Student Result Management System
Monthly
SourceCodester Student Result Management System 1.0 stores authentication credentials in cleartext within an HTTP-accessible file (/login_credentials.txt), allowing unauthenticated remote attackers to retrieve sensitive login information with low complexity. The vulnerability has publicly available exploit code and carries a CVSS 5.3 score reflecting confidentiality impact without integrity or availability compromise.
A Cross-Site Request Forgery (CSRF) vulnerability was identified in the Profile Page of the PHPGurukul Student-Result-Management-System-Using-PHP-V2.0. Rated high severity (CVSS 7.3), this vulnerability is no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
Session hijacking in PHPGurukul Student Result Management System v2.0 stems from the /srms/change-password.php component failing to invalidate existing sessions after a password change, so an attacker holding a previously captured session token retains authenticated access even after the victim rotates their credentials. Publicly available exploit code exists on GitHub, though the flaw is not listed in CISA KEV and carries a modest EPSS score of 0.62% (45th percentile), indicating low observed exploitation activity. The vulnerability primarily undermines the account-recovery security guarantee that changing a password should terminate compromised sessions.
Session hijacking in PHPGurukul Student Result Management System v2.0 stems from improper session invalidation in the employee change-password handler (/elms/emp-changepassword.php), letting attackers reuse session tokens that should have been terminated to take over an authenticated account. A public proof-of-concept exists (VasilVK GitHub), but there is no public exploit identified as actively exploited; EPSS is low at 0.52% (40th percentile) and it is not on CISA KEV. This is a niche PHP educational application, so real-world exposure is limited despite the network-facing nature of the flaw.
Stored cross-site scripting in SourceCodester Student Result Management System 1.0 allows an authenticated admin to inject arbitrary JavaScript via the School Name parameter on the System Settings page. A public exploit exists, but the vulnerability requires high privileges and user interaction, limiting real-world impact.
Cross-site scripting (XSS) in SourceCodester Student Result Management System 1.0 allows an authenticated admin to inject arbitrary JavaScript via the Manage Students module. A public exploit exists, but exploitation requires high privileges and user interaction, limiting real-world risk.
Stored cross-site scripting in SourceCodester Student Result Management System 1.0 allows an authenticated attacker with high privileges to inject malicious scripts via the Title field on the Announcement page. A public exploit exists, but no active exploitation has been reported and EPSS score is low (0.07%).
Stored cross-site scripting in SourceCodester Student Result Management System 1.0 allows an authenticated attacker with high privileges to inject arbitrary JavaScript via the Division parameter on the Division System page. A public exploit exists, but no active exploitation has been reported and EPSS risk is low.
Stored cross-site scripting (XSS) in SourceCodester Student Result Management System 1.0 allows an authenticated user with high privileges to inject arbitrary JavaScript via the Remark field on the Grading System page. The exploit is publicly available, but EPSS score is low (0.06%) and no active exploitation has been reported.
Stored cross-site scripting in SourceCodester Student Result Management System 1.0 allows an authenticated attacker with high privileges to inject arbitrary JavaScript via the Subject field on the Subjects page. A public exploit is available, but no active exploitation has been reported and EPSS risk is low.
Stored cross-site scripting in SourceCodester Student Result Management System 1.0 allows an authenticated attacker with high privileges to inject malicious scripts via the Class Name field on the Classes page. A publicly available proof-of-concept exploit exists, but no active exploitation has been reported and the EPSS score is low (0.09%).
Stored cross-site scripting (XSS) in SourceCodester Student Result Management System 1.0 allows an authenticated attacker with high privileges to inject arbitrary JavaScript via the Academic Term field in the Add Academic Term page. The vulnerability is publicly exploited with a proof-of-concept available, though EPSS score is low (0.09%) and no active exploitation in CISA KEV has been reported.
Stored cross-site scripting in SourceCodester Student Result Management System 1.0 allows an authenticated high-privilege user to inject malicious scripts via the email field on the profile update page. A public exploit exists, but no active exploitation has been reported and EPSS score is low (0.07%).
A remote code execution vulnerability in A vulnerability classified as critical (CVSS 5.3). Risk factors: public PoC available.
Critical SQL injection vulnerability in PHPGurukul Student Result Management System version 1.3, exploitable through the emp1ctc parameter in /editmyexp.php. An unauthenticated remote attacker can manipulate this parameter to inject malicious SQL commands, potentially leading to unauthorized data access, modification, or deletion. With a publicly disclosed exploit and CVSS 7.3 rating reflecting network-based remote exploitation with low attack complexity and no authentication requirements, this vulnerability poses significant risk to exposed instances.
A vulnerability has been found in SourceCodester Student Result Management System 1.0 and classified as critical. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
A vulnerability was found in SourceCodester Student Result Management System 1.0. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
A vulnerability was found in SourceCodester Student Result Management System 1.0. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
Student Result Management System v1.0 is vulnerable to multiple Unauthenticated SQL Injection vulnerabilities. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
Student Result Management System v1.0 is vulnerable to multiple Unauthenticated SQL Injection vulnerabilities. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
Student Result Management System v1.0 is vulnerable to multiple Unauthenticated SQL Injection vulnerabilities. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
Student Result Management System v1.0 is vulnerable to multiple Unauthenticated SQL Injection vulnerabilities. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
SourceCodester Student Result Management System 1.0 stores authentication credentials in cleartext within an HTTP-accessible file (/login_credentials.txt), allowing unauthenticated remote attackers to retrieve sensitive login information with low complexity. The vulnerability has publicly available exploit code and carries a CVSS 5.3 score reflecting confidentiality impact without integrity or availability compromise.
A Cross-Site Request Forgery (CSRF) vulnerability was identified in the Profile Page of the PHPGurukul Student-Result-Management-System-Using-PHP-V2.0. Rated high severity (CVSS 7.3), this vulnerability is no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
Session hijacking in PHPGurukul Student Result Management System v2.0 stems from the /srms/change-password.php component failing to invalidate existing sessions after a password change, so an attacker holding a previously captured session token retains authenticated access even after the victim rotates their credentials. Publicly available exploit code exists on GitHub, though the flaw is not listed in CISA KEV and carries a modest EPSS score of 0.62% (45th percentile), indicating low observed exploitation activity. The vulnerability primarily undermines the account-recovery security guarantee that changing a password should terminate compromised sessions.
Session hijacking in PHPGurukul Student Result Management System v2.0 stems from improper session invalidation in the employee change-password handler (/elms/emp-changepassword.php), letting attackers reuse session tokens that should have been terminated to take over an authenticated account. A public proof-of-concept exists (VasilVK GitHub), but there is no public exploit identified as actively exploited; EPSS is low at 0.52% (40th percentile) and it is not on CISA KEV. This is a niche PHP educational application, so real-world exposure is limited despite the network-facing nature of the flaw.
Stored cross-site scripting in SourceCodester Student Result Management System 1.0 allows an authenticated admin to inject arbitrary JavaScript via the School Name parameter on the System Settings page. A public exploit exists, but the vulnerability requires high privileges and user interaction, limiting real-world impact.
Cross-site scripting (XSS) in SourceCodester Student Result Management System 1.0 allows an authenticated admin to inject arbitrary JavaScript via the Manage Students module. A public exploit exists, but exploitation requires high privileges and user interaction, limiting real-world risk.
Stored cross-site scripting in SourceCodester Student Result Management System 1.0 allows an authenticated attacker with high privileges to inject malicious scripts via the Title field on the Announcement page. A public exploit exists, but no active exploitation has been reported and EPSS score is low (0.07%).
Stored cross-site scripting in SourceCodester Student Result Management System 1.0 allows an authenticated attacker with high privileges to inject arbitrary JavaScript via the Division parameter on the Division System page. A public exploit exists, but no active exploitation has been reported and EPSS risk is low.
Stored cross-site scripting (XSS) in SourceCodester Student Result Management System 1.0 allows an authenticated user with high privileges to inject arbitrary JavaScript via the Remark field on the Grading System page. The exploit is publicly available, but EPSS score is low (0.06%) and no active exploitation has been reported.
Stored cross-site scripting in SourceCodester Student Result Management System 1.0 allows an authenticated attacker with high privileges to inject arbitrary JavaScript via the Subject field on the Subjects page. A public exploit is available, but no active exploitation has been reported and EPSS risk is low.
Stored cross-site scripting in SourceCodester Student Result Management System 1.0 allows an authenticated attacker with high privileges to inject malicious scripts via the Class Name field on the Classes page. A publicly available proof-of-concept exploit exists, but no active exploitation has been reported and the EPSS score is low (0.09%).
Stored cross-site scripting (XSS) in SourceCodester Student Result Management System 1.0 allows an authenticated attacker with high privileges to inject arbitrary JavaScript via the Academic Term field in the Add Academic Term page. The vulnerability is publicly exploited with a proof-of-concept available, though EPSS score is low (0.09%) and no active exploitation in CISA KEV has been reported.
Stored cross-site scripting in SourceCodester Student Result Management System 1.0 allows an authenticated high-privilege user to inject malicious scripts via the email field on the profile update page. A public exploit exists, but no active exploitation has been reported and EPSS score is low (0.07%).
A remote code execution vulnerability in A vulnerability classified as critical (CVSS 5.3). Risk factors: public PoC available.
Critical SQL injection vulnerability in PHPGurukul Student Result Management System version 1.3, exploitable through the emp1ctc parameter in /editmyexp.php. An unauthenticated remote attacker can manipulate this parameter to inject malicious SQL commands, potentially leading to unauthorized data access, modification, or deletion. With a publicly disclosed exploit and CVSS 7.3 rating reflecting network-based remote exploitation with low attack complexity and no authentication requirements, this vulnerability poses significant risk to exposed instances.
A vulnerability has been found in SourceCodester Student Result Management System 1.0 and classified as critical. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
A vulnerability was found in SourceCodester Student Result Management System 1.0. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
A vulnerability was found in SourceCodester Student Result Management System 1.0. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
Student Result Management System v1.0 is vulnerable to multiple Unauthenticated SQL Injection vulnerabilities. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
Student Result Management System v1.0 is vulnerable to multiple Unauthenticated SQL Injection vulnerabilities. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
Student Result Management System v1.0 is vulnerable to multiple Unauthenticated SQL Injection vulnerabilities. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
Student Result Management System v1.0 is vulnerable to multiple Unauthenticated SQL Injection vulnerabilities. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.