Geraldo Alcântara

A vulnerabilidade permite que um invasor remoto obtenha privilégios elevados por meio de um script malicioso que utilize parâmetros como `firstname`, `lastname`, `middlename`, `contact` e `address`.

Uma vulnerabilidade de Cross Site Scripting (XSS) permite que um invasor remoto execute código arbitrário por meio de uma carga maliciosa direcionada ao componente `main settings` nos parâmetros `phone`, `address`, `bank`, `acc name`, `acc number`, `new class` e `cname`, função `add new parent` nos parâmetros `name` e `email`, função `new term` no parâmetro `tname` e função `edit student` no parâmetro `name`.

A vulnerabilidade permite que um invasor remoto execute código arbitrário por meio de uma carga maliciosa direcionada ao parâmetro `id` nas páginas “student form.php” e “class form.php”. Isso permite que o invasor injete código SQL malicioso, o que pode levar a acesso não autorizado ou manipulação de dados.

Uma vulnerabilidade de Cross Site Scripting (XSS) permite que um invasor remoto execute código arbitrário por meio de uma carga maliciosa direcionada aos parâmetros `page` ou `class month` no componente “/php-attendance/attendance report”. Isso permite que o invasor realize ações não autorizadas no sistema.

The issue concerns multiple SQL injection vulnerabilities in the /customer support/ajax.php?action=save ticket endpoint via `department id`, `customer id`, and `subject`. This allows for potential exploitation.

The issue is related to a SQL injection vulnerability. This vulnerability can be exploited via the `email` parameter at the "/customer support/ajax.php" API endpoint.

The issue is related to a SQL injection vulnerability. This vulnerability can be exploited via the `username` parameter at the "/customer support/ajax.php?action=login" API endpoint.

The issue is related to a SQL injection vulnerability. This vulnerability can be exploited via the `lastname` parameter at the "/customer support/ajax.php?action=save user" API endpoint.

The issue is related to a SQL injection vulnerability. This vulnerability can be exploited via the `id` parameter at the "/customer support/manage department.php" API endpoint.

The issue is related to a SQL injection vulnerability. This vulnerability can be exploited via the `id` parameter at the "/customer support/index.php?page=edit customer" API endpoint.

The issue is related to a SQL injection vulnerability. This vulnerability can be exploited via the `subject` parameter at the "/customer support/ajax.php?action=save ticket" API endpoint.

A cross-site scripting (XSS) issue allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the `firstname` parameter at "/customer support/index.php?page=customer list".

A cross-site scripting (XSS) issue allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the `email` parameter at "/customer support/index.php?page=customer list". This enables attackers to potentially steal user data or take control of user sessions.

A cross-site scripting (XSS) issue allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the `contact` parameter at "/customer support/index.php?page=customer list".

A cross-site scripting (XSS) issue allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the `subject` parameter at "/customer support/index.php?page=new ticket".

A cross-site scripting (XSS) issue allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the `address` parameter at "/customer support/index.php?page=new customer".

The issue allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the `category` parameter in the "/bsms ci/index.php/category" API endpoint. This enables the execution of malicious code on the client-side.

A directory listing issue allows attackers to list directories and sensitive files within the application without requiring authorization.

A directory listing issue allows attackers to list directories and sensitive files within the application without requiring authorization.

A directory listing issue allows attackers to list directories and sensitive files within the application without requiring authorization.