Vulnerabilities (CVE)

Join the Common Vulnerabilities and Exposures (CVE) community and start to get notified about new vulnerabilities.

Filtered by vendor Engineers Online Portal Project Subscribe
Total 8 CVE
CVE Vendors Products Updated CVSS v2 CVSS v3
CVE-2021-42671 1 Engineers Online Portal Project 1 Engineers Online Portal 2022-07-12 5.0 MEDIUM 7.5 HIGH
An incorrect access control vulnerability exists in Sourcecodester Engineers Online Portal in PHP in nia_munoz_monitoring_system/admin/uploads. An attacker can leverage this vulnerability in order to bypass access controls and access all the files uploaded to the web server without the need of authentication or authorization.
CVE-2021-43437 1 Engineers Online Portal Project 1 Engineers Online Portal 2022-01-03 6.8 MEDIUM 8.8 HIGH
In sourcecodetester Engineers Online Portal as of 10-21-21, an attacker can manipulate the Host header as seen by the web application and cause the application to behave in unexpected ways. Very often multiple websites are hosted on the same IP address. This is where the Host Header comes in. This header specifies which website should process the HTTP request. The web server uses the value of this header to dispatch the request to the specified website. Each website hosted on the same IP address is called a virtual host. And It's possible to send requests with arbitrary Host Headers to the first virtual host.
CVE-2021-42668 1 Engineers Online Portal Project 1 Engineers Online Portal 2021-12-16 7.5 HIGH 9.8 CRITICAL
A SQL Injection vulnerability exists in Sourcecodester Engineers Online Portal in PHP via the id parameter in the my_classmates.php web page.. As a result, an attacker can extract sensitive data from the web server and in some cases can use this vulnerability in order to get a remote code execution on the remote web server.
CVE-2021-42666 1 Engineers Online Portal Project 1 Engineers Online Portal 2021-11-30 6.5 MEDIUM 8.8 HIGH
A SQL Injection vulnerability exists in Sourcecodester Engineers Online Portal in PHP via the id parameter to quiz_question.php, which could let a malicious user extract sensitive data from the web server and in some cases use this vulnerability in order to get a remote code execution on the remote web server.
CVE-2021-42669 1 Engineers Online Portal Project 1 Engineers Online Portal 2021-11-29 10.0 HIGH 9.8 CRITICAL
A file upload vulnerability exists in Sourcecodester Engineers Online Portal in PHP via dashboard_teacher.php, which allows changing the avatar through teacher_avatar.php. Once an avatar gets uploaded it is getting uploaded to the /admin/uploads/ directory, and is accessible by all users. By uploading a php webshell containing "<?php system($_GET["cmd"]); ?>" the attacker can execute commands on the web server with - /admin/uploads/php-webshell?cmd=id.
CVE-2021-42665 1 Engineers Online Portal Project 1 Engineers Online Portal 2021-11-23 7.5 HIGH 9.8 CRITICAL
An SQL Injection vulnerability exists in Sourcecodester Engineers Online Portal in PHP via the login form inside of index.php, which can allow an attacker to bypass authentication.
CVE-2021-42664 1 Engineers Online Portal Project 1 Engineers Online Portal 2021-11-16 3.5 LOW 5.4 MEDIUM
A Stored Cross Site Scripting (XSS) Vulneraibiilty exists in Sourcecodester Engineers Online Portal in PHP via the (1) Quiz title and (2) quiz description parameters to add_quiz.php. An attacker can leverage this vulnerability in order to run javascript commands on the web server surfers behalf, which can lead to cookie stealing and more.
CVE-2021-42670 1 Engineers Online Portal Project 1 Engineers Online Portal 2021-11-16 7.5 HIGH 9.8 CRITICAL
A SQL injection vulnerability exists in Sourcecodester Engineers Online Portal in PHP via the id parameter to the announcements_student.php web page. As a result a malicious user can extract sensitive data from the web server and in some cases use this vulnerability in order to get a remote code execution on the remote web server.