Updated 10 h ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,762exploited flaws on CISA’s list

34added in the last 30 days

343new WordPress flaws this week

390,080entries in the database

78 results · page 2 of 2

Aug 20, 2024School Management System commit bae5aa was discovered to contain a SQL injection vulnerability via the medium parameter at paidclass.php.CVE-2024-42569 · Other software · arajajyothibabu · reported by MITRECritical 9.8
School Management System commit bae5aa was discovered to contain a SQL injection vulnerability via the medium parameter at paidclass.php.
Product
school_management_system
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record gist.github.com
Aug 20, 2024School Management System commit bae5aa was discovered to contain a SQL injection vulnerability via the transport parameter at vehicle.php.CVE-2024-42568 · Other software · arajajyothibabu · reported by MITRECritical 9.8
School Management System commit bae5aa was discovered to contain a SQL injection vulnerability via the transport parameter at vehicle.php.
Product
school_management_system
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record gist.github.com
Aug 20, 2024School Management System commit bae5aa was discovered to contain a SQL injection vulnerability via the sid parameter at /search.php?action=2.CVE-2024-42567 · Other software · school_management_system_project · reported by MITRECritical 9.8
School Management System commit bae5aa was discovered to contain a SQL injection vulnerability via the sid parameter at /search.php?action=2.
Product
school_management_system
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record gist.github.com
Aug 20, 2024School Management System commit bae5aa was discovered to contain a SQL injection vulnerability via the password parameter at login.phpCVE-2024-42566 · Other software · school_management_system_project · reported by MITRECritical 9.8
School Management System commit bae5aa was discovered to contain a SQL injection vulnerability via the password parameter at login.php
Product
school_management_system
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record gist.github.com
Aug 7, 2024A Stored Cross Site Scripting (XSS) vulnerability was found in "/smsa/add_class_submit.php" in Responsive School Management System v3.2.0, which allows remote aCVE-2024-41239 · Other software · kashipara · reported by MITREMedium 4.8
A Stored Cross Site Scripting (XSS) vulnerability was found in "/smsa/add_class_submit.php" in Responsive School Management System v3.2.0, which allows remote attackers to execute arbitrary code via "class_name" parameter field.
Product
responsive_school_management_system
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com kashipara.com
Jun 27, 2024A vulnerability was found in lahirudanushka School Management System 1.0.0/1.0.1 and classified as problematic.CVE-2024-6374 · Other software · lahirudanushka · reported by VulDBMedium 5.3
A vulnerability was found in lahirudanushka School Management System 1.0.0/1.0.1 and classified as problematic. This issue affects some unknown processing of the file /subject.php of the component Subject Page. The manipulation of the argument Subject Title/Sybillus Details leads to cross site scripting. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-269807.
Product
School Management System
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record secretive-agate-23c.notion.site secretive-agate-23c.notion.site
Jun 23, 2024A vulnerability was found in lahirudanushka School Management System 1.0.0/1.0.1 and classified as critical.CVE-2024-6279 · Other software · lahirudanushka · reported by VulDBMedium 5.3
A vulnerability was found in lahirudanushka School Management System 1.0.0/1.0.1 and classified as critical. Affected by this issue is some unknown functionality of the file examresults-par.php of the component Exam Results Page. The manipulation of the argument sid leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-269492.
Product
School Management System
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record powerful-bulb-c36.notion.site vuldb.com
Jun 23, 2024A vulnerability has been found in lahirudanushka School Management System 1.0.0/1.0.1 and classified as critical.CVE-2024-6278 · Other software · lahirudanushka · reported by VulDBMedium 5.1
A vulnerability has been found in lahirudanushka School Management System 1.0.0/1.0.1 and classified as critical. Affected by this vulnerability is an unknown functionality of the file subject.php of the component Subject Page. The manipulation of the argument update leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-269491.
Product
School Management System
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record powerful-bulb-c36.notion.site vuldb.com
Jun 23, 2024A vulnerability, which was classified as critical, was found in lahirudanushka School Management System 1.0.0/1.0.1.CVE-2024-6277 · Other software · lahirudanushka · reported by VulDBMedium 5.1
A vulnerability, which was classified as critical, was found in lahirudanushka School Management System 1.0.0/1.0.1. Affected is an unknown function of the file student.php of the component Student Page. The manipulation of the argument update leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. VDB-269490 is the identifier assigned to this vulnerability.
Product
School Management System
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record powerful-bulb-c36.notion.site vuldb.com
Jun 23, 2024A vulnerability, which was classified as critical, has been found in lahirudanushka School Management System 1.0.0/1.0.1.CVE-2024-6276 · Other software · lahirudanushka · reported by VulDBMedium 5.1
A vulnerability, which was classified as critical, has been found in lahirudanushka School Management System 1.0.0/1.0.1. This issue affects some unknown processing of the file teacher.php of the component Teacher Page. The manipulation of the argument update leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-269489 was assigned to this vulnerability.
Product
School Management System
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record powerful-bulb-c36.notion.site vuldb.com
Jun 23, 2024A vulnerability classified as critical was found in lahirudanushka School Management System 1.0.0/1.0.1.CVE-2024-6275 · Other software · lahirudanushka · reported by VulDBMedium 5.1
A vulnerability classified as critical was found in lahirudanushka School Management System 1.0.0/1.0.1. This vulnerability affects unknown code of the file parent.php of the component Parent Page. The manipulation of the argument update leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-269488.
Product
School Management System
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record powerful-bulb-c36.notion.site vuldb.com
Jun 23, 2024A vulnerability classified as critical has been found in lahirudanushka School Management System 1.0.0/1.0.1.CVE-2024-6274 · Other software · lahirudanushka · reported by VulDBMedium 5.1
A vulnerability classified as critical has been found in lahirudanushka School Management System 1.0.0/1.0.1. This affects an unknown part of the file /attendancelist.php of the component Attendance Report Page. The manipulation of the argument aid leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-269487.
Product
School Management System
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record powerful-bulb-c36.notion.site vuldb.com
Jun 23, 2024A vulnerability, which was classified as critical, has been found in lahirudanushka School Management System 1.0.0/1.0.1.CVE-2024-6268 · Other software · lahirudanushka · reported by VulDBMedium 6.9
A vulnerability, which was classified as critical, has been found in lahirudanushka School Management System 1.0.0/1.0.1. Affected by this issue is some unknown functionality of the file login.php of the component Login Page. The manipulation of the argument email leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-269480.
Product
School Management System
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com powerful-bulb-c36.notion.site
Feb 28, 2024Cross-site scripting (XSS) vulnerability in Parents & Student Portal in Genesis School Management Systems in Genesis AIMS Student Information Systems v.3053 allCVE-2024-22936 · Other software · genesisedu · reported by MITREMedium 6.1
Cross-site scripting (XSS) vulnerability in Parents & Student Portal in Genesis School Management Systems in Genesis AIMS Student Information Systems v.3053 allows remote attackers to inject arbitrary web script or HTML via the message parameter.
Product
parent_student_portal
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Oct 16, 2023School Management System: Uses the WordPress esc_sql() function on a field not delimited by quotes and did not first prepare the queryCVE-2023-4776 · WordPress plugins & themes · reported by WPScanHigh 8.8
The School Management System WordPress plugin before 2.2.5 uses the WordPress esc_sql() function on a field not delimited by quotes and did not first prepare the query, leading to a SQL injection exploitable by relatively low-privilege users like Teachers.
Product
School Management System
Fixed in
2.2.5
What to do
Update School Management System to 2.2.5 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Nov 28, 2022SQL injection in School Management System 1.0 allows remote attackers to modify or delete data, causing persistent changes to the application's content or behavCVE-2022-36193 · Other software · Lahirudanushka · reported by MITRECritical 9.8
SQL injection in School Management System 1.0 allows remote attackers to modify or delete data, causing persistent changes to the application's content or behavior by using malicious SQL queries.
Product
School Management System
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Jul 28, 2022Advanced School Management System v1.0 was discovered to contain a cross-site scripting (XSS) vulnerability via the address parameter at ip/school/index.php.CVE-2022-34580 · Other software · Advanced School Management System Project · reported by MITREMedium 4.8
Advanced School Management System v1.0 was discovered to contain a cross-site scripting (XSS) vulnerability via the address parameter at ip/school/index.php.
Product
Advanced School Management System
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Jul 26, 2022Advanced School Management System v1.0 was discovered to contain a cross-site scripting (XSS) vulnerability via the component ip/school/moudel/update_subject.phCVE-2022-34594 · Other software · Advanced School Management System Project · reported by MITREMedium 4.8
Advanced School Management System v1.0 was discovered to contain a cross-site scripting (XSS) vulnerability via the component ip/school/moudel/update_subject.php. This vulnerability allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Edit Subject text field.
Product
Advanced School Management System
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Apr 21, 2022Car Driving School Management System v1.0 was discovered to contain a SQL injection vulnerability via /cdsms/classes/Master.php?f=delete_enrollment.CVE-2022-28413 · Other software · CAR Driving School Management System Project · reported by MITRECritical 9.8
Car Driving School Management System v1.0 was discovered to contain a SQL injection vulnerability via /cdsms/classes/Master.php?f=delete_enrollment.
Product
CAR Driving School Management System
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Apr 21, 2022Car Driving School Managment System v1.0 was discovered to contain a SQL injection vulnerability via /cdsms/classes/Master.php?f=delete_package.CVE-2022-28412 · Other software · CAR Driving School Management System Project · reported by MITRECritical 9.8
Car Driving School Managment System v1.0 was discovered to contain a SQL injection vulnerability via /cdsms/classes/Master.php?f=delete_package.
Product
CAR Driving School Management System
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Feb 28, 2022Car Driving School Management System v1.0 is affected by Cross Site Scripting (XSS) in the User Enrollment Form (Username Field).CVE-2022-24572 · Other software · CAR Driving School Management System Project · reported by MITREMedium 6.1
Car Driving School Management System v1.0 is affected by Cross Site Scripting (XSS) in the User Enrollment Form (Username Field). To exploit this Vulnerability, an admin views the registered user details.
Product
CAR Driving School Management System
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Feb 28, 2022Car Driving School Management System v1.0 is affected by SQL injection in the login page.CVE-2022-24571 · Other software · CAR Driving School Management System Project · reported by MITRECritical 9.8
Car Driving School Management System v1.0 is affected by SQL injection in the login page. An attacker can use simple SQL login injection payload to get admin access.
Product
CAR Driving School Management System
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Nov 8, 2021School Management System – WPSchoolPress: Sanitise some fields using sanitize_text_field() but does not escape them before outputting in attributesCVE-2021-24664 · WordPress plugins & themes · reported by WPScanMedium 4.8
The School Management System – WPSchoolPress WordPress plugin before 2.1.17 sanitise some fields using sanitize_text_field() but does not escape them before outputting in attributes, resulting in Stored Cross-Site Scripting issues.
Product
School Management System – WPSchoolPress
Fixed in
2.1.17
What to do
Update School Management System – WPSchoolPress to 2.1.17 or newer.
Full record and what to do →NVD record packetstormsecurity.com wpscan.com
Nov 8, 2021School Management System – WPSchoolPress: Does not properly sanitize or use prepared statements before using POST variable in SQL queriesCVE-2021-24575 · WordPress plugins & themes · reported by WPScanHigh 8.8
The School Management System – WPSchoolPress WordPress plugin before 2.1.10 does not properly sanitize or use prepared statements before using POST variable in SQL queries, leading to SQL injection in multiple actions available to various authenticated users, from simple subscribers/students to teachers and above.
Product
School Management System – WPSchoolPress
Fixed in
2.1.10
What to do
Update School Management System – WPSchoolPress to 2.1.10 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Nov 7, 2017/view/friend_profile.php in Ingenious School Management System 2.3.0 is vulnerable to Boolean-based and Time-based SQL injection in the 'friend_index' parameterCVE-2017-16561 · Other software · Ingenious School Management System Project · reported by MITRECritical 9.8
/view/friend_profile.php in Ingenious School Management System 2.3.0 is vulnerable to Boolean-based and Time-based SQL injection in the 'friend_index' parameter of a GET request.
Product
Ingenious School Management System
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record exploit-db.com exploit-db.com
Oct 29, 2017my_profile.php in Ingenious School Management System 2.3.0 allows a student or teacher to upload an arbitrary file.CVE-2017-15957 · Other software · Ingenious School Management System Project · reported by MITREHigh 8.8
my_profile.php in Ingenious School Management System 2.3.0 allows a student or teacher to upload an arbitrary file.
Product
Ingenious School Management System
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record packetstormsecurity.com exploit-db.com
Sep 27, 2017Mojoomla School Management System for WordPress allows SQL Injection via the id parameter.CVE-2017-14843 · WordPress plugins & themes · reported by MITREHigh 8.8
Mojoomla School Management System for WordPress allows SQL Injection via the id parameter.
What to do
Update the plugin to the newest version.
Full record and what to do →NVD record exploit-db.com exploit-db.com
Mar 28, 2006Cross-site scripting (XSS) vulnerability in default.asp in Caloris Planitia E-School Management System 1.0 and earlier allows remote attackers to inject arbitraCVE-2006-1418 · Other software · Caloris Planitia Technologies · reported by MITRELow 2.6
Cross-site scripting (XSS) vulnerability in default.asp in Caloris Planitia E-School Management System 1.0 and earlier allows remote attackers to inject arbitrary web script or HTML via the msg parameter.
Product
E-school Management System
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record pridels0.blogspot.com secunia.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.