CVE-2024-28094

HighCVSS 8.8/10Last modified Jun 17, 2026

Description

Chat functionality in Schoolbox application before version 23.1.3 is vulnerable to blind SQL Injection enabling the authenticated attackers to read, modify, and delete database records.

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-89

Affected software

No affected versions have been published.

Timeline

Published
Mar 7, 2024
Last modified
Jun 17, 2026
NVD status
Analyzed

Related CVEs from 2024

CVE-2024-280955.4News functionality in Schoolbox application before version 23.1.3 is vulnerable to stored cross-site scripting allowing authenticated attaCVE-2024-280965.4Class functionality in Schoolbox application before version 23.1.3 is vulnerable to stored cross-site scripting allowing authenticated attCVE-2024-280975.4Calendar functionality in Schoolbox application before version 23.1.3 is vulnerable to stored cross-site scripting allowing authenticated CVE-2024-280985.4The vulnerability allows authenticated users with only produce or consume permissions to modify topic-level policies, such as retention, TTLCVE-2024-280997.8VT STUDIO Ver.8.32 and earlier contains an issue with the DLL search path, which may lead to insecurely loading Dynamic Link Libraries. As aCVE-2024-28109.8A vulnerability has been found in Tenda AC15 15.03.05.18/15.03.20_multi and classified as critical. Affected by this vulnerability is the fuCVE-2024-281005.4eLabFTW is an open source electronic lab notebook for research labs. By uploading specially crafted files, a regular user can create a circuCVE-2024-281017.5The Apollo Router is a graph router written in Rust to run a federated supergraph that uses Apollo Federation. Versions 0.9.5 until 1.40.2 aCVE-2024-281026.8JWCrypto implements JWK, JWS, and JWE specifications using python-cryptography. Prior to version 1.5.6, an attacker can cause a denial of seCVE-2024-281039.8Action Pack is a framework for handling and responding to web requests. Since 6.1.0, the application configurable Permissions-Policy is onlyCVE-2024-281057.2phpMyFAQ is an open source FAQ web application for PHP 8.1+ and MySQL, PostgreSQL and other databases. The category image upload function inCVE-2024-281065.4phpMyFAQ is an open source FAQ web application for PHP 8.1+ and MySQL, PostgreSQL and other databases. By manipulating the news parameter in
CVE-2024-28094: High severity, CVSS 8.8 | Vulnix