Latest high and critical flaws
- CVE-2023-27377 Missing authentication in the StudentPopupDetails_EmergencyContactDetails method in IDAttend’s IDWeb application 3.1.052 and earlier allows extraction ofHigh 7.5 · Oct 25, 2023
- CVE-2023-27376 Missing authentication in the StudentPopupDetails_StudentDetails method in IDAttend’s IDWeb application 3.1.052 and earlier allows extraction of sensitiveHigh 7.5 · Oct 25, 2023
- CVE-2023-27375 Missing authentication in the StudentPopupDetails_ContactDetails method in IDAttend’s IDWeb application 3.1.052 and earlier allows extraction of sensitiveHigh 7.5 · Oct 25, 2023
- CVE-2023-27262 Unauthenticated SQL injection in the GetAssignmentsDue method in IDAttend’s IDWeb application 3.1.052 and earlier allows extraction or modification of alCritical 9.8 · Oct 25, 2023
- CVE-2023-27260 Unauthenticated SQL injection in the GetAssignmentsDue method in IDAttend’s IDWeb application 3.1.052 and earlier allows extraction or modification of alCritical 9.8 · Oct 25, 2023
- CVE-2023-27259 Missing authentication in the GetAssignmentsDue method in IDAttend’s IDWeb application 3.1.052 and earlier allows extraction of sensitive student and teachHigh 7.5 · Oct 25, 2023
- CVE-2023-27258 Missing authentication in the GetStudentGroupStudents method in IDAttend’s IDWeb application 3.1.052 and earlier allows retrieval of student and teacher datHigh 7.5 · Oct 25, 2023
- CVE-2023-27257 Missing authentication in the GetActiveToiletPasses method in IDAttend’s IDWeb application 3.1.052 and earlier allows retrieval of student information by unaHigh 7.5 · Oct 25, 2023
- CVE-2023-27255 Unauthenticated SQL injection in the DeleteRoomChanges method in IDAttend’s IDWeb application 3.1.052 and earlier allows extraction or modification of allCritical 9.8 · Oct 25, 2023
- CVE-2023-27254 Unauthenticated SQL injection in the GetRoomChanges method in IDAttend’s IDWeb application 3.1.052 and earlier allows extraction or modification of all datCritical 9.8 · Oct 25, 2023
- CVE-2023-26584 Unauthenticated SQL injection in the GetStudentInconsistencies method in IDAttend’s IDWeb application 3.1.052 and earlier allows extraction or modification Critical 9.8 · Oct 25, 2023
- CVE-2023-26583 Unauthenticated SQL injection in the GetCurrentPeriod method in IDAttend’s IDWeb application 3.1.052 and earlier allows extraction or modification of all datCritical 9.8 · Oct 25, 2023
- CVE-2023-26582 Unauthenticated SQL injection in the GetExcursionDetails method in IDAttend’s IDWeb application 3.1.052 and earlier allows extraction or modification of all dCritical 9.8 · Oct 25, 2023
- CVE-2023-26581 Unauthenticated SQL injection in the GetVisitors method in IDAttend’s IDWeb application 3.1.052 and earlier allows extraction or modification of all data by unCritical 9.8 · Oct 25, 2023
- CVE-2023-26580 Unauthenticated arbitrary file read in the IDAttend’s IDWeb application 3.1.013 allows the retrieval of any file present on the web server by unauthenticated atHigh 7.5 · Oct 25, 2023
- CVE-2023-26578 Arbitrary file upload to web root in the IDAttend’s IDWeb application 3.1.013 allows authenticated attackers to upload dangerous files to web root such as ASP oHigh 8.8 · Oct 25, 2023
- CVE-2023-26577 Stored cross-site scripting in the IDAttend’s IDWeb application 3.1.052 and earlier allows attackers to hijack the browsing session of the logged in user.High 7.5 · Oct 25, 2023
- CVE-2023-26576 Missing authentication in the SearchStudentsRFID method in IDAttend’s IDWeb application 3.1.052 and earlier allows extraction sensitive student data by unauthHigh 7.5 · Oct 25, 2023
- CVE-2023-26575 Missing authentication in the SearchStudentsStaff method in IDAttend’s IDWeb application 3.1.052 and earlier allows extraction sensitive student and teacher daHigh 7.5 · Oct 25, 2023
- CVE-2023-26574 Missing authentication in the SearchStudents method in IDAttend’s IDWeb application 3.1.052 and earlier allows extraction sensitive student data by unauthenticaHigh 7.5 · Oct 25, 2023
- CVE-2023-26573 Missing authentication in the SetDB method in IDAttend’s IDWeb application 3.1.052 and earlier allows denial of service or theft of database login credentials.High 8.2 · Oct 25, 2023
- CVE-2023-26572 Unauthenticated SQL injection in the GetExcursionList method in IDAttend’s IDWeb application 3.1.052 and earlier allows extraction or modification of all data bCritical 9.8 · Oct 25, 2023
- CVE-2023-26571 Missing authentication in the SetStudentNotes method in IDAttend’s IDWeb application 3.1.052 and earlier allows modification of student data by unauthenticatedHigh 7.5 · Oct 25, 2023
- CVE-2023-26570 Missing authentication in the StudentPopupDetails_Timetable method in IDAttend’s IDWeb application 3.1.052 and earlier allows extraction sensitive student data High 7.5 · Oct 25, 2023
- CVE-2023-26569 Unauthenticated SQL injection in the StudentPopupDetails_Timetable method in IDAttend’s IDWeb application 3.1.052 and earlier allows extraction or modification Critical 9.8 · Oct 25, 2023
Part of our vulnerability database: the whole National Vulnerability Database plus CISA’s exploited list, refreshed twice a day. This is general guidance, not a review of your systems.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.