Student Management System
Monthly
Reflected cross-site scripting in ningzichun student-management-system allows unauthenticated remote attackers to inject arbitrary script into the admin/fun/addLog.php log entry function via the reason or detail parameters; exploitation requires a victim to interact with a crafted link, and publicly available exploit code exists. The flaw is rated CVSS 4.0 5.3 (Medium) with no privileges required but user interaction, and independent assessment confirms it is limited to integrity impact with no direct confidentiality or availability loss. The project maintainer has not responded to the reported issue, and no vendor patch is identified at time of analysis.
Default-credential exposure in ningzichun's student-management-system allows remote attackers to authenticate with the administrator password shipped in the example_lite.sql seed file, obtaining full access to the application's administrative functionality and stored data. The flaw affects all versions up to commit 98760f5711cf6dc8b4adca53a9e207ca49b02ebf, and publicly available exploit code exists, though no CISA KEV listing or other confirmation of active exploitation is present. Exploitation is entirely gated on the operator having initialized the database from example_lite.sql and never rotated the seeded account password; given that this is an obscure, rarely deployed hobby project, overall real-world risk is low despite the moderate 5.1 CVSS 4.0 score.
Cross-site request forgery in ningzichun's student-management-system (up to commit 98760f5711cf6dc8b4adca53a9e207ca49b02ebf) lets an unauthenticated attacker forge state-changing requests that execute in the browser of a logged-in administrator or user, producing a limited integrity-only modification. Exploitation requires the victim to hold an active session and be socially engineered into visiting an attacker-controlled page or clicking a crafted link (UI:P/UI:R); confidentiality and availability are unaffected. Publicly available exploit code exists and the CVE carries an EPSS-relevant proof-of-concept flag, though there is no confirmed active exploitation (CISA KEV), and the upstream project was notified via an issue report but has not responded and has released no fix.
Authorization bypass in ningzichun's student-management-system (all versions up to commit 98760f5711cf6dc8b4adca53a9e207ca49b02ebf) allows a remote attacker to tamper with log records by manipulating the sid, addtime, type, reason, detail and logdate arguments passed to user/editLog.php, circumventing the intended ownership/authorization check on those records. Publicly available exploit code exists and the flaw was disclosed through a public GitHub issue report that the maintainer has not responded to, so exposed deployments should be considered at risk. The impact is integrity-only log tampering with no confidentiality or availability loss, and because the affected code is a rare, unmaintained hobby project with no patched release, the realistic risk is low despite a moderate 6.9 CVSS 4.0 base score; authentication requirements are not firmly confirmed from available data, as VulDB rates the vector PR:N while independent analysis assesses PR:L.
Authorization bypass in ningzichun student-management-system (versions up to commit 98760f5711cf6dc8b4adca53a9e207ca49b02ebf) allows remote attackers to read other students' records by manipulating the 'sid' parameter of admin/fun/getStudent.php. Publicly available exploit code exists, and the maintainer has not responded to the report, so no vendor-released patch is identified. The assessed CVSS 3.1 vector is AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N, limiting impact to confidentiality of individual records, but the PR:N rating assumes the admin/ path is reachable without upstream authentication.
Cleartext password storage in sambitraj's Student Management System exposes user credentials to privileged attackers who can access the database or application backend. The flaw resides in aca.sql within the Password Handler component, where passwords are persisted without hashing or encryption. A proof-of-concept has been publicly disclosed via a GitHub issue, though exploitation requires high-privilege access, keeping real-world risk low despite the sensitive nature of the exposed data.
Default credentials hardcoded in the aca.sql database initialization file of sambitraj's Student-Management-System expose unauthenticated remote attackers to authentication bypass using publicly known passwords across all commits through 56ba287f. The project's GitHub issue tracker hosts a public proof-of-concept, and the maintainer has not responded to the disclosure, leaving no remediated release available. The limited deployment footprint (a niche student-facing open-source project) constrains aggregate real-world impact despite the trivial exploitability of default credentials.
Session cookie exposure in sambitraj's Student-Management-System allows attackers to steal session tokens via client-side JavaScript due to the absence of the HttpOnly flag in the `session_start` function. All commits up to 56ba287f2e9031523ccb4244cb6e3fe530e4e5d5 are affected, and no vendor patch exists as the maintainer has not responded to the responsible disclosure. A publicly available proof-of-concept exists, though exploitation requires high attack complexity and a co-present XSS vector to materialize as a session hijack.
Improper authorization in sambitraj Student Management System allows authenticated low-privileged users (students) to access or tamper with other students' records by manipulating the `roll_no` parameter in `student_dashboard.php`. Confirmed by CPE `cpe:2.3:a:sambitraj:student_management_system:*:*:*:*:*:*:*:*`, all commits up to `56ba287f2e9031523ccb4244cb6e3fe530e4e5d5` are affected. A public proof-of-concept is available via a GitHub issue; the project has not responded to disclosure, leaving the flaw unpatched with no KEV listing.
SQL injection in sambitraj's Student-Management-System exposes multiple user-supplied parameters in the Management Mutation Handler to database query manipulation by authenticated remote attackers. The application uses a rolling release model with no versioned releases; all commits up to 56ba287f2e9031523ccb4244cb6e3fe530e4e5d5 are affected and no patch has been issued despite responsible disclosure via GitHub issue. Publicly available exploit code exists (E:P per CVSS 4.0 supplemental), though no active exploitation has been confirmed and the CVSS 4.0 score of 2.1 reflects limited rated impact under low-privilege conditions.
SQL injection in the Dashboard component of sambitraj's Student-Management-System exposes the application to remote database manipulation via the roll_no and teacher_name parameters, affecting all commits through 56ba287f2e9031523ccb4244cb6e3fe530e4e5d5. A low-privileged authenticated attacker can inject arbitrary SQL to read or modify student records without any patch or vendor response currently available. A public exploit exists via GitHub issue disclosure, though real-world impact is constrained by the project's extremely narrow deployment footprint.
Unrestricted file upload in imranrisal-dev's Student-Management-System (PHP) permits authenticated remote attackers to upload arbitrary file types through the storeProfileImage function in student_profile_pic.php by manipulating the choose_file argument. In a PHP application where uploaded files are served under the web root, this class of flaw (CWE-434) directly enables webshell deployment and full server-side remote code execution. A proof-of-concept exploit has been publicly disclosed on GitHub; the vendor did not respond to responsible disclosure, and no patch exists given the project's rolling-release model with no versioned releases.
Cross-site scripting in imvks786/student_management_system allows a low-privileged remote attacker to inject malicious scripts via the name, address, or fname parameters in /add.php. The payload executes in a victim's browser when the affected page is viewed, enabling session hijacking, credential theft, or UI redress attacks against other users of the application. A public exploit is available via a GitHub issue report; the vendor has not responded to the coordinated disclosure.
Improper authorization in the imvks786 student_management_system PHP application allows authenticated low-privileged remote attackers to delete student records they are not authorized to remove via manipulation of the `del` parameter at the /see.php Student Deletion Endpoint. The vulnerability (CWE-285) stems from the application failing to verify that the requesting user holds sufficient privileges to perform the deletion action, effectively enabling horizontal or vertical privilege escalation within the data management scope. No public exploit identified at time of analysis via CISA KEV, though publicly available exploit code exists per the referenced GitHub issue disclosure.
Improper access control in imvks786's Student Management System PHP application exposes the /add.php Student Record Handler endpoint to unauthorized manipulation by authenticated remote attackers. The vulnerability, classified under CWE-284, allows a low-privileged user to perform actions beyond their intended authorization scope - consistent with the 'Authentication Bypass' tag suggesting role-boundary violations rather than full pre-auth access. Public exploit code exists per the GitHub issue report, though the CVSS 4.0 score of 2.1 reflects limited impact scope (low confidentiality, integrity, and availability impact, no downstream system effect). The vendor has not responded to the coordinated disclosure.
SQL injection at the Administrator Login Endpoint of imvks786's student_management_system (PHP) allows unauthenticated remote attackers to manipulate the a_usr and a_pwd parameters in admin/admin_login.php to inject arbitrary SQL. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) confirms zero-barrier remote exploitation with no privileges or user interaction required. A public proof-of-concept exploit has been released via GitHub issue tracker; the project maintainer has not responded to disclosure, and no patch is available at time of analysis.
SQL injection in imvks786 Student Management System (rolling release up to commit 9599b560) allows remote unauthenticated attackers to manipulate the usr and pwd parameters of /index.ph in the Login component to inject arbitrary SQL. Publicly available exploit code exists per VulDB, though the project is on a rolling release with no tagged fix and the maintainer has not responded to the issue report. No CISA KEV listing and no EPSS score is provided, but the trivial network-reachable login vector makes opportunistic scanning likely.
Privilege escalation in Kushan2k student-management-system allows authenticated remote attackers to grant themselves administrator rights by manipulating the `isadmin` parameter in the Profile Update Endpoint. The `edit-admin` function in `controllers/AdminController.php` performs no server-side authorization check on this parameter, enabling any low-privileged account holder to self-elevate to admin. A publicly available exploit exists per VulDB and a GitHub issue disclosure; the vendor has not yet responded, and no patch has been released under the rolling-release model.
SQL injection in the `getStatus` function of `controllers/GradeController.php` within Kushan2k's student-management-system exposes the Certificate Verification Endpoint to database manipulation by low-privileged remote attackers via the `nic` parameter. A publicly available exploit (proof-of-concept via GitHub issue) lowers the practical bar for abuse despite the CVSS 4.0 base score of 2.1. No patch has been released, and the maintainer has not responded to responsible disclosure, leaving all deployments through commit f16a4ceaddd6729c4b306ed4641cda3176c1ef2a unprotected.
Unrestricted file upload in Kushan2k's student-management-system exposes the registration endpoint to unauthenticated remote attackers who can upload arbitrary files - including PHP webshells - by manipulating the `stimg` argument in `service/RegisterService.php`. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) confirms no authentication, no complexity, and no user interaction are required, making this trivially exploitable by any network-reachable attacker. Publicly available exploit code exists (E:P confirmed), and the vendor has not responded to responsible disclosure as of analysis time, leaving all installations unpatched.
Authentication bypass in ealpha072's Student-Management-System PHP application exposes the administrative backend to remote unauthenticated attackers via a flaw in admin/config.php. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) confirms zero prerequisites - no privileges, no user interaction, no special attack conditions - and a proof-of-concept exploit is publicly available via a GitHub issue report. The vendor has not responded to responsible disclosure and no patched release has been issued, leaving all deployments at or before commit 01451bd7a2f58cdda07bd0b86e3967582e3ecd08 without an official remediation path.
Authentication bypass in sayan365's Student Management System exposes multiple protected endpoints to remote unauthenticated attackers, allowing unauthorized access to application functionality across the entire codebase up to commit 7f3c9ce7d410332335c2affac93a385485051800. The CVSS 4.0 vector confirms trivial, unauthenticated network exploitation (AV:N/AC:L/AT:N/PR:N/UI:N), and publicly available exploit code exists per the E:P maturity modifier and GitHub issue #4. The maintainer has not responded to responsible disclosure, leaving no patch available and the exploit window open indefinitely.
Improper authorization in a4m4's Student-Management-System allows unauthenticated remote attackers to manipulate the `sid` parameter in `admin/deleteform.php` to delete student records without any credentials. All commits up to f0c5f6842c5e8c431ff02b5260a565ca844df3a0 are affected, and a proof-of-concept exploit has been publicly disclosed via the project's GitHub issue tracker. No patch is available; the maintainer has not responded to the responsible disclosure report, leaving all deployed instances exposed with no official remediation path.
Execution After Redirect (EAR) in a4m4's Student-Management-System exposes admin/ endpoints to unauthorized data access via manipulation of the uid parameter, allowing server-side PHP logic to execute and return sensitive output despite issuing an HTTP redirect response. The CVSS vector (PR:N) confirms no authentication is required, and the exploit has been publicly published via a GitHub issue, making this trivially reproducible. No patch exists and the project maintainer has not responded to disclosure, leaving all deployed instances exposed with no vendor remediation timeline.
Cross-site scripting in sambitraj STUDENT-MANAGEMENT-SYSTEM 1.0 allows a high-privileged authenticated attacker to inject malicious script into the Name argument on the Dashboard Page, which executes in the browser of any user who subsequently views the affected page. The vulnerability requires both elevated privileges and victim interaction, placing real-world impact firmly in the low-to-negligible range despite network reachability. No public exploit identified at time of analysis as actively weaponized (no CISA KEV listing), though publicly available exploit code exists via a GitHub issue disclosure.
SQL injection in sambitraj's Student Management System 1.0 exposes the login page to unauthenticated remote exploitation via a crafted email parameter, enabling attackers to manipulate backend database queries. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) confirms no authentication, no user interaction, and no special conditions are required for exploitation. A public proof-of-concept exploit exists via a published GitHub issue, and the vendor has not responded to responsible disclosure - no patch is available at time of analysis.
Improper access control in sambitraj's STUDENT-MANAGEMENT-SYSTEM exposes multiple Dashboard endpoints to unauthenticated remote attackers, enabling unauthorized read and write operations on student data. The vulnerability, tagged as an authentication bypass (CWE-284), affects all code up to and including commit 56ba287f2e9031523ccb4244cb6e3fe530e4e5d5 and is confirmed by a publicly disclosed exploit via GitHub issue. No public exploit identified at time of analysis for active KEV-level exploitation, however publicly available exploit code exists and the maintainer has not responded to responsible disclosure, leaving the codebase unpatched.
Cross-site scripting (XSS) in Cyber-III Student-Management-System allows unauthenticated remote attackers to inject malicious scripts via the batch parameter in the /admin/class%20schedule/delete_batch.php endpoint, compromised by improper input validation. The vulnerability affects all versions up to commit 1a938fa61e9f735078e9b291d2e6215b4942af3f and has publicly available exploit code disclosed on GitHub; the vendor has not responded to early notification.
Cross-site scripting (XSS) in Cyber-III Student-Management-System allows high-privileged authenticated attackers to inject malicious scripts via the $_SERVER['PHP_SELF'] parameter in the /admin/Add%20notice/add%20notice.php endpoint. The vulnerability requires user interaction (UI:P) to trigger and is confirmed by publicly available exploit code, though real-world risk is mitigated by high privilege requirements (PR:H) and limited technical impact (integrity only). The product uses rolling releases with no versioning, and the vendor has not responded to early disclosure.
Stored cross-site scripting (XSS) in Cyber-III Student-Management-System via manipulation of the $_SERVER['PHP_SELF'] variable in the batch-notice.php admin file allows authenticated attackers with high privileges to inject malicious scripts. The vulnerability affects all versions up to commit 1a938fa61e9f735078e9b291d2e6215b4942af3f, exploitable remotely with user interaction, and publicly available exploit code exists. CVSS score of 4.8 reflects moderate risk constrained by authentication and interaction requirements, though the integrity impact and active public disclosure elevate operational concern.
Reflected cross-site scripting in Cyber-III Student-Management-System up to commit 1a938fa61e9f735078e9b291d2e6215b4942af3f allows high-privilege authenticated attackers to inject malicious scripts via the $_SERVER['PHP_SELF'] parameter in the admin notice endpoint (/admin/Add%20notice/notice.php). Publicly available exploit code exists, and the vulnerability requires user interaction (UI) to trigger, limiting practical impact despite remote accessibility.
Improper authorization in Cyber-III Student-Management-System allows unauthenticated remote attackers to bypass authentication controls via crafted HTTP POST requests to /viva/update.php. The vulnerability (CWE-285) enables unauthorized modification of student records by manipulating the 'Name' parameter. Publicly available exploit code exists (GitHub issue #236), and the project maintainer has not responded to responsible disclosure attempts. EPSS data not provided, but CVSS 7.3 with PR:N indicates significant risk for internet-facing deployments.
A vulnerability was found in itsourcecode Student Management System 1.0. The impacted element is an unknown function of the file /add_student/ of the component Add Student Module. [CVSS 2.4 LOW]
phpgurukul Student Management System 1.0 is vulnerable to SQL Injection in studentms/admin/search.php via the searchdata parameter. [CVSS 8.8 HIGH]
SQL injection in itsourcecode Student Management System 1.0 allows remote attackers to manipulate database queries via the ID parameter in the /statistical.php endpoint. The vulnerability is unauthenticated and a publicly available exploit exists, yet the EPSS score is only 0.04%, indicating low probability of widespread exploitation despite the POC.
Time-based blind SQL injection in krishanmurariji Student Management System 1.0 lets an attacker who can reach the /studentms/admin/edit-class-detail.php administrative endpoint inject SQL through the editid GET parameter and infer database contents by measuring server response delays caused by SLEEP() payloads. Because the injection sits inside an admin module, successful exploitation can expose or corrupt administrative data and may lead to broader database compromise if the application database account is over-privileged. Publicly available exploit code exists (a GitHub proof-of-concept README), but there is no confirmed active exploitation (no CISA KEV listing) and the EPSS score is low at 0.28% (19th percentile), so real-world priority is currently low-to-moderate, tempered by the likely need for a valid or compromised admin session.
SQL injection vulnerability in itsourcecode Student Management System 1.0 allows remote attackers to execute arbitrary SQL queries via the 'sy' parameter of /list_report.php. Public exploit code exists, but EPSS indicates a very low exploitation probability (0.05%).
SQL injection in itsourcecode Student Management System 1.0 allows unauthenticated remote attackers to manipulate the ID parameter in /form137.php, potentially reading, modifying, or deleting underlying database records. A public proof-of-concept exploit has been disclosed on GitHub, lowering the barrier to exploitation. Despite the public POC, the EPSS score sits at just 0.05% (15th percentile), consistent with a niche product attracting little automated or opportunistic attack activity.
SQL injection in itsourcecode Student Management System 1.0 allows remote attackers to manipulate the ID parameter in /student_p.php to execute arbitrary SQL queries. A public exploit is available, though no active exploitation has been confirmed by CISA KEV, and the EPSS probability is very low.
SQL injection in itsourcecode Student Management System 1.0 allows remote attackers to execute arbitrary SQL commands via the ID parameter of /record.php. Exploit code is publicly available, though active exploitation has not been reported and the EPSS exploitation probability is low (0.05%).
SQL injection in itsourcecode Student Management System 1.0 allows remote attackers to manipulate database queries via the school_year parameter in /candidates_report.php. Public exploit code is available, enabling unauthorized data access and potential database compromise, though EPSS probability of exploitation is very low (0.05%). No active exploitation has been reported to CISA KEV at this time.
SQL injection in itsourcecode Student Management System version 1.0 allows remote, unauthenticated attackers to execute arbitrary SQL commands via the 'sy' parameter in the /advisers.php endpoint. A publicly available proof-of-concept exploit exists, though EPSS suggests low real-world exploitation activity (0.05%). No vendor advisory or patch has been independently confirmed at this time.
SQL injection in itsourcecode Student Management System 1.0 allows remote attackers to manipulate database queries via the ID parameter in the /addrecord.php endpoint. Public exploit code is available, but no active exploitation is confirmed (not listed in CISA KEV). The vulnerability can lead to unauthorized data access or modification.
SQL injection in itsourcecode Student Management System 1.0 allows remote attackers to manipulate database queries via the ID parameter in /update_subject.php. Exploit code is publicly available, though no active exploitation has been confirmed (EPSS: 0.05%).
SQL injection in itsourcecode Student Management System 1.0 via the ID parameter of /uprec.php allows remote unauthenticated attackers to execute arbitrary SQL commands, potentially reading or modifying the application database. A publicly available proof-of-concept exploit exists, but no active exploitation has been confirmed, and the EPSS score (0.05%) suggests low likelihood of widespread attacks.
Remote SQL injection in itsourcecode Student Management System 1.0 allows unauthenticated attackers to manipulate database queries via the 'ID' parameter in /update_program.php. Public exploit code is available, though no active exploitation has been confirmed through CISA KEV and EPSS indicates low probability of widespread exploitation.
SQL injection in itsourcecode Student Management System 1.0 allows remote attackers to manipulate database queries via an unsanitized ID parameter in /update_account.php, potentially leading to unauthorized data modification or access. Public exploit code is available, but EPSS indicates low exploitation probability.
SQL injection in itsourcecode Student Management System 1.0 allows remote unauthenticated attackers to execute arbitrary SQL commands via the grade parameter in /new_grade.php. Publicly available exploit code exists, but the EPSS score is low (0.05%) and no active exploitation has been reported via CISA KEV, suggesting limited interest or targeting.
SQL injection in itsourcecode Student Management System 1.0's promote.php endpoint allows remote attackers to manipulate the 'sy' parameter to execute arbitrary SQL queries, leading to potential data exposure or modification. A public proof-of-concept exploit exists, but there is no indication of active exploitation. The EPSS score
SQL injection vulnerability in itsourcecode Student Management System version 1.0 allows remote attackers to manipulate database queries via the sy parameter in /new_school_year.php. Exploit code is publicly available, though no active exploitation has been confirmed by CISA KEV. The low EPSS score (0.05%) suggests limited exploitability in practice.
SQL injection in itsourcecode Student Management System 1.0 allows remote attackers to manipulate the Name parameter in /new_adviser.php to execute arbitrary SQL commands. An exploit is publicly available, though no active exploitation is confirmed (not in CISA KEV); EPSS score is low (0.05%).
Remote SQL injection in Student Management System 1.0 via the sub parameter in /newsubject.php allows unauthenticated attackers to manipulate database queries. A publicly available proof-of-concept exists, but no active exploitation has been confirmed. Exploitation probability is low (EPSS 0.04%), though the vulnerability is easily triggered over the network without authentication.
SQL injection in Student Management System 1.0 allows remote attackers to manipulate the ID parameter in /newrecord.php, potentially reading or modifying database contents. Exploit code is publicly available, though the EPSS exploitation probability is low (0.04%). No active exploitation has been reported by CISA KEV.
SQL injection in Student Management System 1.0 allows remote attackers to manipulate the 'ID' parameter in /newcurriculm.php, potentially leading to unauthorized database access. Public exploit code exists, but EPSS exploitation probability is negligible (0.04%), and no active exploitation has been reported. The affected product is a niche academic application, limiting real-world impact.
SQL injection in itsourcecode Student Management System 1.0 allows remote attackers to extract or modify database data by manipulating the 'fname' parameter in /edit_user.php. The exploit is publicly available, but no active exploitation has been confirmed, and the EPSS score is very low (0.04%), indicating minimal real-world likelihood.
SQL injection in itsourcecode Student Information System 1.0 allows authenticated attackers to manipulate database queries via the ID parameter in the /section_edit1.php script. Proof-of-concept exploit code is publicly available, but exploitation requires low-privilege authentication and EPSS indicates very low likelihood of widespread exploitation.
PHPGURUKUL Student Management System using PHP and MySQL v1 was discovered to contain multiple SQL injection vulnerabilities at /studentrecordms/login.php via the username and password parameters. Rated medium severity (CVSS 4.4), this vulnerability is low attack complexity. Public exploit code available and no vendor patch available.
PHPGURUKUL Student Management System using PHP and MySQL v1 was discovered to contain multiple SQL injection vulnerabilities at /studentrecordms/password-recovery.php via the emailid and id. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
A vulnerability was found in code-projects Student Management System 1.0. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
A vulnerability has been found in code-projects Student Management System 1.0.00 and classified as critical. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Cross Site Scripting vulnerability in student management system in php with source code v.1.0.0 allows a remote attacker to execute arbitrary code. Rated medium severity (CVSS 4.8), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
A vulnerability classified as critical has been found in itsourcecode Student Management System 1.0. Rated medium severity (CVSS 6.9), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
A vulnerability classified as critical has been found in SourceCodester Student Management System 1.0. Rated medium severity (CVSS 6.9), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
A reflected cross-site scripting (XSS) vulnerability in the Search Student function of Student Management System v1.2.3 and before allows attackers to execute arbitrary Javascript in the context of a. Rated medium severity (CVSS 4.8), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
A vulnerability classified as critical has been found in ningzichun Student Management System 1.0. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
A vulnerability was found in ningzichun Student Management System 1.0. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
A vulnerability, which was classified as critical, was found in SourceCodester Student Management System. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
Kabir Alhasan Student Management System 1.0 is vulnerable to Authentication Bypass via "Username: admin'# && Password: (Write Something)". Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
Reflected cross-site scripting in ningzichun student-management-system allows unauthenticated remote attackers to inject arbitrary script into the admin/fun/addLog.php log entry function via the reason or detail parameters; exploitation requires a victim to interact with a crafted link, and publicly available exploit code exists. The flaw is rated CVSS 4.0 5.3 (Medium) with no privileges required but user interaction, and independent assessment confirms it is limited to integrity impact with no direct confidentiality or availability loss. The project maintainer has not responded to the reported issue, and no vendor patch is identified at time of analysis.
Default-credential exposure in ningzichun's student-management-system allows remote attackers to authenticate with the administrator password shipped in the example_lite.sql seed file, obtaining full access to the application's administrative functionality and stored data. The flaw affects all versions up to commit 98760f5711cf6dc8b4adca53a9e207ca49b02ebf, and publicly available exploit code exists, though no CISA KEV listing or other confirmation of active exploitation is present. Exploitation is entirely gated on the operator having initialized the database from example_lite.sql and never rotated the seeded account password; given that this is an obscure, rarely deployed hobby project, overall real-world risk is low despite the moderate 5.1 CVSS 4.0 score.
Cross-site request forgery in ningzichun's student-management-system (up to commit 98760f5711cf6dc8b4adca53a9e207ca49b02ebf) lets an unauthenticated attacker forge state-changing requests that execute in the browser of a logged-in administrator or user, producing a limited integrity-only modification. Exploitation requires the victim to hold an active session and be socially engineered into visiting an attacker-controlled page or clicking a crafted link (UI:P/UI:R); confidentiality and availability are unaffected. Publicly available exploit code exists and the CVE carries an EPSS-relevant proof-of-concept flag, though there is no confirmed active exploitation (CISA KEV), and the upstream project was notified via an issue report but has not responded and has released no fix.
Authorization bypass in ningzichun's student-management-system (all versions up to commit 98760f5711cf6dc8b4adca53a9e207ca49b02ebf) allows a remote attacker to tamper with log records by manipulating the sid, addtime, type, reason, detail and logdate arguments passed to user/editLog.php, circumventing the intended ownership/authorization check on those records. Publicly available exploit code exists and the flaw was disclosed through a public GitHub issue report that the maintainer has not responded to, so exposed deployments should be considered at risk. The impact is integrity-only log tampering with no confidentiality or availability loss, and because the affected code is a rare, unmaintained hobby project with no patched release, the realistic risk is low despite a moderate 6.9 CVSS 4.0 base score; authentication requirements are not firmly confirmed from available data, as VulDB rates the vector PR:N while independent analysis assesses PR:L.
Authorization bypass in ningzichun student-management-system (versions up to commit 98760f5711cf6dc8b4adca53a9e207ca49b02ebf) allows remote attackers to read other students' records by manipulating the 'sid' parameter of admin/fun/getStudent.php. Publicly available exploit code exists, and the maintainer has not responded to the report, so no vendor-released patch is identified. The assessed CVSS 3.1 vector is AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N, limiting impact to confidentiality of individual records, but the PR:N rating assumes the admin/ path is reachable without upstream authentication.
Cleartext password storage in sambitraj's Student Management System exposes user credentials to privileged attackers who can access the database or application backend. The flaw resides in aca.sql within the Password Handler component, where passwords are persisted without hashing or encryption. A proof-of-concept has been publicly disclosed via a GitHub issue, though exploitation requires high-privilege access, keeping real-world risk low despite the sensitive nature of the exposed data.
Default credentials hardcoded in the aca.sql database initialization file of sambitraj's Student-Management-System expose unauthenticated remote attackers to authentication bypass using publicly known passwords across all commits through 56ba287f. The project's GitHub issue tracker hosts a public proof-of-concept, and the maintainer has not responded to the disclosure, leaving no remediated release available. The limited deployment footprint (a niche student-facing open-source project) constrains aggregate real-world impact despite the trivial exploitability of default credentials.
Session cookie exposure in sambitraj's Student-Management-System allows attackers to steal session tokens via client-side JavaScript due to the absence of the HttpOnly flag in the `session_start` function. All commits up to 56ba287f2e9031523ccb4244cb6e3fe530e4e5d5 are affected, and no vendor patch exists as the maintainer has not responded to the responsible disclosure. A publicly available proof-of-concept exists, though exploitation requires high attack complexity and a co-present XSS vector to materialize as a session hijack.
Improper authorization in sambitraj Student Management System allows authenticated low-privileged users (students) to access or tamper with other students' records by manipulating the `roll_no` parameter in `student_dashboard.php`. Confirmed by CPE `cpe:2.3:a:sambitraj:student_management_system:*:*:*:*:*:*:*:*`, all commits up to `56ba287f2e9031523ccb4244cb6e3fe530e4e5d5` are affected. A public proof-of-concept is available via a GitHub issue; the project has not responded to disclosure, leaving the flaw unpatched with no KEV listing.
SQL injection in sambitraj's Student-Management-System exposes multiple user-supplied parameters in the Management Mutation Handler to database query manipulation by authenticated remote attackers. The application uses a rolling release model with no versioned releases; all commits up to 56ba287f2e9031523ccb4244cb6e3fe530e4e5d5 are affected and no patch has been issued despite responsible disclosure via GitHub issue. Publicly available exploit code exists (E:P per CVSS 4.0 supplemental), though no active exploitation has been confirmed and the CVSS 4.0 score of 2.1 reflects limited rated impact under low-privilege conditions.
SQL injection in the Dashboard component of sambitraj's Student-Management-System exposes the application to remote database manipulation via the roll_no and teacher_name parameters, affecting all commits through 56ba287f2e9031523ccb4244cb6e3fe530e4e5d5. A low-privileged authenticated attacker can inject arbitrary SQL to read or modify student records without any patch or vendor response currently available. A public exploit exists via GitHub issue disclosure, though real-world impact is constrained by the project's extremely narrow deployment footprint.
Unrestricted file upload in imranrisal-dev's Student-Management-System (PHP) permits authenticated remote attackers to upload arbitrary file types through the storeProfileImage function in student_profile_pic.php by manipulating the choose_file argument. In a PHP application where uploaded files are served under the web root, this class of flaw (CWE-434) directly enables webshell deployment and full server-side remote code execution. A proof-of-concept exploit has been publicly disclosed on GitHub; the vendor did not respond to responsible disclosure, and no patch exists given the project's rolling-release model with no versioned releases.
Cross-site scripting in imvks786/student_management_system allows a low-privileged remote attacker to inject malicious scripts via the name, address, or fname parameters in /add.php. The payload executes in a victim's browser when the affected page is viewed, enabling session hijacking, credential theft, or UI redress attacks against other users of the application. A public exploit is available via a GitHub issue report; the vendor has not responded to the coordinated disclosure.
Improper authorization in the imvks786 student_management_system PHP application allows authenticated low-privileged remote attackers to delete student records they are not authorized to remove via manipulation of the `del` parameter at the /see.php Student Deletion Endpoint. The vulnerability (CWE-285) stems from the application failing to verify that the requesting user holds sufficient privileges to perform the deletion action, effectively enabling horizontal or vertical privilege escalation within the data management scope. No public exploit identified at time of analysis via CISA KEV, though publicly available exploit code exists per the referenced GitHub issue disclosure.
Improper access control in imvks786's Student Management System PHP application exposes the /add.php Student Record Handler endpoint to unauthorized manipulation by authenticated remote attackers. The vulnerability, classified under CWE-284, allows a low-privileged user to perform actions beyond their intended authorization scope - consistent with the 'Authentication Bypass' tag suggesting role-boundary violations rather than full pre-auth access. Public exploit code exists per the GitHub issue report, though the CVSS 4.0 score of 2.1 reflects limited impact scope (low confidentiality, integrity, and availability impact, no downstream system effect). The vendor has not responded to the coordinated disclosure.
SQL injection at the Administrator Login Endpoint of imvks786's student_management_system (PHP) allows unauthenticated remote attackers to manipulate the a_usr and a_pwd parameters in admin/admin_login.php to inject arbitrary SQL. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) confirms zero-barrier remote exploitation with no privileges or user interaction required. A public proof-of-concept exploit has been released via GitHub issue tracker; the project maintainer has not responded to disclosure, and no patch is available at time of analysis.
SQL injection in imvks786 Student Management System (rolling release up to commit 9599b560) allows remote unauthenticated attackers to manipulate the usr and pwd parameters of /index.ph in the Login component to inject arbitrary SQL. Publicly available exploit code exists per VulDB, though the project is on a rolling release with no tagged fix and the maintainer has not responded to the issue report. No CISA KEV listing and no EPSS score is provided, but the trivial network-reachable login vector makes opportunistic scanning likely.
Privilege escalation in Kushan2k student-management-system allows authenticated remote attackers to grant themselves administrator rights by manipulating the `isadmin` parameter in the Profile Update Endpoint. The `edit-admin` function in `controllers/AdminController.php` performs no server-side authorization check on this parameter, enabling any low-privileged account holder to self-elevate to admin. A publicly available exploit exists per VulDB and a GitHub issue disclosure; the vendor has not yet responded, and no patch has been released under the rolling-release model.
SQL injection in the `getStatus` function of `controllers/GradeController.php` within Kushan2k's student-management-system exposes the Certificate Verification Endpoint to database manipulation by low-privileged remote attackers via the `nic` parameter. A publicly available exploit (proof-of-concept via GitHub issue) lowers the practical bar for abuse despite the CVSS 4.0 base score of 2.1. No patch has been released, and the maintainer has not responded to responsible disclosure, leaving all deployments through commit f16a4ceaddd6729c4b306ed4641cda3176c1ef2a unprotected.
Unrestricted file upload in Kushan2k's student-management-system exposes the registration endpoint to unauthenticated remote attackers who can upload arbitrary files - including PHP webshells - by manipulating the `stimg` argument in `service/RegisterService.php`. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) confirms no authentication, no complexity, and no user interaction are required, making this trivially exploitable by any network-reachable attacker. Publicly available exploit code exists (E:P confirmed), and the vendor has not responded to responsible disclosure as of analysis time, leaving all installations unpatched.
Authentication bypass in ealpha072's Student-Management-System PHP application exposes the administrative backend to remote unauthenticated attackers via a flaw in admin/config.php. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) confirms zero prerequisites - no privileges, no user interaction, no special attack conditions - and a proof-of-concept exploit is publicly available via a GitHub issue report. The vendor has not responded to responsible disclosure and no patched release has been issued, leaving all deployments at or before commit 01451bd7a2f58cdda07bd0b86e3967582e3ecd08 without an official remediation path.
Authentication bypass in sayan365's Student Management System exposes multiple protected endpoints to remote unauthenticated attackers, allowing unauthorized access to application functionality across the entire codebase up to commit 7f3c9ce7d410332335c2affac93a385485051800. The CVSS 4.0 vector confirms trivial, unauthenticated network exploitation (AV:N/AC:L/AT:N/PR:N/UI:N), and publicly available exploit code exists per the E:P maturity modifier and GitHub issue #4. The maintainer has not responded to responsible disclosure, leaving no patch available and the exploit window open indefinitely.
Improper authorization in a4m4's Student-Management-System allows unauthenticated remote attackers to manipulate the `sid` parameter in `admin/deleteform.php` to delete student records without any credentials. All commits up to f0c5f6842c5e8c431ff02b5260a565ca844df3a0 are affected, and a proof-of-concept exploit has been publicly disclosed via the project's GitHub issue tracker. No patch is available; the maintainer has not responded to the responsible disclosure report, leaving all deployed instances exposed with no official remediation path.
Execution After Redirect (EAR) in a4m4's Student-Management-System exposes admin/ endpoints to unauthorized data access via manipulation of the uid parameter, allowing server-side PHP logic to execute and return sensitive output despite issuing an HTTP redirect response. The CVSS vector (PR:N) confirms no authentication is required, and the exploit has been publicly published via a GitHub issue, making this trivially reproducible. No patch exists and the project maintainer has not responded to disclosure, leaving all deployed instances exposed with no vendor remediation timeline.
Cross-site scripting in sambitraj STUDENT-MANAGEMENT-SYSTEM 1.0 allows a high-privileged authenticated attacker to inject malicious script into the Name argument on the Dashboard Page, which executes in the browser of any user who subsequently views the affected page. The vulnerability requires both elevated privileges and victim interaction, placing real-world impact firmly in the low-to-negligible range despite network reachability. No public exploit identified at time of analysis as actively weaponized (no CISA KEV listing), though publicly available exploit code exists via a GitHub issue disclosure.
SQL injection in sambitraj's Student Management System 1.0 exposes the login page to unauthenticated remote exploitation via a crafted email parameter, enabling attackers to manipulate backend database queries. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) confirms no authentication, no user interaction, and no special conditions are required for exploitation. A public proof-of-concept exploit exists via a published GitHub issue, and the vendor has not responded to responsible disclosure - no patch is available at time of analysis.
Improper access control in sambitraj's STUDENT-MANAGEMENT-SYSTEM exposes multiple Dashboard endpoints to unauthenticated remote attackers, enabling unauthorized read and write operations on student data. The vulnerability, tagged as an authentication bypass (CWE-284), affects all code up to and including commit 56ba287f2e9031523ccb4244cb6e3fe530e4e5d5 and is confirmed by a publicly disclosed exploit via GitHub issue. No public exploit identified at time of analysis for active KEV-level exploitation, however publicly available exploit code exists and the maintainer has not responded to responsible disclosure, leaving the codebase unpatched.
Cross-site scripting (XSS) in Cyber-III Student-Management-System allows unauthenticated remote attackers to inject malicious scripts via the batch parameter in the /admin/class%20schedule/delete_batch.php endpoint, compromised by improper input validation. The vulnerability affects all versions up to commit 1a938fa61e9f735078e9b291d2e6215b4942af3f and has publicly available exploit code disclosed on GitHub; the vendor has not responded to early notification.
Cross-site scripting (XSS) in Cyber-III Student-Management-System allows high-privileged authenticated attackers to inject malicious scripts via the $_SERVER['PHP_SELF'] parameter in the /admin/Add%20notice/add%20notice.php endpoint. The vulnerability requires user interaction (UI:P) to trigger and is confirmed by publicly available exploit code, though real-world risk is mitigated by high privilege requirements (PR:H) and limited technical impact (integrity only). The product uses rolling releases with no versioning, and the vendor has not responded to early disclosure.
Stored cross-site scripting (XSS) in Cyber-III Student-Management-System via manipulation of the $_SERVER['PHP_SELF'] variable in the batch-notice.php admin file allows authenticated attackers with high privileges to inject malicious scripts. The vulnerability affects all versions up to commit 1a938fa61e9f735078e9b291d2e6215b4942af3f, exploitable remotely with user interaction, and publicly available exploit code exists. CVSS score of 4.8 reflects moderate risk constrained by authentication and interaction requirements, though the integrity impact and active public disclosure elevate operational concern.
Reflected cross-site scripting in Cyber-III Student-Management-System up to commit 1a938fa61e9f735078e9b291d2e6215b4942af3f allows high-privilege authenticated attackers to inject malicious scripts via the $_SERVER['PHP_SELF'] parameter in the admin notice endpoint (/admin/Add%20notice/notice.php). Publicly available exploit code exists, and the vulnerability requires user interaction (UI) to trigger, limiting practical impact despite remote accessibility.
Improper authorization in Cyber-III Student-Management-System allows unauthenticated remote attackers to bypass authentication controls via crafted HTTP POST requests to /viva/update.php. The vulnerability (CWE-285) enables unauthorized modification of student records by manipulating the 'Name' parameter. Publicly available exploit code exists (GitHub issue #236), and the project maintainer has not responded to responsible disclosure attempts. EPSS data not provided, but CVSS 7.3 with PR:N indicates significant risk for internet-facing deployments.
A vulnerability was found in itsourcecode Student Management System 1.0. The impacted element is an unknown function of the file /add_student/ of the component Add Student Module. [CVSS 2.4 LOW]
phpgurukul Student Management System 1.0 is vulnerable to SQL Injection in studentms/admin/search.php via the searchdata parameter. [CVSS 8.8 HIGH]
SQL injection in itsourcecode Student Management System 1.0 allows remote attackers to manipulate database queries via the ID parameter in the /statistical.php endpoint. The vulnerability is unauthenticated and a publicly available exploit exists, yet the EPSS score is only 0.04%, indicating low probability of widespread exploitation despite the POC.
Time-based blind SQL injection in krishanmurariji Student Management System 1.0 lets an attacker who can reach the /studentms/admin/edit-class-detail.php administrative endpoint inject SQL through the editid GET parameter and infer database contents by measuring server response delays caused by SLEEP() payloads. Because the injection sits inside an admin module, successful exploitation can expose or corrupt administrative data and may lead to broader database compromise if the application database account is over-privileged. Publicly available exploit code exists (a GitHub proof-of-concept README), but there is no confirmed active exploitation (no CISA KEV listing) and the EPSS score is low at 0.28% (19th percentile), so real-world priority is currently low-to-moderate, tempered by the likely need for a valid or compromised admin session.
SQL injection vulnerability in itsourcecode Student Management System 1.0 allows remote attackers to execute arbitrary SQL queries via the 'sy' parameter of /list_report.php. Public exploit code exists, but EPSS indicates a very low exploitation probability (0.05%).
SQL injection in itsourcecode Student Management System 1.0 allows unauthenticated remote attackers to manipulate the ID parameter in /form137.php, potentially reading, modifying, or deleting underlying database records. A public proof-of-concept exploit has been disclosed on GitHub, lowering the barrier to exploitation. Despite the public POC, the EPSS score sits at just 0.05% (15th percentile), consistent with a niche product attracting little automated or opportunistic attack activity.
SQL injection in itsourcecode Student Management System 1.0 allows remote attackers to manipulate the ID parameter in /student_p.php to execute arbitrary SQL queries. A public exploit is available, though no active exploitation has been confirmed by CISA KEV, and the EPSS probability is very low.
SQL injection in itsourcecode Student Management System 1.0 allows remote attackers to execute arbitrary SQL commands via the ID parameter of /record.php. Exploit code is publicly available, though active exploitation has not been reported and the EPSS exploitation probability is low (0.05%).
SQL injection in itsourcecode Student Management System 1.0 allows remote attackers to manipulate database queries via the school_year parameter in /candidates_report.php. Public exploit code is available, enabling unauthorized data access and potential database compromise, though EPSS probability of exploitation is very low (0.05%). No active exploitation has been reported to CISA KEV at this time.
SQL injection in itsourcecode Student Management System version 1.0 allows remote, unauthenticated attackers to execute arbitrary SQL commands via the 'sy' parameter in the /advisers.php endpoint. A publicly available proof-of-concept exploit exists, though EPSS suggests low real-world exploitation activity (0.05%). No vendor advisory or patch has been independently confirmed at this time.
SQL injection in itsourcecode Student Management System 1.0 allows remote attackers to manipulate database queries via the ID parameter in the /addrecord.php endpoint. Public exploit code is available, but no active exploitation is confirmed (not listed in CISA KEV). The vulnerability can lead to unauthorized data access or modification.
SQL injection in itsourcecode Student Management System 1.0 allows remote attackers to manipulate database queries via the ID parameter in /update_subject.php. Exploit code is publicly available, though no active exploitation has been confirmed (EPSS: 0.05%).
SQL injection in itsourcecode Student Management System 1.0 via the ID parameter of /uprec.php allows remote unauthenticated attackers to execute arbitrary SQL commands, potentially reading or modifying the application database. A publicly available proof-of-concept exploit exists, but no active exploitation has been confirmed, and the EPSS score (0.05%) suggests low likelihood of widespread attacks.
Remote SQL injection in itsourcecode Student Management System 1.0 allows unauthenticated attackers to manipulate database queries via the 'ID' parameter in /update_program.php. Public exploit code is available, though no active exploitation has been confirmed through CISA KEV and EPSS indicates low probability of widespread exploitation.
SQL injection in itsourcecode Student Management System 1.0 allows remote attackers to manipulate database queries via an unsanitized ID parameter in /update_account.php, potentially leading to unauthorized data modification or access. Public exploit code is available, but EPSS indicates low exploitation probability.
SQL injection in itsourcecode Student Management System 1.0 allows remote unauthenticated attackers to execute arbitrary SQL commands via the grade parameter in /new_grade.php. Publicly available exploit code exists, but the EPSS score is low (0.05%) and no active exploitation has been reported via CISA KEV, suggesting limited interest or targeting.
SQL injection in itsourcecode Student Management System 1.0's promote.php endpoint allows remote attackers to manipulate the 'sy' parameter to execute arbitrary SQL queries, leading to potential data exposure or modification. A public proof-of-concept exploit exists, but there is no indication of active exploitation. The EPSS score
SQL injection vulnerability in itsourcecode Student Management System version 1.0 allows remote attackers to manipulate database queries via the sy parameter in /new_school_year.php. Exploit code is publicly available, though no active exploitation has been confirmed by CISA KEV. The low EPSS score (0.05%) suggests limited exploitability in practice.
SQL injection in itsourcecode Student Management System 1.0 allows remote attackers to manipulate the Name parameter in /new_adviser.php to execute arbitrary SQL commands. An exploit is publicly available, though no active exploitation is confirmed (not in CISA KEV); EPSS score is low (0.05%).
Remote SQL injection in Student Management System 1.0 via the sub parameter in /newsubject.php allows unauthenticated attackers to manipulate database queries. A publicly available proof-of-concept exists, but no active exploitation has been confirmed. Exploitation probability is low (EPSS 0.04%), though the vulnerability is easily triggered over the network without authentication.
SQL injection in Student Management System 1.0 allows remote attackers to manipulate the ID parameter in /newrecord.php, potentially reading or modifying database contents. Exploit code is publicly available, though the EPSS exploitation probability is low (0.04%). No active exploitation has been reported by CISA KEV.
SQL injection in Student Management System 1.0 allows remote attackers to manipulate the 'ID' parameter in /newcurriculm.php, potentially leading to unauthorized database access. Public exploit code exists, but EPSS exploitation probability is negligible (0.04%), and no active exploitation has been reported. The affected product is a niche academic application, limiting real-world impact.
SQL injection in itsourcecode Student Management System 1.0 allows remote attackers to extract or modify database data by manipulating the 'fname' parameter in /edit_user.php. The exploit is publicly available, but no active exploitation has been confirmed, and the EPSS score is very low (0.04%), indicating minimal real-world likelihood.
SQL injection in itsourcecode Student Information System 1.0 allows authenticated attackers to manipulate database queries via the ID parameter in the /section_edit1.php script. Proof-of-concept exploit code is publicly available, but exploitation requires low-privilege authentication and EPSS indicates very low likelihood of widespread exploitation.
PHPGURUKUL Student Management System using PHP and MySQL v1 was discovered to contain multiple SQL injection vulnerabilities at /studentrecordms/login.php via the username and password parameters. Rated medium severity (CVSS 4.4), this vulnerability is low attack complexity. Public exploit code available and no vendor patch available.
PHPGURUKUL Student Management System using PHP and MySQL v1 was discovered to contain multiple SQL injection vulnerabilities at /studentrecordms/password-recovery.php via the emailid and id. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
A vulnerability was found in code-projects Student Management System 1.0. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
A vulnerability has been found in code-projects Student Management System 1.0.00 and classified as critical. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Cross Site Scripting vulnerability in student management system in php with source code v.1.0.0 allows a remote attacker to execute arbitrary code. Rated medium severity (CVSS 4.8), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
A vulnerability classified as critical has been found in itsourcecode Student Management System 1.0. Rated medium severity (CVSS 6.9), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
A vulnerability classified as critical has been found in SourceCodester Student Management System 1.0. Rated medium severity (CVSS 6.9), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
A reflected cross-site scripting (XSS) vulnerability in the Search Student function of Student Management System v1.2.3 and before allows attackers to execute arbitrary Javascript in the context of a. Rated medium severity (CVSS 4.8), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
A vulnerability classified as critical has been found in ningzichun Student Management System 1.0. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
A vulnerability was found in ningzichun Student Management System 1.0. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
A vulnerability, which was classified as critical, was found in SourceCodester Student Management System. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
Kabir Alhasan Student Management System 1.0 is vulnerable to Authentication Bypass via "Username: admin'# && Password: (Write Something)". Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.