Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 5

CVE-2026-124502

yungifez Skuul School Management System Delete GraduationController.php resetGraduation authorization

A security vulnerability has been detected in yungifez Skuul School Management System up to 2.6.3. Affected by this vulnerability is the function GraduationController::resetGraduation of the file app/Http/Controllers/GraduationController.php of the component Delete Handler. Such manipulation of the argument student leads to missing authorization. The attack can be executed remotely. The exploit has been disclosed publicly and may be used. Upgrading to version 3.0.0 addresses this issue. The name of the patch is b42f2c80a8e5e01ca6e607bbd97f137ede368ac9. The affected component should be upgraded.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Yungifez
Products
Skuul School Management System
CVE-2026-117028

Unauthorized Student Result Disclosure via Incorrect Access Control in Skuul 2.6.5

Skuul School Management System through version 2.6.5 is vulnerable to incorrect access control in the ResultChecker::checkResult method. An authenticated student can manipulate the studentId parameter to retrieve another student's examination results, including examination marks, without authorization.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed
Vendors
Yungifez
Products
Skuul School Management System
CVE-2025-12918

yungifez Skuul School Management System View Fee Invoice fee-invoices resource injection

A security flaw has been discovered in yungifez Skuul School Management System up to 2.6.5. The impacted element is an unknown function of the file /dashboard/fees/fee-invoices/ of the component View Fee Invoice. Performing manipulation of the argument invoice_id results in improper control of resource identifiers. Remote exploitation of the attack is possible. The attack is considered to have high complexity. The exploitability is regarded as difficult. The exploit has been released to the public and may be exploited. The vendor was contacted early about this disclosure but did not respond in any way.

CVSS 4.0 · 2.3 Low EPSS < 1% KEV · Not listed
Vendors
Yungifez
Products
Skuul Skuul School Management System
CVE-2025-13785

yungifez Skuul School Management System Image profile information disclosure

A security vulnerability has been detected in yungifez Skuul School Management System up to 2.6.5. This issue affects some unknown processing of the file /user/profile of the component Image Handler. Such manipulation leads to information disclosure. The attack may be performed from remote. The exploit has been disclosed publicly and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Yungifez
Products
Skuul Skuul School Management System
CVE-2025-13784

yungifez Skuul School Management System SVG File edit cross site scripting

A weakness has been identified in yungifez Skuul School Management System up to 2.6.5. This vulnerability affects unknown code of the file /dashboard/schools/1/edit of the component SVG File Handler. This manipulation causes cross site scripting. The attack is possible to be carried out remotely. The exploit has been made available to the public and could be exploited. The vendor was contacted early about this disclosure but did not respond in any way.

CVSS 4.0 · 4.8 Medium EPSS < 1% KEV · Not listed
Vendors
Yungifez
Products
Skuul Skuul School Management System