Vulnerabilities
13 CVEs · NVD, GitHub Advisories, CISA KEV, FIRST EPSS, GitHub PoC repos
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2020-37088 | School ERP Pro 1.0 contains a file disclosure vulnerability that allows unauthenticated attackers to read arbitrary files by manipulating the 'document' paramet School ERP Pro 1.0 contains a file disclosure vulnerability that allows unauthenticated attackers to read arbitrary files by manipulating the 'document' parameter in download.php. Attackers can access sensitive configuration files by supplying directory traversal paths to retrieve system credentials and configuration information. NVD description · AI analysis pending | 8.7 group max | 3% | PoC |
| — | |
| CVE-2024-4824 | Vulnerability in School ERP Pro+Responsive 1.0 that allows SQL injection through the '/SchoolERP/office_admin/' index in the parameters groups_id, examname, cla Vulnerability in School ERP Pro+Responsive 1.0 that allows SQL injection through the '/SchoolERP/office_admin/' index in the parameters groups_id, examname, classes_id, es_voucherid, es_class, etc. This vulnerability could allow a remote attacker to send a specially crafted SQL query to the server and retrieve all the information stored in the database. NVD description · AI analysis pending | 9.8 group max | <1% |
| — | ||
| CVE-2022-32119 +1 in the same advisory: …32118 | Arox School ERP Pro v1.0 was discovered to contain multiple arbitrary file upload vulnerabilities via the Add Photo function at photogalleries.inc.php and the i Arox School ERP Pro v1.0 was discovered to contain multiple arbitrary file upload vulnerabilities via the Add Photo function at photogalleries.inc.php and the import staff excel function at 1finance_master.inc.php. NVD description · AI analysis pending | 8.8 group max | 2% | PoC |
| — | |
| CVE-2020-8505 +1 in the same advisory: …8504 | School Management Software PHP/mySQL through 2019-03-14 allows office_admin/?action=deleteadmin CSRF to delete a user. School Management Software PHP/mySQL through 2019-03-14 allows office_admin/?action=deleteadmin CSRF to delete a user. NVD description · AI analysis pending | 6.5 | 1% | PoC |
| — | |
| CVE-2019-13294 | AROX School-ERP Pro has a command execution vulnerability. AROX School-ERP Pro has a command execution vulnerability. import_stud.php and upload_fille.php do not have session control. Therefore an unauthenticated user can execute a command on the system. NVD description · AI analysis pending | 9.8 | 19% | PoC ×2 |
| — | |
| CVE-2017-15978 | AROX School ERP PHP Script 1.0 allows SQL Injection via the office_admin/ id parameter. AROX School ERP PHP Script 1.0 allows SQL Injection via the office_admin/ id parameter. NVD description · AI analysis pending | 9.8 | 3% | PoC |
| — |