CVE-2024-28094: falha de alta gravidade em Schoolbox
Blind SQL Injection in Chat functionality in Schoolbox
Publicada em · Atualizada em
21Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Trackcvss 8.8epss 0.6%
probabilidade de exploração
0.6%top 56% das CVEs
exploração observada
nãonenhuma fonte reporta
Chat functionality in Schoolbox application before
version 23.1.3 is vulnerable to blind SQL Injection enabling the
authenticated attackers to read, modify, and delete database records.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Produtos afetados
Schoolbox Pty Ltd · SchoolboxCVEs relacionadas — Schoolbox
No mesmo produto, das mais perigosas para as menos.
CVE-2022-3059HIGHSQL injection in Schoolbox version 21.0.2, by Schoolbox Pty LtdEPSS 0.5%CVE-2022-39020HIGHCross-site scripting in Schoolbox version 21.0.2, by Schoolbox Pty LtdEPSS 0.4%CVE-2024-28097HIGHStored Cross-site Scripting in Calendar functionality in SchoolboxEPSS 0.4%CVE-2024-28096HIGHStored Cross-site Scripting in Class functionality in SchoolboxEPSS 0.4%CVE-2024-28095HIGHStored Cross-site Scripting in News functionality in SchoolboxEPSS 0.3%