CVE-2024-10509

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

A vulnerability, which was classified as critical, has been found in Codezips Online Institute Management System 1.0. This issue affects some unknown processing of the file /login.php. The manipulation of the argument email leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-89

Affected software

Vendor	Product	Versions
Codezips	Online Institute Management System	1.0
codezips	online_institute_management_system	1.0

References

https://github.com/ppp-src/CVE/issues/27Exploit, Third Party Advisory
https://vuldb.com/?ctiid.282449Permissions Required, VDB Entry
https://vuldb.com/?id.282449Third Party Advisory, VDB Entry
https://vuldb.com/?submit.432720Third Party Advisory, VDB Entry

Timeline

Published: Oct 30, 2024
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2024

CVE-2024-10516.4The List category posts plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'catlist' shortcode in all versio CVE-2024-105104.8The adBuddy+ (AdBlocker Detection) by NetfunkDesign WordPress plugin through 1.1.3 does not sanitise and escape some of its settings, which CVE-2024-105115.3CWE-287: Improper Authentication vulnerability exists that could cause Denial of access to the web interface when someone on the local netwo CVE-2024-105137.2A path traversal vulnerability exists in the 'document uploads manager' feature of mintplex-labs/anything-llm, affecting the latest version CVE-2024-105153.5In the process of testing the SEO Plugin by Squirrly SEO WordPress plugin before 12.3.21, a vulnerability was found that allows you to imple CVE-2024-105168.1The Swift Performance Lite plugin for WordPress is vulnerable to Local PHP File Inclusion in all versions up to, and including, 2.3.7.1 via CVE-2024-105174.8The Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content WordPress plugin before 4.15.15 CVE-2024-105184.8The Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content WordPress plugin before 4.15.15 CVE-2024-105196.1The Wishlist for WooCommerce: Multi Wishlists Per Customer PRO plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the CVE-2024-10528.0Boundary and Boundary Enterprise (“Boundary”) is vulnerable to session hijacking through TLS certificate tampering. An attacker with privile CVE-2024-105205.3The WP Project Manager plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check in the 'che CVE-2024-105214.3The WordPress Contact Forms by Cimatti plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including