Filtered by vendor Schoolcms Subscriptions
Filtered by product Schoolcms Subscriptions
Total 5 CVE
CVE Vendors Products Updated CVSS v3.1
CVE-2025-4795 1 Schoolcms 1 Schoolcms 2025-11-10 4.7 Medium
A vulnerability classified as critical has been found in gongfuxiang schoolcms 2.3.1. This affects the function SaveInfo of the file /index.php?m=Admin&c=article&a=SaveInfo. The manipulation of the argument ID leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.
CVE-2019-9572 1 Schoolcms 1 Schoolcms 2024-11-21 N/A
SchoolCMS version 2.3.1 allows file upload via the theme upload feature at admin.php?m=admin&c=theme&a=upload by using the .zip extension along with the _Static substring, changing the Content-Type to application/zip, and placing PHP code after the ZIP header. This ultimately allows execution of arbitrary PHP code in Public\Home\1_Static.php because of mishandling in the Application\Admin\Controller\ThemeController.class.php Upload() function.
CVE-2019-9181 1 Schoolcms 1 Schoolcms 2024-11-21 N/A
SchoolCMS version 2.3.1 allows file upload via the logo upload feature at admin.php?m=admin&c=site&a=save by using the .jpg extension, changing the Content-Type to image/php, and placing PHP code after the JPEG data. This ultimately allows execution of arbitrary PHP code.
CVE-2019-8335 1 Schoolcms 1 Schoolcms 2024-11-21 N/A
An issue was discovered in SchoolCMS 2.3.1. There is an XSS vulnerability via index.php?a=Index&c=Channel&m=Home&id=[XSS].
CVE-2019-8334 1 Schoolcms 1 Schoolcms 2024-11-21 N/A
An issue was discovered in SchoolCMS 2.3.1. There is an XSS vulnerability via index.php?a=Index&c=Channel&m=Home&viewid=[XSS].