Vulnerabilities

TI-2018-13306 CVE-2018-18795 · GHSA-ggq7-fjr5-3jwp

School Event Management System 1.0 has SQL Injection via the student/index.php or event/index.php id parameter.

MEDIUM 48

School Event Management System 1.0 has SQL Injection via the student/index.php or event/index.php id parameter.

CVSS 3.0CRITICAL 9.8 Network No auth No interaction EPSS 0.03213 Published 2018-11-16 No fix listed CWE-89

TI-2018-13305 CVE-2018-18794 · GHSA-qh8v-p36x-mcqv

MEDIUM 43

School Event Management System 1.0 allows CSRF via user/controller.php?action=edit.

CVSS 3.0HIGH 8.8 Network No auth User interaction EPSS 0.02385 Published 2018-11-16 No fix listed CWE-352

TI-2018-13304 CVE-2018-18793 · GHSA-g8pf-x7gv-62xv

MEDIUM 54

School Event Management System 1.0 allows Arbitrary File Upload via event/controller.php?action=photos.

CVSS 3.0CRITICAL 9.8 Network No auth No interaction EPSS 0.09504 Published 2018-11-16 No fix listed CWE-434