stumasy vulnerabilities

A vulnerability was found in mjperpinosa stumasy up to commit 327d1b0f2915ba79d7ef8ebb74553e987609d9be. An unknown function in /PHP/objects/notes within the Note Handler/Assignment Handler component allows authorization bypass via manipulation of the assignment_item_id argument. The attack is remotely exploitable and the exploit is public.

A SQL injection vulnerability has been found in mjperpinosa stumasy up to commit 327d1b0f2915ba79d7ef8ebb74553e987609d9be in the Notes_controller::search_scratch_data function. The attack can be launched remotely by manipulating the field_name argument. The exploit is publicly available, increasing the risk of exploitation.

A vulnerability was found in mjperpinosa stumasy up to version 327d1b0f2915ba79d7ef8ebb74553e987609d9be in the eval function of calculate.php. Manipulating the mathematical_sentence argument allows remote code injection. The exploit is publicly available and may be used.

A vulnerability was found in mjperpinosa's stumasy application in an unknown function of the file application/PHP/objects/profiles/change_profile_image.php. Manipulating the pr_profile_image argument leads to unrestricted file upload. The attack can be launched remotely and the exploit has been publicly disclosed.

A vulnerability was found in mjperpinosa's stumasy application in an unknown function of the file application/PHP/objects/updates/add_post.php. Manipulating the up_file_to_post argument results in unrestricted file upload. The attack can be initiated remotely and the exploit has been made public.