allows attackers to execute arbitrary code via uploading a crafted PHP file.
- CVE-2024-42786Aug 21, 2024risk 0.00cvss —epss 0.01
A SQL injection vulnerability in "/music/view_user.php" in Kashipara Music Management System v1.0 allows an attacker to execute arbitrary SQL commands via the "id" parameter of View User Profile Page.
- CVE-2024-42777Aug 21, 2024risk 0.00cvss —epss 0.01
An Unrestricted file upload vulnerability was found in "/music/ajax.php?action=signup" of Kashipara Music Management System v1.0, which allows attackers to execute arbitrary code via uploading a crafted PHP file.
- CVE-2024-41238Aug 8, 2024risk 0.00cvss —epss 0.00
A SQL injection vulnerability in /smsa/student_login.php in Kashipara Responsive School Management System v1.0 allows an attacker to execute arbitrary SQL commands via the "username" parameter.
- CVE-2024-41244Aug 7, 2024risk 0.00cvss —epss 0.00
An Incorrect Access Control vulnerability was found in /smsa/view_class.php in Kashipara Responsive School Management System v3.2.0, which allows remote unauthenticated attackers to view CLASS details.
- CVE-2024-41243Aug 7, 2024risk 0.00cvss —epss 0.01
An Incorrect Access Control vulnerability was found in /smsa/view_marks.php in Kashipara Responsive School Management System v3.2.0, which allows remote unauthenticated attackers to view MARKS details.
- CVE-2024-41249Aug 7, 2024risk 0.00cvss —epss 0.01
An Incorrect Access Control vulnerability was found in /smsa/view_subject.php in Kashipara Responsive School Management System v3.2.0, which allows remote unauthenticated attackers to view SUBJECT details.
- CVE-2024-41248Aug 7, 2024risk 0.00cvss —epss 0.01
An Incorrect Access Control vulnerability was found in /smsa/add_subject.php and /smsa/add_subject_submit.php in Kashipara Responsive School Management System v3.2.0, which allows remote unauthenticated attackers to add a new subject entry.
- CVE-2024-41241Aug 7, 2024risk 0.00cvss —epss 0.00
A Reflected Cross Site Scripting (XSS) vulnerability was found in " /smsa/admin_login.php" in Kashipara Responsive School Management System v3.2.0, which allows remote attackers to execute arbitrary code via "error" parameter.
- CVE-2024-41240Aug 7, 2024risk 0.00cvss —epss 0.00
A Reflected Cross Site Scripting (XSS) vulnerability was found in " /smsa/teacher_login.php" in Kashipara Responsive School Management System v3.2.0, which allows remote attackers to execute arbitrary code via the "error" parameter.
- CVE-2024-41242Aug 7, 2024risk 0.00cvss —epss 0.00
A Reflected Cross Site Scripting (XSS) vulnerability was found in /smsa/student_login.php in Kashipara Responsive School Management System v3.2.0, which allows remote attackers to execute arbitrary code via "error" parameter.
- CVE-2024-41251Aug 7, 2024risk 0.00cvss —epss 0.00
An Incorrect Access Control vulnerability was found in /smsa/admin_teacher_register_approval.php and /smsa/admin_teacher_register_approval_submit.php in Kashipara Responsive School Management System v3.2.0, which allows remote unauthenticated attackers to view and approve…
- CVE-2024-41239Aug 7, 2024risk 0.00cvss —epss 0.00
A Stored Cross Site Scripting (XSS) vulnerability was found in "/smsa/add_class_submit.php" in Responsive School Management System v3.2.0, which allows remote attackers to execute arbitrary code via "class_name" parameter field.
- CVE-2024-41245Aug 7, 2024risk 0.00cvss —epss 0.01
An Incorrect Access Control vulnerability was found in /smsa/view_teachers.php in Kashipara Responsive School Management System v3.2.0, which allows remote unauthenticated attackers to view TEACHER details.
- CVE-2024-41246Aug 7, 2024risk 0.00cvss —epss 0.01
An Incorrect Access Control vulnerability was found in /smsa/admin_dashboard.php in Kashipara Responsive School Management System v3.2.0, which allows remote unauthenticated attackers to view administrator dashboard.
Page 2 of 4