Student File Management System
Monthly
Information disclosure vulnerability in Student File Management System 1.0 allows low-privileged authenticated users to access arbitrary files via the store_id parameter in /download.php. A public proof-of-concept exploit exists, but EPSS is 0.03% (very low exploitation probability) and no active exploitation has been reported. Exploitation requires authentication, limiting the attack surface.
SQL injection in Student File Management System 1.0 via the istore_id parameter in /download.php allows authenticated remote attackers to execute arbitrary SQL queries with limited information disclosure impact. The vulnerability requires valid user credentials (PR:L) and has a CVSS score of 2.1 with EPSS exploitation probability of 0.04%, indicating low real-world risk despite public exploit availability.
Unauthenticated file upload vulnerability in code-projects Student File Management System 1.0 allows authenticated remote attackers to bypass file upload restrictions via manipulation of the File parameter in /save_file.php, despite the CVSS v4.0 score of 2.1 reflecting only low confidentiality, integrity, and availability impact with no scope change. The exploit is publicly available and the low EPSS score (0.09%, 25th percentile) suggests limited real-world exploitation attempts despite public disclosure.
Cross-site scripting (XSS) in code-projects Student File Management System 1.0 allows high-privilege users to inject malicious scripts via the /admin/update_student.php endpoint, requiring user interaction to execute. The vulnerability has low real-world impact (CVSS 1.9, EPSS 0.06%) despite publicly available exploit code, as it demands high administrative privileges and user action; however, the low exploitation threshold (EPSS percentile 18%) indicates this is not a widespread threat.
Cross-site scripting vulnerability in code-projects Student File Management System 1.0 allows high-privilege authenticated users to inject malicious scripts via the Update User Page at /admin/update_user.php, requiring user interaction to trigger. The exploit is publicly available and rated CVSS 1.9 due to restrictive privilege and UI requirements, though EPSS score of 0.05% indicates minimal real-world exploitation risk.
SQL injection in Student File Management System 1.0 allows remote attackers to manipulate the stud_id parameter in /admin/delete_student.php, potentially leading to unauthorized database access or data manipulation. The vulnerability has a publicly available exploit and affects the code-projects application. No vendor patch is available at this time.
SQL injection in Student File Management System 1.0 allows remote attackers to manipulate database queries via the user_id parameter in /admin/delete_user.php. The vulnerability can lead to unauthorized access or modification of data, and publicly available exploit code exists, though no active exploitation has been confirmed.
SQL injection in Student File Management 1.0 via /admin/save_student.php enables remote, unauthenticated attackers to manipulate the database through the stud_no parameter. Publicly available exploit code exists, but the vulnerability is not listed in CISA KEV, and the low EPSS score (0.07%) indicates limited exploitation risk. The impact is limited to low confidentiality, integrity, and availability compromises.
SQL injection in Student File Management System 1.0 at /admin/update_student.php via the stud_id parameter allows remote attackers to read or modify database contents without authentication. Exploit code is publicly available, though no active exploitation has been confirmed.
SQL injection in Student File Management System 1.0 allows remote unauthenticated attackers to manipulate database queries via the firstname parameter in /admin/save_user.php. Exploit code is publicly available, but no reports of active exploitation exist at this time. The vulnerability has a CVSS 4.0 base score of 5.5 (low impact) and an EPSS score of 0.07%, indicating low exploitation probability.
SQL injection in Student File Management System 1.0 allows remote unauthenticated attackers to manipulate database queries via the user_id parameter in /admin/update_user.php. Public exploit code is available on GitHub, but the EPSS score (0.05%) indicates low exploitation probability and no active exploitation is confirmed (not in CISA KEV). The vulnerability is easy to exploit but yields only limited data confidentiality, integrity, and availability impacts.
SQL injection in Student File Management System 1.0 allows remote attackers to manipulate database queries via the Username parameter of /admin/login_query.php. The vulnerability, with publicly available exploit code, enables low-impact data extraction or modification without authentication. At the time of analysis, it is not listed in CISA's KEV, and EPSS indicates low exploitation probability.
SQL injection in code-projects Student File Management System 1.0 allows remote unauthenticated attackers to manipulate database queries via the stud_no parameter in login_query.php. A public exploit is available, but EPSS indicates a low probability of widespread exploitation (0.07%); the vulnerability is not listed in CISA KEV.
Information disclosure vulnerability in Student File Management System 1.0 allows low-privileged authenticated users to access arbitrary files via the store_id parameter in /download.php. A public proof-of-concept exploit exists, but EPSS is 0.03% (very low exploitation probability) and no active exploitation has been reported. Exploitation requires authentication, limiting the attack surface.
SQL injection in Student File Management System 1.0 via the istore_id parameter in /download.php allows authenticated remote attackers to execute arbitrary SQL queries with limited information disclosure impact. The vulnerability requires valid user credentials (PR:L) and has a CVSS score of 2.1 with EPSS exploitation probability of 0.04%, indicating low real-world risk despite public exploit availability.
Unauthenticated file upload vulnerability in code-projects Student File Management System 1.0 allows authenticated remote attackers to bypass file upload restrictions via manipulation of the File parameter in /save_file.php, despite the CVSS v4.0 score of 2.1 reflecting only low confidentiality, integrity, and availability impact with no scope change. The exploit is publicly available and the low EPSS score (0.09%, 25th percentile) suggests limited real-world exploitation attempts despite public disclosure.
Cross-site scripting (XSS) in code-projects Student File Management System 1.0 allows high-privilege users to inject malicious scripts via the /admin/update_student.php endpoint, requiring user interaction to execute. The vulnerability has low real-world impact (CVSS 1.9, EPSS 0.06%) despite publicly available exploit code, as it demands high administrative privileges and user action; however, the low exploitation threshold (EPSS percentile 18%) indicates this is not a widespread threat.
Cross-site scripting vulnerability in code-projects Student File Management System 1.0 allows high-privilege authenticated users to inject malicious scripts via the Update User Page at /admin/update_user.php, requiring user interaction to trigger. The exploit is publicly available and rated CVSS 1.9 due to restrictive privilege and UI requirements, though EPSS score of 0.05% indicates minimal real-world exploitation risk.
SQL injection in Student File Management System 1.0 allows remote attackers to manipulate the stud_id parameter in /admin/delete_student.php, potentially leading to unauthorized database access or data manipulation. The vulnerability has a publicly available exploit and affects the code-projects application. No vendor patch is available at this time.
SQL injection in Student File Management System 1.0 allows remote attackers to manipulate database queries via the user_id parameter in /admin/delete_user.php. The vulnerability can lead to unauthorized access or modification of data, and publicly available exploit code exists, though no active exploitation has been confirmed.
SQL injection in Student File Management 1.0 via /admin/save_student.php enables remote, unauthenticated attackers to manipulate the database through the stud_no parameter. Publicly available exploit code exists, but the vulnerability is not listed in CISA KEV, and the low EPSS score (0.07%) indicates limited exploitation risk. The impact is limited to low confidentiality, integrity, and availability compromises.
SQL injection in Student File Management System 1.0 at /admin/update_student.php via the stud_id parameter allows remote attackers to read or modify database contents without authentication. Exploit code is publicly available, though no active exploitation has been confirmed.
SQL injection in Student File Management System 1.0 allows remote unauthenticated attackers to manipulate database queries via the firstname parameter in /admin/save_user.php. Exploit code is publicly available, but no reports of active exploitation exist at this time. The vulnerability has a CVSS 4.0 base score of 5.5 (low impact) and an EPSS score of 0.07%, indicating low exploitation probability.
SQL injection in Student File Management System 1.0 allows remote unauthenticated attackers to manipulate database queries via the user_id parameter in /admin/update_user.php. Public exploit code is available on GitHub, but the EPSS score (0.05%) indicates low exploitation probability and no active exploitation is confirmed (not in CISA KEV). The vulnerability is easy to exploit but yields only limited data confidentiality, integrity, and availability impacts.
SQL injection in Student File Management System 1.0 allows remote attackers to manipulate database queries via the Username parameter of /admin/login_query.php. The vulnerability, with publicly available exploit code, enables low-impact data extraction or modification without authentication. At the time of analysis, it is not listed in CISA's KEV, and EPSS indicates low exploitation probability.
SQL injection in code-projects Student File Management System 1.0 allows remote unauthenticated attackers to manipulate database queries via the stud_no parameter in login_query.php. A public exploit is available, but EPSS indicates a low probability of widespread exploitation (0.07%); the vulnerability is not listed in CISA KEV.