Online Faculty Clearance System
Monthly
Unrestricted file upload in SourceCodester Online Faculty Clearance System 1.0 allows authenticated remote attackers to upload arbitrary files - including PHP webshells - via the profile picture upload endpoint at production/edit_picture.php, leading to remote code execution on the host server. The vulnerability stems from PHP's move_uploaded_file() being called without validating file type or extension. A public proof-of-concept exploit exists (GitHub issue linked from VulDB). No KEV listing; EPSS data not provided in source intelligence.
Unauthenticated remote SQL injection in SourceCodester Online Faculty Clearance System 1.0 allows an attacker to inject arbitrary SQL through the ID argument of /delete_faculty1.php, exposing or destroying records in the underlying database. The CVSS 4.0 vector rates network-reachable, low-complexity, no-privilege, no-interaction exploitation with low confidentiality, integrity and availability impact (base 5.5), and publicly available exploit code exists, so unpatched internet-facing instances are immediately at risk. No CISA KEV entry or EPSS score was supplied, so there is no confirmed evidence of active exploitation in the wild at time of analysis.
Unauthenticated SQL injection in SourceCodester Online Faculty Clearance System 1.0 allows remote attackers to inject arbitrary SQL through the ID argument of /delete_requirement.php, giving them read and write access to the application's clearance records. Publicly available exploit code exists (GitHub OnlyCMJB/cve issue 2), and the flaw is tracked by VulDB and ENISA EUVD, but CISA KEV does not list it as actively exploited. Because this is a demo-grade PHP application distributed as downloadable source with no vendor patch channel identified, exposure is concentrated among institutions that deployed it as-is on an internet-facing web server.
A vulnerability was found in code-projects Online Faculty Clearance 1.0. Rated medium severity (CVSS 6.3), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
A vulnerability was found in code-projects Online Faculty Clearance 1.0. Rated medium severity (CVSS 6.3), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
A vulnerability was found in code-projects Online Faculty Clearance 1.0. Rated medium severity (CVSS 6.3), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Unrestricted file upload in SourceCodester Online Faculty Clearance System 1.0 allows authenticated remote attackers to upload arbitrary files - including PHP webshells - via the profile picture upload endpoint at production/edit_picture.php, leading to remote code execution on the host server. The vulnerability stems from PHP's move_uploaded_file() being called without validating file type or extension. A public proof-of-concept exploit exists (GitHub issue linked from VulDB). No KEV listing; EPSS data not provided in source intelligence.
Unauthenticated remote SQL injection in SourceCodester Online Faculty Clearance System 1.0 allows an attacker to inject arbitrary SQL through the ID argument of /delete_faculty1.php, exposing or destroying records in the underlying database. The CVSS 4.0 vector rates network-reachable, low-complexity, no-privilege, no-interaction exploitation with low confidentiality, integrity and availability impact (base 5.5), and publicly available exploit code exists, so unpatched internet-facing instances are immediately at risk. No CISA KEV entry or EPSS score was supplied, so there is no confirmed evidence of active exploitation in the wild at time of analysis.
Unauthenticated SQL injection in SourceCodester Online Faculty Clearance System 1.0 allows remote attackers to inject arbitrary SQL through the ID argument of /delete_requirement.php, giving them read and write access to the application's clearance records. Publicly available exploit code exists (GitHub OnlyCMJB/cve issue 2), and the flaw is tracked by VulDB and ENISA EUVD, but CISA KEV does not list it as actively exploited. Because this is a demo-grade PHP application distributed as downloadable source with no vendor patch channel identified, exposure is concentrated among institutions that deployed it as-is on an internet-facing web server.
A vulnerability was found in code-projects Online Faculty Clearance 1.0. Rated medium severity (CVSS 6.3), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
A vulnerability was found in code-projects Online Faculty Clearance 1.0. Rated medium severity (CVSS 6.3), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
A vulnerability was found in code-projects Online Faculty Clearance 1.0. Rated medium severity (CVSS 6.3), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.