Vulnerabilities

kashipara Online Service Management Portal V1.0 is vulnerable to SQL Injection in /osms/Requester/Requesterchangepass.php via the parameter: rPassword.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.00487 Published 2025-05-05 No fix listed CWE-89

TI-2025-28757 CVE-2025-45320 · GHSA-w64c-qgh2-qj9c

A Directory Listing Vulnerability was found in the /osms/Requester/ directory of the…

HIGH 72

A Directory Listing Vulnerability was found in the /osms/Requester/ directory of the Kashipara Online Service Management Portal V1.0.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00407 Published 2025-05-05 No fix listed CWE-548

TI-2024-36721 CVE-2024-54938 · GHSA-wxx9-pq23-vg6j

A Directory Listing issue was found in Kashipara E-Learning Management System v1.0, which…

HIGH 72

A Directory Listing issue was found in Kashipara E-Learning Management System v1.0, which allows remote attackers to access sensitive files and directories via /admin/uploads.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00564 Published 2024-12-09 No fix listed CWE-125

TI-2024-36720 CVE-2024-54937 · GHSA-wc68-rh2f-56m4

A Directory Listing issue was found in Kashipara E-Learning Management System v1.0, which…

MEDIUM 63

A Directory Listing issue was found in Kashipara E-Learning Management System v1.0, which allows remote attackers to access sensitive files and directories via /admin/assets.

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.00474 Published 2024-12-09 No fix listed CWE-125

TI-2024-36719 CVE-2024-54936 · GHSA-pgg8-7hhg-9qjh

A Stored Cross-Site Scripting (XSS) vulnerability was found in /send_message.php of…

MEDIUM 58

A Stored Cross-Site Scripting (XSS) vulnerability was found in /send_message.php of Kashipara E-learning Management System v1.0.

CVSS 3.1MEDIUM 5.4 Network Low privileges User interaction EPSS 0.00406 Published 2024-12-09 No fix listed CWE-79

TI-2024-36718 CVE-2024-54935 · GHSA-9696-g44j-7f38

A Stored Cross-Site Scripting (XSS) vulnerability was found in…

MEDIUM 58

A Stored Cross-Site Scripting (XSS) vulnerability was found in /send_message_teacher_to_student.php of kashipara E-learning Management System v1.0.

CVSS 3.1MEDIUM 5.4 Network Low privileges User interaction EPSS 0.0039 Published 2024-12-09 No fix listed CWE-79

TI-2024-36717 CVE-2024-54934 · GHSA-5qrg-ccrj-6fg3

Kashipara E-learning Management System v1.0 is vulnerable to SQL Injection in /admin/delete_class.php.

HIGH 82

Kashipara E-learning Management System v1.0 is vulnerable to SQL Injection in /admin/delete_class.php.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.0051 Published 2024-12-09 No fix listed CWE-89

TI-2024-36716 CVE-2024-54933 · GHSA-4wg6-j4jc-xh8j

Kashipara E-learning Management System v1.0 is vulnerable to SQL Injection in /admin/delete_content.php.

HIGH 82

Kashipara E-learning Management System v1.0 is vulnerable to SQL Injection in /admin/delete_content.php.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.00493 Published 2024-12-09 No fix listed CWE-89

TI-2024-36715 CVE-2024-54932 · GHSA-38g9-r8v2-99xr

Kashipara E-learning Management System v1.0 is vulnerable to SQL Injection in /admin/delete_department.php.

HIGH 82

Kashipara E-learning Management System v1.0 is vulnerable to SQL Injection in /admin/delete_department.php.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.0051 Published 2024-12-09 No fix listed CWE-89

TI-2024-36714 CVE-2024-54931 · GHSA-856r-5w5p-h874

A SQL Injection was found in /admin/delete_event.php in kashipara E-learning Management…

HIGH 82

A SQL Injection was found in /admin/delete_event.php in kashipara E-learning Management System v1.0, which allows remote attackers to execute arbitrary SQL commands to get unauthorized database access via the id paramete…

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.006 Published 2024-12-09 No fix listed CWE-89

TI-2024-36713 CVE-2024-54930 · GHSA-6qhw-w3qj-8cf9

Kashipara E-learning Management System v1.0 is vulnerable to SQL Injection in /admin/delete_student.php.

HIGH 82

Kashipara E-learning Management System v1.0 is vulnerable to SQL Injection in /admin/delete_student.php.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.00493 Published 2024-12-09 No fix listed CWE-89

TI-2024-36712 CVE-2024-54929 · GHSA-fppg-2vjw-7hf6

KASHIPARA E-learning Management System v1.0 is vulnerable to SQL Injection in /admin/delete_subject.php.

HIGH 67

KASHIPARA E-learning Management System v1.0 is vulnerable to SQL Injection in /admin/delete_subject.php.

CVSS 3.1HIGH 7.2 Network High privileges No interaction EPSS 0.00508 Published 2024-12-09 No fix listed CWE-89

TI-2024-36711 CVE-2024-54928 · GHSA-5cj9-rv5c-h66j

kashipara E-learning Management System v1.0 is vulnerable to SQL Injection in /admin/delete_teacher.php,

LOW 34

kashipara E-learning Management System v1.0 is vulnerable to SQL Injection in /admin/delete_teacher.php,

CVSS 3.1HIGH 7.2 Network High privileges No interaction EPSS 0.00488 Published 2024-12-09 No fix listed CWE-89

TI-2024-36710 CVE-2024-54927 · GHSA-96jh-w5wq-573j

Kashipara E-learning Management System v1.0 is vulnerable to SQL Injection in /admin/delete_users.php.

HIGH 67

Kashipara E-learning Management System v1.0 is vulnerable to SQL Injection in /admin/delete_users.php.

CVSS 3.1HIGH 7.2 Network High privileges No interaction EPSS 0.00488 Published 2024-12-09 No fix listed CWE-89

TI-2024-36709 CVE-2024-54926 · GHSA-vh4h-v74p-9778

A SQL Injection vulnerability was found in /search_class.php of kashipara E-learning…

HIGH 82

A SQL Injection vulnerability was found in /search_class.php of kashipara E-learning Management System v1.0, which allows remote attackers to execute arbitrary SQL commands to get unauthorized database access via the sch…

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.00582 Published 2024-12-09 No fix listed CWE-89

TI-2024-36708 CVE-2024-54925 · GHSA-c9cj-xh7p-qvvr

A SQL Injection was found in /remove_sent_message.php in kashipara E-learning Management…

HIGH 82

A SQL Injection was found in /remove_sent_message.php in kashipara E-learning Management System v1.0, which allows remote attackers to execute arbitrary SQL commands to get unauthorized database access via the id paramet…

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.006 Published 2024-12-09 No fix listed CWE-89

TI-2024-36707 CVE-2024-54924 · GHSA-xfmg-7r6x-xpg8

A SQL Injection was found in /admin/edit_content.php in kashipara E-learning Management…

HIGH 82

A SQL Injection was found in /admin/edit_content.php in kashipara E-learning Management System v1.0, which allows remote attackers to execute arbitrary SQL commands to get unauthorized database access via the title and c…

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.006 Published 2024-12-09 No fix listed CWE-89

TI-2024-36706 CVE-2024-54923 · GHSA-3q42-g7wg-ggw3

A SQL Injection vulnerability was found in /admin/edit_teacher.php in kashipara…

HIGH 82

A SQL Injection vulnerability was found in /admin/edit_teacher.php in kashipara E-learning Management System v1.0, which allows remote attackers to execute arbitrary SQL commands to get unauthorized database access via t…

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.006 Published 2024-12-09 No fix listed CWE-89

TI-2024-36705 CVE-2024-54922 · GHSA-vq37-g99r-q77r

A SQL Injection was found in /admin/edit_user.php of kashipara E-learning Management…

HIGH 82

A SQL Injection was found in /admin/edit_user.php of kashipara E-learning Management System v1.0, which allows remote attackers to execute arbitrary SQL commands to get unauthorized database access via the firstname, las…

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.00579 Published 2024-12-09 No fix listed CWE-89

TI-2024-36704 CVE-2024-54921 · GHSA-68q5-f84h-346q

A SQL Injection was found in /student_signup.php in kashipara E-learning Management…

HIGH 82

A SQL Injection was found in /student_signup.php in kashipara E-learning Management System v1.0, which allows remote attackers to execute arbitrary SQL commands to get unauthorized database access via the username, first…

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.006 Published 2024-12-09 No fix listed CWE-89

TI-2024-36703 CVE-2024-54920 · GHSA-p55v-8989-68v9

A SQL Injection vulnerability was found in /teacher_signup.php of kashipara E-learning…

HIGH 82

A SQL Injection vulnerability was found in /teacher_signup.php of kashipara E-learning Management System v1.0, which allows remote attackers to execute arbitrary SQL command to get unauthorized database access via the fi…

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.00599 Published 2024-12-09 No fix listed CWE-89

TI-2024-36702 CVE-2024-54919 · GHSA-3vmr-3jv9-76jr

A Stored Cross Site Scripting (XSS ) was found in /teacher_avatar.php of kashipara…

MEDIUM 58

A Stored Cross Site Scripting (XSS ) was found in /teacher_avatar.php of kashipara E-learning Management System v1.0.

CVSS 3.1MEDIUM 5.4 Network Low privileges User interaction EPSS 0.00315 Published 2024-12-09 No fix listed CWE-79

TI-2024-36701 CVE-2024-54918 · GHSA-xhx6-w3cj-3336

Kashipara E-learning Management System v1.0 is vulnerable to Remote Code Execution via…

HIGH 82

Kashipara E-learning Management System v1.0 is vulnerable to Remote Code Execution via File Upload in /teacher_avatar.php.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.00924 Published 2024-12-09 No fix listed CWE-434