Fabian Ros Scholars Tracking System 1.0

code-projects Community Project Scholars Tracking System 1.0 is vulnerable to SQL Injection in the admin user management endpoints /admin/save_user.php and /admin/update_user.php. These endpoints lack authentication checks and directly concatenate user-supplied POST parameters (firstname, lastname, username, password, user_id) into SQL queries without validation or parameterization.

Published: 2026-02-18T00:00:00.000Z
Updated: 2026-02-18T18:06:19.419Z

code-projects Scholars Tracking System 1.0 allows an authenticated attacker to achieve remote code execution via unrestricted file upload. The endpoints update_profile_picture.php and upload_picture.php store uploaded files in a web-accessible uploads/ directory using the original, user-supplied filename without validating the file type or extension. By uploading a PHP file and then requesting it from /uploads/, an attacker can execute arbitrary PHP code as the web server user.

Published: 2026-02-18T00:00:00.000Z
Updated: 2026-02-18T18:22:07.589Z

A security vulnerability has been detected in code-projects Scholars Tracking System 1.0. The impacted element is an unknown function of the file /home.php. Such manipulation of the argument post_content leads to sql injection. The attack can be executed remotely. The exploit has been disclosed publicly and may be used.

Published: 2025-12-19T14:32:06.003Z
Updated: 2026-02-24T05:56:19.799Z

A weakness has been identified in code-projects Scholars Tracking System 1.0. The affected element is an unknown function of the file /delete_post.php. This manipulation of the argument ID causes sql injection. Remote exploitation of the attack is possible. The exploit has been made available to the public and could be used for attacks.

Published: 2025-12-19T13:32:06.549Z
Updated: 2026-02-24T05:56:08.240Z

A vulnerability was determined in code-projects Scholars Tracking System 1.0. The affected element is an unknown function of the file /admin/delete_user.php. This manipulation of the argument ID causes sql injection. It is possible to initiate the attack remotely. The exploit has been publicly disclosed and may be utilized.

Published: 2025-12-19T04:02:08.625Z
Updated: 2026-02-24T05:55:55.720Z

Code-projects Scholars Tracking System 1.0 is vulnerable to SQL Injection via the News Feed.

Published: 2024-03-05T00:00:00.000Z
Updated: 2024-08-08T20:40:59.669Z