Online Library Management System
Monthly
Information disclosure in code-projects Online Library Management System 1.0 allows unauthenticated remote attackers to access sensitive data from SQL database backup files via the /sql/library.sql component, requiring user interaction (clicking a link or similar action). The vulnerability has a publicly available exploit and carries a CVSS score of 4.3 with an exploit proof-of-concept (E:P) rating, making it a low-to-moderate priority issue with confirmed public discoverability but limited real-world attack surface due to interaction requirements.
SQL injection in SourceCodester Online Library Management System 1.0 allows unauthenticated remote attackers to manipulate the searchField parameter in /home.php, enabling data exfiltration, modification, and potential service disruption. Public exploit code exists for this vulnerability, and no patch is currently available.
An issue in Online Library Management System v.3.0 allows an attacker to escalate privileges via the adminlogin.php component and the Login function. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
An issue in PHPGurukul Online-Library-Management-System v3.0 allows an attacker to escalate privileges via the index.php. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
Session hijacking in PHPGurukul Online Library Management System v3.0 stems from improper session invalidation in /library/change-password.php, where sessions are not properly terminated after credential changes, allowing an attacker who obtains or reuses a still-valid session token to impersonate a victim. Publicly available exploit code exists (GitHub, VasilVK), though there is no public exploit identified as actively exploited in the wild and it is not listed in CISA KEV. EPSS is low at 0.39% (31st percentile), indicating limited predicted mass-exploitation activity despite the available POC.
Reflected cross-site scripting in PHPGurukul Online Library Management System 3.0 allows a remote, low-privileged attacker to inject arbitrary JavaScript into the admin panel by manipulating the `stdid` parameter in `/admin/student-history.php`. A victim admin user who loads a crafted URL or page would execute attacker-controlled script in their browser session, enabling session hijacking or DOM manipulation. A public proof-of-concept exploit has been disclosed on GitHub; EPSS remains very low at 0.03% (8th percentile), consistent with a niche product with limited real-world attack surface.
SQL injection in PHPGurukul Online Library Management System 3.0 allows authenticated attackers with low privileges to manipulate the stdid parameter in the /admin/student-history.php endpoint, potentially reading or modifying database records. A proof-of-concept exploit is publicly available, but the EPSS exploitation probability is very low (0.04%), indicating limited real-world threat despite a
A vulnerability was found in PHPGurukul Online Library Management System 3.0. Rated low severity (CVSS 2.3), this vulnerability is remotely exploitable. Public exploit code available and no vendor patch available.
An Arbitrary File Upload in the Upload Image component in SourceCodester Online Library Management System 1.0 allows the user to conduct remote code execution via admin/borrower/index.php?view=add. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
Information disclosure in code-projects Online Library Management System 1.0 allows unauthenticated remote attackers to access sensitive data from SQL database backup files via the /sql/library.sql component, requiring user interaction (clicking a link or similar action). The vulnerability has a publicly available exploit and carries a CVSS score of 4.3 with an exploit proof-of-concept (E:P) rating, making it a low-to-moderate priority issue with confirmed public discoverability but limited real-world attack surface due to interaction requirements.
SQL injection in SourceCodester Online Library Management System 1.0 allows unauthenticated remote attackers to manipulate the searchField parameter in /home.php, enabling data exfiltration, modification, and potential service disruption. Public exploit code exists for this vulnerability, and no patch is currently available.
An issue in Online Library Management System v.3.0 allows an attacker to escalate privileges via the adminlogin.php component and the Login function. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
An issue in PHPGurukul Online-Library-Management-System v3.0 allows an attacker to escalate privileges via the index.php. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
Session hijacking in PHPGurukul Online Library Management System v3.0 stems from improper session invalidation in /library/change-password.php, where sessions are not properly terminated after credential changes, allowing an attacker who obtains or reuses a still-valid session token to impersonate a victim. Publicly available exploit code exists (GitHub, VasilVK), though there is no public exploit identified as actively exploited in the wild and it is not listed in CISA KEV. EPSS is low at 0.39% (31st percentile), indicating limited predicted mass-exploitation activity despite the available POC.
Reflected cross-site scripting in PHPGurukul Online Library Management System 3.0 allows a remote, low-privileged attacker to inject arbitrary JavaScript into the admin panel by manipulating the `stdid` parameter in `/admin/student-history.php`. A victim admin user who loads a crafted URL or page would execute attacker-controlled script in their browser session, enabling session hijacking or DOM manipulation. A public proof-of-concept exploit has been disclosed on GitHub; EPSS remains very low at 0.03% (8th percentile), consistent with a niche product with limited real-world attack surface.
SQL injection in PHPGurukul Online Library Management System 3.0 allows authenticated attackers with low privileges to manipulate the stdid parameter in the /admin/student-history.php endpoint, potentially reading or modifying database records. A proof-of-concept exploit is publicly available, but the EPSS exploitation probability is very low (0.04%), indicating limited real-world threat despite a
A vulnerability was found in PHPGurukul Online Library Management System 3.0. Rated low severity (CVSS 2.3), this vulnerability is remotely exploitable. Public exploit code available and no vendor patch available.
An Arbitrary File Upload in the Upload Image component in SourceCodester Online Library Management System 1.0 allows the user to conduct remote code execution via admin/borrower/index.php?view=add. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.