CVE-2023-6618

HighCVSS 8.8/10Last modified Jun 17, 2026

Description

A vulnerability was found in SourceCodester Simple Student Attendance System 1.0. It has been declared as problematic. Affected by this vulnerability is an unknown functionality of the file index.php. The manipulation of the argument page leads to file inclusion. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-247255.

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-73 CWE-610

Affected software

Vendor	Product	Versions
SourceCodester	Simple Student Attendance System	1.0

References

https://vuldb.com/?ctiid.247255Permissions Required, Third Party Advisory
https://vuldb.com/?id.247255Third Party Advisory
https://www.yuque.com/u39339523/el4dxs/krpez3nzv1144cucThird Party Advisory
https://vuldb.com/?ctiid.247255Permissions Required, Third Party Advisory
https://vuldb.com/?id.247255Third Party Advisory
https://www.yuque.com/u39339523/el4dxs/krpez3nzv1144cucThird Party Advisory

Timeline

Published: Dec 8, 2023
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2023

CVE-2023-66199.8A vulnerability was found in SourceCodester Simple Student Attendance System 1.0. It has been rated as critical. Affected by this issue is s CVE-2023-66207.2The POST SMTP Mailer WordPress plugin before 2.8.7 does not properly sanitise and escape several parameters before using them in SQL stateme CVE-2023-66216.1The POST SMTP WordPress plugin before 2.8.7 does not sanitise and escape the msg parameter before outputting it back in the page, leading to CVE-2023-66225.5A null pointer dereference vulnerability was found in nft_dynset_init() in net/netfilter/nft_dynset.c in nf_tables in the Linux kernel. This CVE-2023-66239.8The Essential Blocks WordPress plugin before 4.4.3 does not prevent unauthenticated attackers from overwriting local variables when renderin CVE-2023-66245.4The Import and export users and customers plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's shortcode(s) in CVE-2023-66254.3The Product Enquiry for WooCommerce WordPress plugin before 3.1 does not have a CSRF check in place when deleting inquiries, which could all CVE-2023-66264.8The Product Enquiry for WooCommerce WordPress plugin before 3.1 does not sanitise and escape some of its settings, which could allow high pr CVE-2023-66276.1The WP Go Maps (formerly WP Google Maps) WordPress plugin before 9.0.28 does not properly protect most of its REST API routes, which attacke CVE-2023-66296.1The POST SMTP Mailer – Email log, Delivery Failure Notifications and Best Mail SMTP for WordPress plugin for WordPress is vulnerable to Refl CVE-2023-66304.3The Contact Form 7 – Dynamic Text Extension plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, an CVE-2023-66317.8PowerSYSTEM Center versions 2020 Update 16 and prior contain a vulnerability that may allow an authorized local user to insert arbitrary cod