Cybershailendra

A weakness has been identified in projectworlds Advanced Library Management System 1.0. Impacted is the function mysqli query of the file report search.php. Executing a manipulation of the argument dateto/datefrom can lead to sql injection. The attack can be executed remotely. The exploit has been made available to the public and could be used for attacks.

**Name of the Vulnerable Software and Affected Versions** PHPGurukul User Registration & Login and User Management System version 3.3 **Description** An issue exists in the Change Password Handler component within the file `loginsystem/admin/change-password.php`. Manipulation of the `currentpassword` argument allows for incorrect authorization, which can be exploited remotely. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

A vulnerability was determined in projectworlds Online Examination System 1.0. The affected element is an unknown function of the file feedback.php of the component Feedback Form. Executing a manipulation of the argument Name/Subject can lead to cross site scripting. The attack may be launched remotely. The exploit has been publicly disclosed and may be utilized.

**Name of the Vulnerable Software and Affected Versions** Projectwolds Online Attendance System version 1.0 **Description** A remote cross-site scripting issue exists in the `profile.php` file. The flaw allows for the manipulation of the `email` variable to execute malicious scripts in the context of the user's browser. **Recommendations** As a temporary workaround, restrict access to the `profile.php` file or avoid using the `email` parameter until a fix is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.