Online Admission System Project
Monthly
SQL injection in itsourcecode Online Admission System Project 1.0 exposes the admin login handler at /admin/login1.php, where the User parameter is used in a database query without adequate sanitization. Remote unauthenticated attackers can submit crafted input to the login form and manipulate SQL statements, with limited confidentiality, integrity, and availability impacts per the provided CVSS 4.0 score of 6.9 and the independent CVSS 3.1 assessment. Publicly available exploit code exists, no CISA KEV active exploitation is confirmed, and the realistic exposed population is small because this is a rarely deployed sample application.
SQL injection in the ID parameter processed by confirm.php in itsourcecode Online Admission System Project 1.0 lets an authenticated remote user with only low privileges inject arbitrary SQL into backend queries and read or alter the underlying database. The flaw is a textbook CWE-89 case in a small open-source PHP sample/tutorial application, and the required low-privilege session (CVSS 4.0 PR:L, UI:N) plus the product's limited real-world deployment keep practical risk at LOW-to-MODERATE despite the public availability of exploit code. No CISA KEV entry indicates confirmed active exploitation, but a public proof-of-concept has been released (referenced via the VulDB report and a GitHub issue), so any internet-reachable instance should be treated as exposed. The assessed impact is limited confidentiality, integrity, and availability loss (CVSS 5.3), not full system compromise.
A vulnerability was found in Project Worlds Online Admission System 1.0 and classified as critical.php. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
A vulnerability classified as problematic has been found in SourceCodester Online Admission System. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
A vulnerability, which was classified as problematic, was found in SourceCodester Online Admission System. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
A vulnerability was found in SourceCodester Online Admission System and classified as critical. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
A vulnerability has been found in SourceCodester Online Admission System and classified as critical. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
SQL injection in itsourcecode Online Admission System Project 1.0 exposes the admin login handler at /admin/login1.php, where the User parameter is used in a database query without adequate sanitization. Remote unauthenticated attackers can submit crafted input to the login form and manipulate SQL statements, with limited confidentiality, integrity, and availability impacts per the provided CVSS 4.0 score of 6.9 and the independent CVSS 3.1 assessment. Publicly available exploit code exists, no CISA KEV active exploitation is confirmed, and the realistic exposed population is small because this is a rarely deployed sample application.
SQL injection in the ID parameter processed by confirm.php in itsourcecode Online Admission System Project 1.0 lets an authenticated remote user with only low privileges inject arbitrary SQL into backend queries and read or alter the underlying database. The flaw is a textbook CWE-89 case in a small open-source PHP sample/tutorial application, and the required low-privilege session (CVSS 4.0 PR:L, UI:N) plus the product's limited real-world deployment keep practical risk at LOW-to-MODERATE despite the public availability of exploit code. No CISA KEV entry indicates confirmed active exploitation, but a public proof-of-concept has been released (referenced via the VulDB report and a GitHub issue), so any internet-reachable instance should be treated as exposed. The assessed impact is limited confidentiality, integrity, and availability loss (CVSS 5.3), not full system compromise.
A vulnerability was found in Project Worlds Online Admission System 1.0 and classified as critical.php. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
A vulnerability classified as problematic has been found in SourceCodester Online Admission System. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
A vulnerability, which was classified as problematic, was found in SourceCodester Online Admission System. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
A vulnerability was found in SourceCodester Online Admission System and classified as critical. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
A vulnerability has been found in SourceCodester Online Admission System and classified as critical. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.