CVE-2022-36193

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

SQL injection in School Management System 1.0 allows remote attackers to modify or delete data, causing persistent changes to the application's content or behavior by using malicious SQL queries.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-89

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

https://github.com/G37SYS73M/Advisory_G37SYS73M/blob/main/CVE-2022-36193/POC.mdExploit, Third Party Advisory
https://github.com/lahirudanushka/School-Management-System---PHP-MySQLProduct
https://github.com/G37SYS73M/Advisory_G37SYS73M/blob/main/CVE-2022-36193/POC.mdExploit, Third Party Advisory
https://github.com/lahirudanushka/School-Management-System---PHP-MySQLProduct

Timeline

Published: Nov 28, 2022
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2022

CVE-2022-361945.4Centreon 22.04.0 is vulnerable to Cross Site Scripting (XSS) from the function Pollers > Broker Configuration by adding a crafted payload in CVE-2022-361975.4BigTree CMS 4.4.16 was discovered to contain an arbitrary file upload vulnerability which allows attackers to execute arbitrary code via a c CVE-2022-361989.8Multiple SQL injections detected in Bus Pass Management System 1.0 via buspassms/admin/view-enquiry.php, buspassms/admin/pass-bwdates-report CVE-2022-36209.8A vulnerability was found in Exim and classified as problematic. This issue affects the function dmarc_dns_lookup of the file dmarc.c of the CVE-2022-362007.5In FiberHome VDSL2 Modem HG150-Ub_V3.0, Credentials of Admin are submitted in URL, which can be logged/sniffed.CVE-2022-362019.8Doctor’s Appointment System v1.0 is vulnerable to Blind SQLi via settings.php.CVE-2022-362029.8Doctor's Appointment System1.0 is vulnerable to Incorrect Access Control via edoc/patient/settings.php. The settings.php is affected by Brok CVE-2022-362036.1Doctor's Appointment System 1.0 is vulnerable to Cross Site Scripting (XSS) via the admin panel. In addition, it leads to takeover the admin CVE-2022-36216.5A vulnerability was found in Linux Kernel. It has been classified as problematic. Affected is the function nilfs_bmap_lookup_at_level of the CVE-2022-362157.2DedeBIZ v6 was discovered to contain a remote code execution vulnerability in sys_info.php.CVE-2022-362167.2DedeCMS v5.7.94 - v5.7.97 was discovered to contain a remote code execution vulnerability in member_toadmin.php.CVE-2022-36224.1The Blog2Social plugin for WordPress is vulnerable to authorization bypass due to missing capability checks in versions up to, and includin