School Management System
Monthly
SQL injection in itsourcecode School Management System 1.0 allows unauthenticated remote attackers to manipulate the email parameter in User_Login.php, injecting arbitrary SQL into backend database queries at the pre-authentication login endpoint. With a public exploit available on GitHub, exploitation requires minimal skill and no credentials. The CVSS 4.0 vector confirms network-accessible, no-privilege exploitation with partial confidentiality, integrity, and availability impact against the underlying database.
SQL injection in ProjectsAndPrograms School Management System allows remote unauthenticated attackers to compromise database confidentiality, integrity, and availability via the bus_id parameter in buslocation.php. The vulnerability affects all versions up to commit 6b6fae5, with publicly available exploit code (EPSS not provided). Vendor was notified but did not respond, leaving the product vulnerable at time of analysis. The rolling release model means no fixed version number exists.
SQL injection in itsourcecode School Management System 1.0 via the ID parameter in /settings/index.php allows unauthenticated remote attackers to manipulate database queries and potentially read or modify sensitive data. Public exploit code exists for this vulnerability, and no patch is currently available. Organizations running affected versions should implement access controls or upgrade immediately to mitigate the risk.
SQL injection in itsourcecode School Management System 1.0 via the ID parameter in /ramonsys/user/controller.php allows unauthenticated remote attackers to execute arbitrary SQL queries and potentially access or modify sensitive data. Public exploit code exists for this vulnerability, increasing the risk of active exploitation. No patch is currently available, requiring organizations to implement alternative mitigations or restrict access to vulnerable systems.
SQL injection in itsourcecode School Management System 1.0 allows unauthenticated remote attackers to manipulate the 'ay' parameter in /ramonsys/report/index.php, potentially enabling data exfiltration, modification, or service disruption. Public exploit code exists for this vulnerability and no patch is currently available, creating immediate risk for deployed instances.
School Management System versions up to 1.0 contains a vulnerability that allows attackers to sql injection (CVSS 7.3).
SQL injection in itsourcecode School Management System 1.0 via the ID parameter in /ramonsys/settings/controller.php allows unauthenticated remote attackers to manipulate database queries. Public exploit code exists for this vulnerability, and no patch is currently available. Successful exploitation enables data exfiltration, modification, and potential service disruption.
SQL injection in itsourcecode Student Management System 1.0 allows unauthenticated remote attackers to manipulate the ID parameter in /ramonsys/billing/index.php and execute arbitrary SQL queries. Public exploit code exists for this vulnerability, and no patch is currently available. Successful exploitation could enable data exfiltration, modification, or deletion depending on database permissions.
SQL injection in itsourcecode Student Management System 1.0 via the ID parameter in /ramonsys/soa/index.php allows unauthenticated remote attackers to manipulate database queries with public exploit code available. The vulnerability enables attackers to read, modify, or delete sensitive educational data without authentication or user interaction. No patch is currently available, leaving affected installations at risk of data compromise.
SQL injection in itsourcecode Student Management System 1.0 allows unauthenticated remote attackers to manipulate the ID parameter in /ramonsys/facultyloading/index.php, potentially enabling unauthorized database access and modification. Public exploit code exists for this vulnerability, and no patch is currently available, leaving affected installations at active risk.
SQL injection in itsourcecode Student Management System 1.0 allows unauthenticated remote attackers to manipulate the ID parameter in /ramonsys/enrollment/controller.php, enabling unauthorized database access and potential data modification. Public exploit code exists for this vulnerability, and no patch is currently available, creating significant risk for affected school institutions.
SQL injection in itsourcecode School Management System 1.0 via the ID parameter in /enrollment/index.php enables unauthenticated remote attackers to manipulate database queries and extract or modify sensitive data. Public exploit code exists for this vulnerability, and no patch is currently available. The attack requires no user interaction and can be executed over the network against affected installations.
SQL injection in itsourcecode School Management System 1.0 via the ID parameter in /ramonsys/faculty/index.php enables unauthenticated remote attackers to read, modify, or delete database contents. Public exploit code exists for this vulnerability, and no patch is currently available.
SQL injection in itsourcecode School Management System 1.0 via the txtsearch parameter in /ramonsys/inquiry/index.php enables unauthenticated remote attackers to execute arbitrary SQL queries with limited impact on confidentiality, integrity, and availability. Public exploit code exists for this vulnerability, and no patch is currently available.
School Management System versions up to 1.0 contains a vulnerability that allows attackers to sql injection (CVSS 6.3).
School Management System versions up to 1.0 contains a vulnerability that allows attackers to sql injection (CVSS 7.3).
SQL injection in itsourcecode School Management System 1.0 via the ID parameter in /subject/index.php allows unauthenticated remote attackers to query, modify, or delete database contents. Public exploit code exists for this vulnerability, and no patch is currently available. The attack requires no user interaction and can be executed over the network against vulnerable instances.
SQL injection in itsourcecode School Management System 1.0 via the ID parameter in /student/index.php enables unauthenticated remote attackers to query or manipulate the database. Public exploit code exists for this vulnerability, and no patch is currently available, leaving all installations at risk.
kashipara School Management System 1.0 is vulnerable to Cross Site Scripting (XSS) via /client_user/feedback.php. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
kashipara School Management System 1.0 is vulnerable to Cross Site Scripting (XSS) via the formuser and formpassword parameters in /adminLogin.php. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
Authentication bypass in ProjectsAndPrograms School Management System allows unauthenticated remote attackers to access protected functions without credentials. A publicly available exploit exists, but no evidence of active exploitation has been confirmed through CISA KEV. The vulnerability has a low EPSS score (0.17%), indicating a low probability of widespread automated exploitation.
Unrestricted file upload in Oranbyte School Management System allows remote attackers to upload arbitrary files, including PHP shells, to the server via the /assets/uploadSllyabus.php endpoint. The vulnerability requires no authentication and has a publicly available exploit, but the low EPSS score (0.06%) suggests limited active exploitation. Attackers can achieve code execution if the uploaded file is accessible and executable.
We need to produce a JSON object with the specified fields. Let's analyze the provided data: CVE: CVE-2025-11659 Description: "A flaw has been found in ProjectsAndPrograms School Management System up to 6b6fae5426044f89c08d0dd101c7fa71f9042a59. Affected by this vulnerability is an unknown functionality of the file /assets/uploadNotes.php. This manipulation of the argument File causes unrestricted upload. Remote exploitation of the attack is possible. The exploit has been published and may be used. This product follows a rolling release approach for continuous delivery, so version details for affected or updated releases are not provided." CVSS Score: 5.5, Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X CWE: CWE-284 (Improper Access Control) EPSS: 0.06% (percentile 19%) POC: Publicly available (exploit published) KEV? Not mentioned in input, so assume NO. Tags: PHP, Authentication Bypass, File Upload, School Management System CPE: cpe:2.3:a:oranbyte:school_management_system:1.0:*:*:*:*:*:*:* (vendor: oranbyte? Actually "ProjectsAndPrograms" might be the project name? The CPE says vendor "oranbyte", product "school_management_system", version 1.0. However, description says "ProjectsAndPrograms School Management System". Possibly the product is by ProjectsAndPrograms? The CPE suggests Oranbyte as vendor. I'll use the product name as "School Management System" and vendor as Oranbyte/ProjectsAndPrograms perhaps. For product_name field: 1-3 words ONLY. "School Management System" fits. Could also be "ProjectsAndPrograms SMS"? Best to stick with "School Management System". The description mentions "ProjectsAndPrograms School Management System", so the primary product is that system. I'll use "School Management System" as product_name, or maybe "ProjectsAndPrograms SMS"? Actually the field requires specific product; "School Management System" is generic but the name includes "ProjectsAndPrograms". I'll do "ProjectsAndPrograms School Management System" is 4 words, but I can shorten to "School Management System"? The instruction says 1-3 words. I'll use "School Management System" - it's clear and includes the product type. For prevalence: School management systems are somewhat niche but deployed in educational institutions. It might be low or medium. Given it's a specific web app, not ubiquitous. Probably "low" prevalence. Prevalence basis: "niche school management software, limited footprint". Not many large-scale deployments. Now, we need to synthesize. There is no CVSS 3.1 vector provided; only CVSS 4.0 vector. We must provide our own assessed CVSS 3.1 base vector and CVSS 4.0 base vector. The description: unrestricted file upload via /assets/uploadNotes.php, manipulation of argument File, remote exploitation possible. The provided CVSS 4.0 vector: AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N. This means no authentication (PR:N), no user interaction (UI:N), low impact to confidentiality, integrity, availability. But unrestricted file upload typically can lead to remote code execution if the uploaded file can be executed, but here the vector indicates only low impacts. Possibly the file upload is to a directory that does not execute scripts, or impact might be denial/storage exhaustion? The CWE is CWE-284 (Improper Access Control) not CWE-434 (Unrestricted Upload of File with Dangerous Type) — interesting. So maybe the file upload is allowed without proper access control, but could be abused to upload arbitrary files, but execution might not be possible. The exploit has been published, so we have POC. We'll note that. Our assessed CVSS 3.1: Assuming the same as 4.0 mapping: AV:N, AC:L, PR:N, UI:N, S:U (no scope change from 4.0), C:L, I:L, A:L. So CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L. Base score: 7.3 (High). But the given CVSS 4.0 had base score 5.5 (Medium). In 3.1, such a vector (C:L/I:L/A:L) scores 7.3. There's a discrepancy because 4.0 scores lower for same impacts. I'll assess as per my understanding of the vulnerability. Unrestricted file upload typically could lead to RCE if the file is executable, but the CVSS 4.0 only gives low impact for C/I/A, so maybe the upload destination does not allow execution, and the only impact is storage consumption or phishing? The exploit might allow uploading arbitrary files, but reading them might not provide sensitive data if they can't be accessed. It says "unrestricted upload" but not "arbitrary file upload leading to code execution". So low impacts plausible. I'll assess CVSS 3.1 as AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L, but I need to justify. In CVSS 3.1, low confidentiality could be that uploaded files may be readable by attacker if they know the path (but file names might be predictable). Low integrity because attacker can upload files (overwrite maybe). Low availability because disk space can be filled. So that's plausible. So I'll set that. Now, exploitation conditions: "Remote exploitation is possible" and "unknown functionality" but the file is /assets/uploadNotes.php. No authentication mentioned. The script uploads notes, maybe intended for authenticated users but lacks access control? CWE-284 suggests improper access control, so maybe the endpoint is unprotected, allowing anyone to upload. So condition: The file upload endpoint /assets/uploadNotes.php is accessible without authentication. Possibly it's a default exposed script. I'll state: "The /assets/uploadNotes.php endpoint in ProjectsAndPrograms School Management System does not enforce authentication or authorization checks, allowing any unauthenticated user to upload arbitrary files via the 'File' argument." That's specific. The description says "unknown functionality" but the endpoint is given. So I'll use that. Attack chain: Remote attacker sends crafted HTTP POST request to /assets/uploadNotes.php with a malicious file → File is uploaded to server without validation → Attacker may access uploaded file for unauthorized actions or cause denial of service. No execution step, given low impact. So: "Access vulnerable endpoint" → "Craft malicious file payload" → "Upload file via HTTP POST" → "Gain unauthorized access to server resources or disrupt service". I'll make it a 4-step: "Access /assets/uploadNotes.php without authentication" → "Deliver crafted file via 'File' parameter" → "Exploit unrestricted upload to store file on server" → "Execute optional follow-on actions like unauthorized data access or disk exhaustion". That's realistic. Remediation: The product uses rolling release, no version numbers provided. So we can't say upgrade to a specific version. Input data says patch available? The patch field in input not explicitly given, but the description says "This product follows a rolling release approach for continuous delivery, so version details for affected or updated releases are not provided." So maybe there is an update but unspecified. From references, the GitHub issue (#4) might contain a fix? Possibly a commit hash? The commit 6b6fae5426044f89c08d0dd101c7fa71f9042a59 is the "up to" point. There might be a later commit that fixes it, but not specified. I'll note that vendor has not published a specific patched version, but an update may be available via the rolling release. Suggest removing or restricting access to uploadNotes.php, implementing access controls, file type validation. So: "No specific patched version is available due to the product's rolling release model. Implement access controls on /assets/uploadNotes.php to require authentication, validate file types, and sanitize file names. Consider removing the endpoint if not needed. Monitor vendor updates." That's actionable. Confidence notes: Confirmed by NVD, CVE from VulDB, POC publicly available. No KEV. EPSS very low (0.06%). No vendor advisory with specific fix. The exact fix commit unknown. So I'll note: "Exploit publicly available, confirmed by NVD and VulDB. No vendor patch version specified; product uses rolling release, making versioning ambiguous. CISA KEV not listed, and EPSS indicates low exploitation probability in the wild." That's specific. Now, construct the summary: "Remote file upload in ProjectsAndPrograms School Management System through /assets/uploadNotes.php allows unauthenticated attackers to upload arbitrary files to the server, leading to potential data exposure or denial of service. Public exploit code exists, but no active exploitation reported; low EPSS score suggests limited real-world impact." Technical context: "The vulnerability resides in the PHP-based School Management System, specifically in the uploadNotes.php script that handles file uploads via the 'File' parameter. CWE-284 (Improper Access Control) indicates a missing authorization check, allowing anyone to access the endpoint without authentication. The affected product is identified by CPE cpe:2.3:a:oranbyte:school_management_system:1.0, but the rolling release model means version numbers are not consistently applied." Educational. Risk assessment: "CVSS 4.0 rates this as 5.5 Medium, with network attack vector, low impact to confidentiality, integrity, and availability. EPSS probability of exploitation is very low (0.06%), suggesting it is not targeted in the wild. No KEV listing indicates CISA does not consider it actively exploited. POC is public but exploitation requires the upload endpoint to be reachable; impact limited to file upload, not code execution, reducing real-world risk. This is a moderate-risk vulnerability that may be prioritized lower than critical RCE flaws." That compares and contrasts. Exploit scenario: "An attacker sends an HTTP POST request to /assets/uploadNotes.php with a malicious file, such as a PHP webshell, if the server configuration permits execution of uploaded scripts; otherwise, the attacker may upload large files to exhaust disk space, causing denial of service." Realistic. Exploitation conditions (specific): "The /assets/uploadNotes.php endpoint must be accessible via the web (typically at the application's base URL). No authentication is required. The attacker needs network access to the target server. The impact is limited by the server's configuration: if uploaded files cannot be executed (e.g., stored outside web root or restricted by .htaccess), confidentiality and integrity impacts are low, mainly denial of service by storage exhaustion." Prevalence: "low" because it's a niche school management system, not widely deployed. Prevalence basis: "niche educational software, limited deployment footprint". Good. Assessed CVSS 3.1 vector: "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L" and rationale: "No authentication or user interaction required; impact limited to low due to file upload without execution capability." For CVSS 4.0, I'll keep the same as provided, but with my own? The instruction says: "The SAME assessment expressed as a CVSS 4.0 base vector, consistent with your 3.1 choice." So I need to map my assessed 3.1 to 4.0. My 3.1: AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L. In CVSS 4.0 that maps to AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N. That's exactly the provided vector, so I'll output that. Provided CVSS 4.0 has no scope change and low impacts, so consistent. So assessed_cvss40_vector = "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N". Rationale for 4.0: "Same as provided vector: network accessible, no privileges, low impacts on vulnerable system, no subsequent system impact." I'll use that. Now combine all. Ensure no arrays, everything string. Product name: "School Management System" (capitalized). CPE says oranbyte:
Unrestricted file upload in OranByte School Management System allows remote attackers to upload arbitrary files via the /assets/changeSllyabus.php endpoint without authentication. Successful exploitation can lead to code execution and full server compromise. Exploit code is publicly available, though no active exploitation is confirmed.
Unrestricted file upload in Oranbyte School Management System allows remote unauthenticated attackers to upload arbitrary files via /assets/createNotice.php, potentially leading to remote code execution. Public exploit code exists; no patch version identified as the product uses a rolling release model, and exploitation probability (EPSS 0.06%) is low despite public exploit availability.
Unrestricted file upload in ProjectsAndPrograms School Management System allows remote attackers to upload arbitrary files via the /assets/editNotes.php endpoint. An attacker can send a specially crafted request to execute malicious code on the server. A publicly available proof-of-concept exists, but no active exploitation has been confirmed.
A flaw has been found in ProjectsAndPrograms School Management System 1.0. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
A Reflected Cross-site Scripting (XSS) vulnerability exists in the themeSet.php file of ProjectsAndPrograms School Management System 1.0. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
The School Management System for Wordpress plugin for WordPress is vulnerable to privilege escalation via account takeover in all versions up to, and including, 93.0.0. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
The School Management System for Wordpress plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'title' parameter in all versions up to, and including, 93.0.0 due to. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
The School Management System for Wordpress plugin for WordPress is vulnerable to unauthorized loss of data due to a missing capability check on the 'mj_smgt_remove_feetype' and. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
The School Management System for Wordpress plugin for WordPress is vulnerable to SQL Injection via the 'view-attendance' page in all versions up to, and including, 92.0.0 due to insufficient escaping. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
The School Management System for Wordpress plugin for WordPress is vulnerable to SQL Injection via the 'id' parameter of the 'mj_smgt_show_event_task' AJAX action in all versions up to, and. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
The School Management System for Wordpress plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the mj_smgt_load_documets_new() and. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
The School Management System for Wordpress plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the mj_smgt_user_avatar_image_upload() function in all. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
School Management System commit bae5aa was discovered to contain a SQL injection vulnerability via the medium parameter at substaff.php. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
School Management System commit bae5aa was discovered to contain a SQL injection vulnerability via the medium parameter at attendance.php. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
School Management System commit bae5aa was discovered to contain a SQL injection vulnerability via the medium parameter at dtmarks.php. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
School Management System commit bae5aa was discovered to contain a SQL injection vulnerability via the medium parameter at unitmarks.php. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
School Management System commit bae5aa was discovered to contain a SQL injection vulnerability via the medium parameter at insertattendance.php. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
School Management System commit bae5aa was discovered to contain a SQL injection vulnerability via the medium parameter at admininsert.php. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
School Management System commit bae5aa was discovered to contain a SQL injection vulnerability via the medium parameter at paidclass.php. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
School Management System commit bae5aa was discovered to contain a SQL injection vulnerability via the transport parameter at vehicle.php. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
School Management System commit bae5aa was discovered to contain a SQL injection vulnerability via the sid parameter at /search.php?action=2. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
School Management System commit bae5aa was discovered to contain a SQL injection vulnerability via the password parameter at login.php. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
A vulnerability was found in lahirudanushka School Management System 1.0.0/1.0.1 and classified as critical. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
A vulnerability has been found in lahirudanushka School Management System 1.0.0/1.0.1 and classified as critical. Rated medium severity (CVSS 5.1), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
A vulnerability, which was classified as critical, was found in lahirudanushka School Management System 1.0.0/1.0.1. Rated medium severity (CVSS 5.1), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
A vulnerability, which was classified as critical, has been found in lahirudanushka School Management System 1.0.0/1.0.1.php of the component Teacher Page. Rated medium severity (CVSS 5.1), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
A vulnerability classified as critical was found in lahirudanushka School Management System 1.0.0/1.0.1. Rated medium severity (CVSS 5.1), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
A vulnerability classified as critical has been found in lahirudanushka School Management System 1.0.0/1.0.1. Rated medium severity (CVSS 5.1), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
A vulnerability, which was classified as critical, has been found in lahirudanushka School Management System 1.0.0/1.0.1. Rated medium severity (CVSS 6.9), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
SQL injection in School Management System 1.0 allows remote attackers to modify or delete data, causing persistent changes to the application's content or behavior by using malicious SQL queries. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
Mojoomla School Management System for WordPress allows SQL Injection via the id parameter. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
SQL injection in itsourcecode School Management System 1.0 allows unauthenticated remote attackers to manipulate the email parameter in User_Login.php, injecting arbitrary SQL into backend database queries at the pre-authentication login endpoint. With a public exploit available on GitHub, exploitation requires minimal skill and no credentials. The CVSS 4.0 vector confirms network-accessible, no-privilege exploitation with partial confidentiality, integrity, and availability impact against the underlying database.
SQL injection in ProjectsAndPrograms School Management System allows remote unauthenticated attackers to compromise database confidentiality, integrity, and availability via the bus_id parameter in buslocation.php. The vulnerability affects all versions up to commit 6b6fae5, with publicly available exploit code (EPSS not provided). Vendor was notified but did not respond, leaving the product vulnerable at time of analysis. The rolling release model means no fixed version number exists.
SQL injection in itsourcecode School Management System 1.0 via the ID parameter in /settings/index.php allows unauthenticated remote attackers to manipulate database queries and potentially read or modify sensitive data. Public exploit code exists for this vulnerability, and no patch is currently available. Organizations running affected versions should implement access controls or upgrade immediately to mitigate the risk.
SQL injection in itsourcecode School Management System 1.0 via the ID parameter in /ramonsys/user/controller.php allows unauthenticated remote attackers to execute arbitrary SQL queries and potentially access or modify sensitive data. Public exploit code exists for this vulnerability, increasing the risk of active exploitation. No patch is currently available, requiring organizations to implement alternative mitigations or restrict access to vulnerable systems.
SQL injection in itsourcecode School Management System 1.0 allows unauthenticated remote attackers to manipulate the 'ay' parameter in /ramonsys/report/index.php, potentially enabling data exfiltration, modification, or service disruption. Public exploit code exists for this vulnerability and no patch is currently available, creating immediate risk for deployed instances.
School Management System versions up to 1.0 contains a vulnerability that allows attackers to sql injection (CVSS 7.3).
SQL injection in itsourcecode School Management System 1.0 via the ID parameter in /ramonsys/settings/controller.php allows unauthenticated remote attackers to manipulate database queries. Public exploit code exists for this vulnerability, and no patch is currently available. Successful exploitation enables data exfiltration, modification, and potential service disruption.
SQL injection in itsourcecode Student Management System 1.0 allows unauthenticated remote attackers to manipulate the ID parameter in /ramonsys/billing/index.php and execute arbitrary SQL queries. Public exploit code exists for this vulnerability, and no patch is currently available. Successful exploitation could enable data exfiltration, modification, or deletion depending on database permissions.
SQL injection in itsourcecode Student Management System 1.0 via the ID parameter in /ramonsys/soa/index.php allows unauthenticated remote attackers to manipulate database queries with public exploit code available. The vulnerability enables attackers to read, modify, or delete sensitive educational data without authentication or user interaction. No patch is currently available, leaving affected installations at risk of data compromise.
SQL injection in itsourcecode Student Management System 1.0 allows unauthenticated remote attackers to manipulate the ID parameter in /ramonsys/facultyloading/index.php, potentially enabling unauthorized database access and modification. Public exploit code exists for this vulnerability, and no patch is currently available, leaving affected installations at active risk.
SQL injection in itsourcecode Student Management System 1.0 allows unauthenticated remote attackers to manipulate the ID parameter in /ramonsys/enrollment/controller.php, enabling unauthorized database access and potential data modification. Public exploit code exists for this vulnerability, and no patch is currently available, creating significant risk for affected school institutions.
SQL injection in itsourcecode School Management System 1.0 via the ID parameter in /enrollment/index.php enables unauthenticated remote attackers to manipulate database queries and extract or modify sensitive data. Public exploit code exists for this vulnerability, and no patch is currently available. The attack requires no user interaction and can be executed over the network against affected installations.
SQL injection in itsourcecode School Management System 1.0 via the ID parameter in /ramonsys/faculty/index.php enables unauthenticated remote attackers to read, modify, or delete database contents. Public exploit code exists for this vulnerability, and no patch is currently available.
SQL injection in itsourcecode School Management System 1.0 via the txtsearch parameter in /ramonsys/inquiry/index.php enables unauthenticated remote attackers to execute arbitrary SQL queries with limited impact on confidentiality, integrity, and availability. Public exploit code exists for this vulnerability, and no patch is currently available.
School Management System versions up to 1.0 contains a vulnerability that allows attackers to sql injection (CVSS 6.3).
School Management System versions up to 1.0 contains a vulnerability that allows attackers to sql injection (CVSS 7.3).
SQL injection in itsourcecode School Management System 1.0 via the ID parameter in /subject/index.php allows unauthenticated remote attackers to query, modify, or delete database contents. Public exploit code exists for this vulnerability, and no patch is currently available. The attack requires no user interaction and can be executed over the network against vulnerable instances.
SQL injection in itsourcecode School Management System 1.0 via the ID parameter in /student/index.php enables unauthenticated remote attackers to query or manipulate the database. Public exploit code exists for this vulnerability, and no patch is currently available, leaving all installations at risk.
kashipara School Management System 1.0 is vulnerable to Cross Site Scripting (XSS) via /client_user/feedback.php. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
kashipara School Management System 1.0 is vulnerable to Cross Site Scripting (XSS) via the formuser and formpassword parameters in /adminLogin.php. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
Authentication bypass in ProjectsAndPrograms School Management System allows unauthenticated remote attackers to access protected functions without credentials. A publicly available exploit exists, but no evidence of active exploitation has been confirmed through CISA KEV. The vulnerability has a low EPSS score (0.17%), indicating a low probability of widespread automated exploitation.
Unrestricted file upload in Oranbyte School Management System allows remote attackers to upload arbitrary files, including PHP shells, to the server via the /assets/uploadSllyabus.php endpoint. The vulnerability requires no authentication and has a publicly available exploit, but the low EPSS score (0.06%) suggests limited active exploitation. Attackers can achieve code execution if the uploaded file is accessible and executable.
We need to produce a JSON object with the specified fields. Let's analyze the provided data: CVE: CVE-2025-11659 Description: "A flaw has been found in ProjectsAndPrograms School Management System up to 6b6fae5426044f89c08d0dd101c7fa71f9042a59. Affected by this vulnerability is an unknown functionality of the file /assets/uploadNotes.php. This manipulation of the argument File causes unrestricted upload. Remote exploitation of the attack is possible. The exploit has been published and may be used. This product follows a rolling release approach for continuous delivery, so version details for affected or updated releases are not provided." CVSS Score: 5.5, Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X CWE: CWE-284 (Improper Access Control) EPSS: 0.06% (percentile 19%) POC: Publicly available (exploit published) KEV? Not mentioned in input, so assume NO. Tags: PHP, Authentication Bypass, File Upload, School Management System CPE: cpe:2.3:a:oranbyte:school_management_system:1.0:*:*:*:*:*:*:* (vendor: oranbyte? Actually "ProjectsAndPrograms" might be the project name? The CPE says vendor "oranbyte", product "school_management_system", version 1.0. However, description says "ProjectsAndPrograms School Management System". Possibly the product is by ProjectsAndPrograms? The CPE suggests Oranbyte as vendor. I'll use the product name as "School Management System" and vendor as Oranbyte/ProjectsAndPrograms perhaps. For product_name field: 1-3 words ONLY. "School Management System" fits. Could also be "ProjectsAndPrograms SMS"? Best to stick with "School Management System". The description mentions "ProjectsAndPrograms School Management System", so the primary product is that system. I'll use "School Management System" as product_name, or maybe "ProjectsAndPrograms SMS"? Actually the field requires specific product; "School Management System" is generic but the name includes "ProjectsAndPrograms". I'll do "ProjectsAndPrograms School Management System" is 4 words, but I can shorten to "School Management System"? The instruction says 1-3 words. I'll use "School Management System" - it's clear and includes the product type. For prevalence: School management systems are somewhat niche but deployed in educational institutions. It might be low or medium. Given it's a specific web app, not ubiquitous. Probably "low" prevalence. Prevalence basis: "niche school management software, limited footprint". Not many large-scale deployments. Now, we need to synthesize. There is no CVSS 3.1 vector provided; only CVSS 4.0 vector. We must provide our own assessed CVSS 3.1 base vector and CVSS 4.0 base vector. The description: unrestricted file upload via /assets/uploadNotes.php, manipulation of argument File, remote exploitation possible. The provided CVSS 4.0 vector: AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N. This means no authentication (PR:N), no user interaction (UI:N), low impact to confidentiality, integrity, availability. But unrestricted file upload typically can lead to remote code execution if the uploaded file can be executed, but here the vector indicates only low impacts. Possibly the file upload is to a directory that does not execute scripts, or impact might be denial/storage exhaustion? The CWE is CWE-284 (Improper Access Control) not CWE-434 (Unrestricted Upload of File with Dangerous Type) — interesting. So maybe the file upload is allowed without proper access control, but could be abused to upload arbitrary files, but execution might not be possible. The exploit has been published, so we have POC. We'll note that. Our assessed CVSS 3.1: Assuming the same as 4.0 mapping: AV:N, AC:L, PR:N, UI:N, S:U (no scope change from 4.0), C:L, I:L, A:L. So CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L. Base score: 7.3 (High). But the given CVSS 4.0 had base score 5.5 (Medium). In 3.1, such a vector (C:L/I:L/A:L) scores 7.3. There's a discrepancy because 4.0 scores lower for same impacts. I'll assess as per my understanding of the vulnerability. Unrestricted file upload typically could lead to RCE if the file is executable, but the CVSS 4.0 only gives low impact for C/I/A, so maybe the upload destination does not allow execution, and the only impact is storage consumption or phishing? The exploit might allow uploading arbitrary files, but reading them might not provide sensitive data if they can't be accessed. It says "unrestricted upload" but not "arbitrary file upload leading to code execution". So low impacts plausible. I'll assess CVSS 3.1 as AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L, but I need to justify. In CVSS 3.1, low confidentiality could be that uploaded files may be readable by attacker if they know the path (but file names might be predictable). Low integrity because attacker can upload files (overwrite maybe). Low availability because disk space can be filled. So that's plausible. So I'll set that. Now, exploitation conditions: "Remote exploitation is possible" and "unknown functionality" but the file is /assets/uploadNotes.php. No authentication mentioned. The script uploads notes, maybe intended for authenticated users but lacks access control? CWE-284 suggests improper access control, so maybe the endpoint is unprotected, allowing anyone to upload. So condition: The file upload endpoint /assets/uploadNotes.php is accessible without authentication. Possibly it's a default exposed script. I'll state: "The /assets/uploadNotes.php endpoint in ProjectsAndPrograms School Management System does not enforce authentication or authorization checks, allowing any unauthenticated user to upload arbitrary files via the 'File' argument." That's specific. The description says "unknown functionality" but the endpoint is given. So I'll use that. Attack chain: Remote attacker sends crafted HTTP POST request to /assets/uploadNotes.php with a malicious file → File is uploaded to server without validation → Attacker may access uploaded file for unauthorized actions or cause denial of service. No execution step, given low impact. So: "Access vulnerable endpoint" → "Craft malicious file payload" → "Upload file via HTTP POST" → "Gain unauthorized access to server resources or disrupt service". I'll make it a 4-step: "Access /assets/uploadNotes.php without authentication" → "Deliver crafted file via 'File' parameter" → "Exploit unrestricted upload to store file on server" → "Execute optional follow-on actions like unauthorized data access or disk exhaustion". That's realistic. Remediation: The product uses rolling release, no version numbers provided. So we can't say upgrade to a specific version. Input data says patch available? The patch field in input not explicitly given, but the description says "This product follows a rolling release approach for continuous delivery, so version details for affected or updated releases are not provided." So maybe there is an update but unspecified. From references, the GitHub issue (#4) might contain a fix? Possibly a commit hash? The commit 6b6fae5426044f89c08d0dd101c7fa71f9042a59 is the "up to" point. There might be a later commit that fixes it, but not specified. I'll note that vendor has not published a specific patched version, but an update may be available via the rolling release. Suggest removing or restricting access to uploadNotes.php, implementing access controls, file type validation. So: "No specific patched version is available due to the product's rolling release model. Implement access controls on /assets/uploadNotes.php to require authentication, validate file types, and sanitize file names. Consider removing the endpoint if not needed. Monitor vendor updates." That's actionable. Confidence notes: Confirmed by NVD, CVE from VulDB, POC publicly available. No KEV. EPSS very low (0.06%). No vendor advisory with specific fix. The exact fix commit unknown. So I'll note: "Exploit publicly available, confirmed by NVD and VulDB. No vendor patch version specified; product uses rolling release, making versioning ambiguous. CISA KEV not listed, and EPSS indicates low exploitation probability in the wild." That's specific. Now, construct the summary: "Remote file upload in ProjectsAndPrograms School Management System through /assets/uploadNotes.php allows unauthenticated attackers to upload arbitrary files to the server, leading to potential data exposure or denial of service. Public exploit code exists, but no active exploitation reported; low EPSS score suggests limited real-world impact." Technical context: "The vulnerability resides in the PHP-based School Management System, specifically in the uploadNotes.php script that handles file uploads via the 'File' parameter. CWE-284 (Improper Access Control) indicates a missing authorization check, allowing anyone to access the endpoint without authentication. The affected product is identified by CPE cpe:2.3:a:oranbyte:school_management_system:1.0, but the rolling release model means version numbers are not consistently applied." Educational. Risk assessment: "CVSS 4.0 rates this as 5.5 Medium, with network attack vector, low impact to confidentiality, integrity, and availability. EPSS probability of exploitation is very low (0.06%), suggesting it is not targeted in the wild. No KEV listing indicates CISA does not consider it actively exploited. POC is public but exploitation requires the upload endpoint to be reachable; impact limited to file upload, not code execution, reducing real-world risk. This is a moderate-risk vulnerability that may be prioritized lower than critical RCE flaws." That compares and contrasts. Exploit scenario: "An attacker sends an HTTP POST request to /assets/uploadNotes.php with a malicious file, such as a PHP webshell, if the server configuration permits execution of uploaded scripts; otherwise, the attacker may upload large files to exhaust disk space, causing denial of service." Realistic. Exploitation conditions (specific): "The /assets/uploadNotes.php endpoint must be accessible via the web (typically at the application's base URL). No authentication is required. The attacker needs network access to the target server. The impact is limited by the server's configuration: if uploaded files cannot be executed (e.g., stored outside web root or restricted by .htaccess), confidentiality and integrity impacts are low, mainly denial of service by storage exhaustion." Prevalence: "low" because it's a niche school management system, not widely deployed. Prevalence basis: "niche educational software, limited deployment footprint". Good. Assessed CVSS 3.1 vector: "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L" and rationale: "No authentication or user interaction required; impact limited to low due to file upload without execution capability." For CVSS 4.0, I'll keep the same as provided, but with my own? The instruction says: "The SAME assessment expressed as a CVSS 4.0 base vector, consistent with your 3.1 choice." So I need to map my assessed 3.1 to 4.0. My 3.1: AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L. In CVSS 4.0 that maps to AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N. That's exactly the provided vector, so I'll output that. Provided CVSS 4.0 has no scope change and low impacts, so consistent. So assessed_cvss40_vector = "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N". Rationale for 4.0: "Same as provided vector: network accessible, no privileges, low impacts on vulnerable system, no subsequent system impact." I'll use that. Now combine all. Ensure no arrays, everything string. Product name: "School Management System" (capitalized). CPE says oranbyte:
Unrestricted file upload in OranByte School Management System allows remote attackers to upload arbitrary files via the /assets/changeSllyabus.php endpoint without authentication. Successful exploitation can lead to code execution and full server compromise. Exploit code is publicly available, though no active exploitation is confirmed.
Unrestricted file upload in Oranbyte School Management System allows remote unauthenticated attackers to upload arbitrary files via /assets/createNotice.php, potentially leading to remote code execution. Public exploit code exists; no patch version identified as the product uses a rolling release model, and exploitation probability (EPSS 0.06%) is low despite public exploit availability.
Unrestricted file upload in ProjectsAndPrograms School Management System allows remote attackers to upload arbitrary files via the /assets/editNotes.php endpoint. An attacker can send a specially crafted request to execute malicious code on the server. A publicly available proof-of-concept exists, but no active exploitation has been confirmed.
A flaw has been found in ProjectsAndPrograms School Management System 1.0. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
A Reflected Cross-site Scripting (XSS) vulnerability exists in the themeSet.php file of ProjectsAndPrograms School Management System 1.0. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
The School Management System for Wordpress plugin for WordPress is vulnerable to privilege escalation via account takeover in all versions up to, and including, 93.0.0. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
The School Management System for Wordpress plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'title' parameter in all versions up to, and including, 93.0.0 due to. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
The School Management System for Wordpress plugin for WordPress is vulnerable to unauthorized loss of data due to a missing capability check on the 'mj_smgt_remove_feetype' and. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
The School Management System for Wordpress plugin for WordPress is vulnerable to SQL Injection via the 'view-attendance' page in all versions up to, and including, 92.0.0 due to insufficient escaping. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
The School Management System for Wordpress plugin for WordPress is vulnerable to SQL Injection via the 'id' parameter of the 'mj_smgt_show_event_task' AJAX action in all versions up to, and. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
The School Management System for Wordpress plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the mj_smgt_load_documets_new() and. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
The School Management System for Wordpress plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the mj_smgt_user_avatar_image_upload() function in all. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
School Management System commit bae5aa was discovered to contain a SQL injection vulnerability via the medium parameter at substaff.php. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
School Management System commit bae5aa was discovered to contain a SQL injection vulnerability via the medium parameter at attendance.php. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
School Management System commit bae5aa was discovered to contain a SQL injection vulnerability via the medium parameter at dtmarks.php. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
School Management System commit bae5aa was discovered to contain a SQL injection vulnerability via the medium parameter at unitmarks.php. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
School Management System commit bae5aa was discovered to contain a SQL injection vulnerability via the medium parameter at insertattendance.php. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
School Management System commit bae5aa was discovered to contain a SQL injection vulnerability via the medium parameter at admininsert.php. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
School Management System commit bae5aa was discovered to contain a SQL injection vulnerability via the medium parameter at paidclass.php. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
School Management System commit bae5aa was discovered to contain a SQL injection vulnerability via the transport parameter at vehicle.php. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
School Management System commit bae5aa was discovered to contain a SQL injection vulnerability via the sid parameter at /search.php?action=2. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
School Management System commit bae5aa was discovered to contain a SQL injection vulnerability via the password parameter at login.php. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
A vulnerability was found in lahirudanushka School Management System 1.0.0/1.0.1 and classified as critical. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
A vulnerability has been found in lahirudanushka School Management System 1.0.0/1.0.1 and classified as critical. Rated medium severity (CVSS 5.1), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
A vulnerability, which was classified as critical, was found in lahirudanushka School Management System 1.0.0/1.0.1. Rated medium severity (CVSS 5.1), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
A vulnerability, which was classified as critical, has been found in lahirudanushka School Management System 1.0.0/1.0.1.php of the component Teacher Page. Rated medium severity (CVSS 5.1), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
A vulnerability classified as critical was found in lahirudanushka School Management System 1.0.0/1.0.1. Rated medium severity (CVSS 5.1), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
A vulnerability classified as critical has been found in lahirudanushka School Management System 1.0.0/1.0.1. Rated medium severity (CVSS 5.1), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
A vulnerability, which was classified as critical, has been found in lahirudanushka School Management System 1.0.0/1.0.1. Rated medium severity (CVSS 6.9), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
SQL injection in School Management System 1.0 allows remote attackers to modify or delete data, causing persistent changes to the application's content or behavior by using malicious SQL queries. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
Mojoomla School Management System for WordPress allows SQL Injection via the id parameter. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.