CVE-2024-28094: fallo de gravedad alta en Schoolbox
Blind SQL Injection in Chat functionality in Schoolbox
Publicada el · Actualizada el
21Vexday Risk Score
Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.
ssvc Trackcvss 8.8epss 0.6%
probabilidad de explotación
0.6%top 56% de las CVE
explotación observada
noninguna fuente lo reporta
Chat functionality in Schoolbox application before
version 23.1.3 is vulnerable to blind SQL Injection enabling the
authenticated attackers to read, modify, and delete database records.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Productos afectados
Schoolbox Pty Ltd · SchoolboxCVEs relacionadas — Schoolbox
En el mismo producto, de las más peligrosas a las menos.
CVE-2022-3059HIGHSQL injection in Schoolbox version 21.0.2, by Schoolbox Pty LtdEPSS 0.5%CVE-2022-39020HIGHCross-site scripting in Schoolbox version 21.0.2, by Schoolbox Pty LtdEPSS 0.4%CVE-2024-28097HIGHStored Cross-site Scripting in Calendar functionality in SchoolboxEPSS 0.4%CVE-2024-28096HIGHStored Cross-site Scripting in Class functionality in SchoolboxEPSS 0.4%CVE-2024-28095HIGHStored Cross-site Scripting in News functionality in SchoolboxEPSS 0.3%