Oranbyte
Monthly
Authentication bypass in ProjectsAndPrograms School Management System allows unauthenticated remote attackers to access protected functions without credentials. A publicly available exploit exists, but no evidence of active exploitation has been confirmed through CISA KEV. The vulnerability has a low EPSS score (0.17%), indicating a low probability of widespread automated exploitation.
Unrestricted file upload in Oranbyte School Management System allows remote attackers to upload arbitrary files, including PHP shells, to the server via the /assets/uploadSllyabus.php endpoint. The vulnerability requires no authentication and has a publicly available exploit, but the low EPSS score (0.06%) suggests limited active exploitation. Attackers can achieve code execution if the uploaded file is accessible and executable.
Unrestricted file upload in Oranbyte's School Management System (PHP) allows remote unauthenticated attackers to upload arbitrary files via the /assets/uploadNotes.php endpoint without authentication or file-type validation. Because the upload target is a web-accessible PHP directory, a successful upload of a PHP webshell grants the attacker arbitrary server-side code execution. A public proof-of-concept exploit is available on GitHub, and no patched version has been identified given the product's rolling release model.
Unrestricted file upload in OranByte School Management System allows remote attackers to upload arbitrary files via the /assets/changeSllyabus.php endpoint without authentication. Successful exploitation can lead to code execution and full server compromise. Exploit code is publicly available, though no active exploitation is confirmed.
Unrestricted file upload in Oranbyte School Management System allows remote unauthenticated attackers to upload arbitrary files via /assets/createNotice.php, potentially leading to remote code execution. Public exploit code exists; no patch version identified as the product uses a rolling release model, and exploitation probability (EPSS 0.06%) is low despite public exploit availability.
Unrestricted file upload in ProjectsAndPrograms School Management System allows remote attackers to upload arbitrary files via the /assets/editNotes.php endpoint. An attacker can send a specially crafted request to execute malicious code on the server. A publicly available proof-of-concept exists, but no active exploitation has been confirmed.
A flaw has been found in ProjectsAndPrograms School Management System 1.0. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
A Reflected Cross-site Scripting (XSS) vulnerability exists in the themeSet.php file of ProjectsAndPrograms School Management System 1.0. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
Authentication bypass in ProjectsAndPrograms School Management System allows unauthenticated remote attackers to access protected functions without credentials. A publicly available exploit exists, but no evidence of active exploitation has been confirmed through CISA KEV. The vulnerability has a low EPSS score (0.17%), indicating a low probability of widespread automated exploitation.
Unrestricted file upload in Oranbyte School Management System allows remote attackers to upload arbitrary files, including PHP shells, to the server via the /assets/uploadSllyabus.php endpoint. The vulnerability requires no authentication and has a publicly available exploit, but the low EPSS score (0.06%) suggests limited active exploitation. Attackers can achieve code execution if the uploaded file is accessible and executable.
Unrestricted file upload in Oranbyte's School Management System (PHP) allows remote unauthenticated attackers to upload arbitrary files via the /assets/uploadNotes.php endpoint without authentication or file-type validation. Because the upload target is a web-accessible PHP directory, a successful upload of a PHP webshell grants the attacker arbitrary server-side code execution. A public proof-of-concept exploit is available on GitHub, and no patched version has been identified given the product's rolling release model.
Unrestricted file upload in OranByte School Management System allows remote attackers to upload arbitrary files via the /assets/changeSllyabus.php endpoint without authentication. Successful exploitation can lead to code execution and full server compromise. Exploit code is publicly available, though no active exploitation is confirmed.
Unrestricted file upload in Oranbyte School Management System allows remote unauthenticated attackers to upload arbitrary files via /assets/createNotice.php, potentially leading to remote code execution. Public exploit code exists; no patch version identified as the product uses a rolling release model, and exploitation probability (EPSS 0.06%) is low despite public exploit availability.
Unrestricted file upload in ProjectsAndPrograms School Management System allows remote attackers to upload arbitrary files via the /assets/editNotes.php endpoint. An attacker can send a specially crafted request to execute malicious code on the server. A publicly available proof-of-concept exists, but no active exploitation has been confirmed.
A flaw has been found in ProjectsAndPrograms School Management System 1.0. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
A Reflected Cross-site Scripting (XSS) vulnerability exists in the themeSet.php file of ProjectsAndPrograms School Management System 1.0. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.