Gscsd

**Name of the Vulnerable Software and Affected Versions** mjperpinosa stumasy versions up to 327d1b0f2915ba79d7ef8ebb74553e987609d9be **Description** A remote code injection issue exists due to the improper handling of the `mathematical sentence` argument within the `eval()` function located in the application/pages/imba calculator/calculate.php file. **Recommendations** As a temporary workaround, restrict access to the `eval()` function in the application/pages/imba calculator/calculate.php file or avoid using the `mathematical sentence` argument until a fix is released. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** mjperpinosa stumasy versions up to 327d1b0f2915ba79d7ef8ebb74553e987609d9be **Description** A remote SQL injection occurs due to the improper handling of the `Password` argument within the `Notes controller::accessing dictionary authorization()` function located in the application/PHP/objects/notes/accessing dictionary authorization.php file. SQL injection is a technique where an attacker inserts malicious SQL code into a query, allowing them to manipulate the database. **Recommendations** As a temporary workaround, consider restricting access to the `Notes controller::accessing dictionary authorization()` function until a patch is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** mjperpinosa stumasy versions up to 327d1b0f2915ba79d7ef8ebb74553e987609d9be **Description** An authorization bypass exists in the Note Handler/Assignment Handler component within the `/PHP/objects/notes` file. A remote attacker can trigger this issue by manipulating the `assignment item id` argument. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** a4m4 Student-Management-System versions up to f0c5f6842c5e8c431ff02b5260a565ca844df3a0 **Description** A flaw in the Admin Endpoint component, specifically within the `admin/` file, allows remote attackers to cause execution after redirect. This occurs through the manipulation of the `uid` argument across multiple endpoints. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.