SourceCodester Online Employees Work From Home Attendance System v1.0 is vulnerable to SQL Injection in the file /wfh_attendance/admin/attendance_list.php.
SourceCodester Online Employees Work From Home Attendance System v1.0 is vulnerable to SQL Injection in the file /wfh_attendance/admin/manage_department.php.
SourceCodester Online Employees Work From Home Attendance System v1.0 is vulnerable to SQL Injection in the file /wfh_attendance/admin/manage_employee.php.
SourceCodester Online Employees Work From Home Attendance System v1.0 is vulnerable to SQL Injection in the file /wfh_attendance/admin/view_employee.php.
A vulnerability was identified in CodeAstro Online Job Portal 1.0. The impacted element is an unknown function of the file /jobs/job-delete.php of the component Delete Job Posting Handler. Such manipulation of the argument ID leads to improper access controls. The attack can be launched remotely. The exploit is publicly available and might be used.
In Phpgurukul Online Course Registration v3.1, an arbitrary file upload vulnerability was discovered within the profile picture upload functionality on the /my-profile.php page.
Sourcecodester Online Thesis Archiving System v1.0 contains a low-severity SQL injection vulnerability in the file /otas/admin/curriculum/manage_curriculum.php. This vulnerability allows an attacker with high privileges to inject SQL commands, potentially leading to limited data disclosure. No known exploits or patches are currently documented for this issue.
Sourcecodester Online Thesis Archiving System version 1.0 contains a SQL injection vulnerability in the /otas/projects_per_department.php script. This vulnerability allows an attacker with high privileges to inject SQL code, potentially leading to limited confidentiality impact. The vulnerability has a low CVSS score of 2.7 and does not affect integrity or availability. No official patch or remediation guidance is currently available, and no known exploits are reported in the wild.
Sourcecodester Online Thesis Archiving System v1.0 contains a SQL injection vulnerability in the /otas/view_archive.php file. This vulnerability allows an unauthenticated attacker to execute arbitrary SQL commands, potentially leading to data disclosure, modification, or denial of service. The vulnerability has a CVSS v3.1 base score of 7.3, indicating high severity. No official patch or remediation information is currently available. There are no known exploits in the wild at this time.
The Tutor LMS – eLearning and online course solution plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 3.9.7. This is due to missing authorization checks in the `save_course_content_order()` private method, which is called unconditionally by the `tutor_update_course_content_order` AJAX handler. While the handler's `content_parent` branch includes a `can_user_manage()` check, the `save_course_content_order()` call processes attacker-supplied `tutor_topics_lessons_sorting` JSON without any ownership or capability verification. This makes it possible for authenticated attackers with Subscriber-level access or above to detach lessons from topics, reorder course content, and reassign lessons between topics in any course, including admin-owned courses, by sending a crafted AJAX request with manipulated topic and lesson IDs.
The LifterLMS plugin for WordPress is vulnerable to SQL Injection via the 'order' parameter in all versions up to, and including, 9.2.1. This is due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with Instructor-level access and above who have the edit_post capability on the quiz, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
Step CA is an online certificate authority for secure, automated certificate management for DevOps. From 0.24.0 to before 0.30.0-rc3, an attacker can trigger an index out-of-bounds panic in Step CA by sending a crafted attestation key (AK) certificate with an empty Extended Key Usage (EKU) extension during TPM device attestation. When processing a device-attest-01 ACME challenge using TPM attestation, Step CA validates that the AK certificate contains the tcg-kp-AIKCertificate Extended Key Usage OID. During this validation, the EKU extension value is decoded from its ASN.1 representation and the first element is checked. A crafted certificate could include an EKU extension that decodes to an empty sequence, causing the code to panic when accessing the first element of the empty slice. This vulnerability is only reachable when a device-attest-01 ACME challenge with TPM attestation is configured. Deployments not using TPM device attestation are not affected. This vulnerability is fixed in 0.30.0-rc3.
CVE-2026-6033 is a medium severity SQL injection vulnerability in CodeAstro Online Classroom version 1.0. It affects an unknown function in the file /updatedetailsfromstudent.php via manipulation of the 'fname' parameter. The vulnerability can be exploited remotely without user interaction or elevated privileges. Although the exploit has been publicly disclosed, there are no known exploits in the wild at this time. No official patch or remediation guidance has been provided by the vendor yet.