CVE-2024-5356

anji-plus AJ-Report testTransform;swagger-ui sql injection

A vulnerability, which was classified as critical, was found in anji-plus AJ-Report up to 1.4.1. Affected is an unknown function of the file /dataSet/testTransform;swagger-ui. The manipulation of the argument dynSentence leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-266268.

CVSS 4.0 · 5.3 Medium EPSS 1.0% KEV · Not listed

Vendors

Anji-plus

Products

Aj-report

CVE-2024-3539

Campcodes Church Management System addgiving.php sql injection

A vulnerability was found in Campcodes Church Management System 1.0. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the file /admin/addgiving.php. The manipulation of the argument amount leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-259909 was assigned to this vulnerability.

CVSS 3.1 · 6.3 Medium EPSS < 1% KEV · Not listed

Vendors

Campcodes

Products

Church Management System

CVE-2024-32838

Apache Fineract: SQL injection vulnerabilities in offices API endpoint

SQL Injection vulnerability in various API endpoints - offices, dashboards, etc. Apache Fineract versions 1.9 and before have a vulnerability that allows an authenticated attacker to inject malicious data into some of the REST API endpoints' query parameter.  Users are recommended to upgrade to version 1.10.1, which fixes this issue. A SQL Validator has been implemented which allows us to configure a series of tests and checks against our SQL queries that will allow us to validate and protect against nearly all potential SQL injection attacks.

CVSS 4.0 · 9.4 Critical EPSS 1.5% KEV · Not listed

Vendors

Apache

Products

Fineract

CVE-2024-5104

Campcodes Complete Web-Based School Management System student_grade_wise.php sql injection

A vulnerability was found in Campcodes Complete Web-Based School Management System 1.0. It has been rated as critical. Affected by this issue is some unknown functionality of the file /view/student_grade_wise.php. The manipulation of the argument grade leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. VDB-265094 is the identifier assigned to this vulnerability.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Campcodes

Products

Complete Web-based School Management System

CVE-2024-5105

Campcodes Complete Web-Based School Management System student_payment_details.php sql injection

A vulnerability classified as critical has been found in Campcodes Complete Web-Based School Management System 1.0. This affects an unknown part of the file /view/student_payment_details.php. The manipulation of the argument index leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-265095.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Campcodes

Products

Complete Web-based School Management System

CVE-2024-3771

PHPGurukul Student Record System edit-subject.php sql injection

A vulnerability was found in PHPGurukul Student Record System 3.20 and classified as critical. Affected by this issue is some unknown functionality of the file /edit-subject.php. The manipulation of the argument sub1/sub2/sub3/sub4/udate leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. VDB-260618 is the identifier assigned to this vulnerability.

CVSS 3.1 · 6.3 Medium EPSS < 1% KEV · Not listed

Vendors

Phpgurukul

Products

Student Record System

CVE-2024-3523

Campcodes Online Event Management System index.php sql injection

A vulnerability classified as critical was found in Campcodes Online Event Management System 1.0. This vulnerability affects unknown code of the file /views/index.php. The manipulation of the argument ID leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. VDB-259894 is the identifier assigned to this vulnerability.

CVSS 3.1 · 6.3 Medium EPSS < 1% KEV · Not listed

Vendors

Campcodes

Products

Online Event Management System

CVE-2024-3770

PHPGurukul Student Record System sql injection

A vulnerability has been found in PHPGurukul Student Record System 3.20 and classified as critical. Affected by this vulnerability is an unknown functionality of the file /manage-courses.php?del=1. The manipulation of the argument del leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-260617 was assigned to this vulnerability.

CVSS 3.1 · 6.3 Medium EPSS < 1% KEV · Not listed

Vendors

Phpgurukul

Products

Student Record System

CVE-2024-5234

Campcodes Complete Web-Based School Management System teacher_salary_history1.php sql injection

A vulnerability was found in Campcodes Complete Web-Based School Management System 1.0. It has been rated as critical. This issue affects some unknown processing of the file /view/teacher_salary_history1.php. The manipulation of the argument index leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-265985 was assigned to this vulnerability.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Campcodes

Products

Complete Web-based School Management System

CVE-2024-5106

Campcodes Complete Web-Based School Management System student_payment_details3.php sql injection

A vulnerability classified as critical was found in Campcodes Complete Web-Based School Management System 1.0. This vulnerability affects unknown code of the file /view/student_payment_details3.php. The manipulation of the argument index leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-265096.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Campcodes

Products

Complete Web-based School Management System

CVE-2024-3535

Campcodes Church Management System index.php sql injection

A vulnerability, which was classified as critical, was found in Campcodes Church Management System 1.0. This affects an unknown part of the file /admin/index.php. The manipulation of the argument password leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-259905 was assigned to this vulnerability.

CVSS 3.1 · 7.3 High EPSS 1.1% KEV · Not listed

Vendors

Campcodes

Products

Church Management System

CVE-2024-12938

code-projects Simple Admin Panel updateOrderStatus.php sql injection

A vulnerability has been found in code-projects Simple Admin Panel 1.0 and classified as critical. Affected by this vulnerability is an unknown functionality of the file updateOrderStatus.php. The manipulation of the argument record leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Code-projects

Products

Simple Admin Panel

CVE-2024-3522

Campcodes Online Event Management System process.php sql injection

A vulnerability classified as critical has been found in Campcodes Online Event Management System 1.0. This affects an unknown part of the file /api/process.php. The manipulation of the argument userId leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-259893 was assigned to this vulnerability.

CVSS 3.1 · 6.3 Medium EPSS < 1% KEV · Not listed

Vendors

Campcodes

Products

Online Event Management System

CVE-2024-5063

PHPGurukul Online Course Registration System index.php sql injection

A vulnerability was found in PHPGurukul Online Course Registration System 3.1. It has been declared as critical. This vulnerability affects unknown code of the file /admin/index.php. The manipulation of the argument username/password leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. VDB-264922 is the identifier assigned to this vulnerability.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed

Vendors

Phpgurukul

Products

Online Course Registration System

CVE-2024-5103

Campcodes Complete Web-Based School Management System student_first_payment.php sql injection

A vulnerability was found in Campcodes Complete Web-Based School Management System 1.0. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the file /view/student_first_payment.php. The manipulation of the argument grade leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-265093 was assigned to this vulnerability.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Campcodes

Products

Complete Web-based School Management System

CVE-2024-5240

Campcodes Complete Web-Based School Management System unread_msg.php sql injection

A vulnerability was found in Campcodes Complete Web-Based School Management System 1.0 and classified as critical. This issue affects some unknown processing of the file /view/unread_msg.php. The manipulation of the argument my_index leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-265991.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Campcodes

Products

Complete Web-based School Management System

CVE-2024-3540

Campcodes Church Management System add_sundaysch.php sql injection

A vulnerability was found in Campcodes Church Management System 1.0. It has been rated as critical. Affected by this issue is some unknown functionality of the file /admin/add_sundaysch.php. The manipulation of the argument Gender leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. VDB-259910 is the identifier assigned to this vulnerability.

CVSS 3.1 · 6.3 Medium EPSS < 1% KEV · Not listed

Vendors

Campcodes

Products

Church Management System

CVE-2024-3537

Campcodes Church Management System admin_user.php sql injection

A vulnerability was found in Campcodes Church Management System 1.0 and classified as critical. This issue affects some unknown processing of the file /admin/admin_user.php. The manipulation of the argument firstname leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-259907.

CVSS 3.1 · 6.3 Medium EPSS < 1% KEV · Not listed

Vendors

Campcodes

Products

Church Management System

CVE-2024-37906

Admidio has Blind SQL Injection in ecard_send.php

Admidio is a free, open source user management system for websites of organizations and groups. In Admidio before version 4.3.9, there is an SQL Injection in the `/adm_program/modules/ecards/ecard_send.php` source file of the Admidio Application. The SQL Injection results in a compromise of the application's database. The value of `ecard_recipients `POST parameter is being directly concatenated with the SQL query in the source code causing the SQL Injection. The SQL Injection can be exploited by a member user, using blind condition-based, time-based, and Out of band interaction SQL Injection payloads. This vulnerability is fixed in 4.3.9.

CVSS 3.1 · 10 Critical EPSS < 1% KEV · Not listed

Vendors

Admidio

Products

Admidio

CVE-2024-5237

Campcodes Complete Web-Based School Management System timetable_grade_wise.php sql injection

A vulnerability, which was classified as critical, has been found in Campcodes Complete Web-Based School Management System 1.0. Affected by this issue is some unknown functionality of the file /view/timetable_grade_wise.php. The manipulation of the argument grade leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-265988.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Campcodes

Products

Complete Web-based School Management System