Geraldo Alcântara

The issue allows a remote attacker to escalate privileges via a crafted script using parameters such as `firstname`, `lastname`, `middlename`, `contact`, and `address`.

A Cross Site Scripting (XSS) issue allows a remote attacker to execute arbitrary code via a crafted payload to the main settings component in the `phone`, `address`, `bank`, `acc name`, `acc number` parameters, `new class` and `cname` parameter, `add new parent` function in the `name` and `email` parameters, `new term` function in the `tname` parameter, and the `edit student` function in the `name` parameter.

The issue allows a remote attacker to execute arbitrary code via a crafted payload to the `id` parameter in the "student form.php" and "class form.php" pages. This enables the attacker to inject malicious SQL code, potentially leading to unauthorized access or data manipulation.

A Cross Site Scripting (XSS) issue allows a remote attacker to execute arbitrary code via a crafted payload to the `page` or `class month` parameter in the "/php-attendance/attendance report" component. This enables the attacker to perform unauthorized actions on the system.

The issue concerns multiple SQL injection vulnerabilities in the /customer support/ajax.php?action=save ticket endpoint via `department id`, `customer id`, and `subject`. This allows for potential exploitation.

The issue is related to a SQL injection vulnerability. This vulnerability can be exploited via the `email` parameter at the "/customer support/ajax.php" API endpoint.

The issue is related to a SQL injection vulnerability. This vulnerability can be exploited via the `username` parameter at the "/customer support/ajax.php?action=login" API endpoint.

The issue is related to a SQL injection vulnerability. This vulnerability can be exploited via the `lastname` parameter at the "/customer support/ajax.php?action=save user" API endpoint.

The issue is related to a SQL injection vulnerability. This vulnerability can be exploited via the `id` parameter at the "/customer support/manage department.php" API endpoint.

The issue is related to a SQL injection vulnerability. This vulnerability can be exploited via the `id` parameter at the "/customer support/index.php?page=edit customer" API endpoint.

The issue is related to a SQL injection vulnerability. This vulnerability can be exploited via the `subject` parameter at the "/customer support/ajax.php?action=save ticket" API endpoint.

A cross-site scripting (XSS) issue allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the `firstname` parameter at "/customer support/index.php?page=customer list".

A cross-site scripting (XSS) issue allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the `email` parameter at "/customer support/index.php?page=customer list". This enables attackers to potentially steal user data or take control of user sessions.

A cross-site scripting (XSS) issue allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the `contact` parameter at "/customer support/index.php?page=customer list".

A cross-site scripting (XSS) issue allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the `subject` parameter at "/customer support/index.php?page=new ticket".

A cross-site scripting (XSS) issue allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the `address` parameter at "/customer support/index.php?page=new customer".

The issue allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the `category` parameter in the "/bsms ci/index.php/category" API endpoint. This enables the execution of malicious code on the client-side.

A directory listing issue allows attackers to list directories and sensitive files within the application without requiring authorization.

A directory listing issue allows attackers to list directories and sensitive files within the application without requiring authorization.

A directory listing issue allows attackers to list directories and sensitive files within the application without requiring authorization.