imvks786 student_management_system vulnerabilities

A cross-site scripting vulnerability was found in the imvks786 student management system in the /add.php file. Manipulation of the name/address/fname arguments allows remote script injection. The exploit is publicly available.

In imvks786 student_management_system up to commit 9599b560ad3c3b83e75d328b76bedcd489ef1f46, a vulnerability exists in the Student Deletion Endpoint (/see.php) due to improper authorization. Manipulation of the del argument leads to unauthorized access. The attack can be initiated remotely. The exploit has been disclosed publicly and may be used. The product uses rolling release, so no version details are available. The project was informed but has not responded.

SQL injection vulnerability in imvks786 student_management_system (up to 9599b560ad3c3b83e75d328b76bedcd489ef1f46) in admin/admin_login.php via a_usr/a_pwd arguments. Remote attack possible, exploit public.

SQL injection vulnerability in imvks786 student_management_system (up to 9599b560ad3c3b83e75d328b76bedcd489ef1f46) in /index.ph via usr/pwd arguments. Remote attack, exploit public.