Vulnerabilities

TI-2024-22381 CVE-2024-33911 · GHSA-j847-crmf-8mpc

WordPress The School Management Pro plugin <= 10.3.4 - SQL Injection vulnerability

LOW 35

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Weblizar School Management Pro.This issue affects School Management Pro: from n/a through 10.3.4.

CVSS 3.1HIGH 7.6 Network High privileges No interaction EPSS 0.01094 Published 2024-05-02 No fix listed CWE-89

TI-2022-01479 CVE-2022-1609 · GHSA-4g99-5gw9-42hv

The School Management < 9.9.7 - Unauthenticated RCE via REST api

HIGH 84

The School Management WordPress plugin before 9.9.7 contains an obfuscated backdoor injected in it's license checking code that registers a REST API handler, allowing an unauthenticated attacker to execute arbitrary PHP…

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.64075 Published 2024-01-16 Fixed in 9.9.7 CWE-94

Vulnerabilities

Filters

WordPress The School Management Pro plugin <= 10.3.4 - SQL Injection vulnerability

The School Management < 9.9.7 - Unauthenticated RCE via REST api