CVE-2024-4524

MediumCVSS 6.1/10Last modified Jun 17, 2026

Description

A vulnerability, which was classified as problematic, was found in Campcodes Complete Web-Based School Management System 1.0. This affects an unknown part of the file /view/student_payment_invoice.php. The manipulation of the argument desc leads to cross site scripting. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-263127.

Metrics

CVSS 3.1 6.1/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

No affected versions have been published.

Timeline

Published: May 6, 2024
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2024

CVE-2024-452407.4The TikTok (aka com.zhiliaoapp.musically) application before 34.5.5 for Android allows the takeover of Lynxview JavaScript interfaces via de CVE-2024-452417.5A traversal vulnerability in GeneralDocs.aspx in CentralSquare CryWolf (False Alarm Management) through 2024-08-09 allows unauthenticated at CVE-2024-452427.8EnGenius ENH1350EXT A8J-ENH1350EXT devices through 3.9.3.2_c1.9.51 allow (blind) OS Command Injection via shell metacharacters to the Ping o CVE-2024-452445.3Hyperledger Fabric through 3.0.0 and 2.5.x through 2.5.9 do not verify that a request has a timestamp within the expected time window.CVE-2024-452457.8Diebold Nixdorf – CWE-200: Exposure of Sensitive Information to an Unauthorized Actor CVE-2024-452467.3Diebold Nixdorf – CWE-427: Uncontrolled Search Path Element CVE-2024-452476.1Sonarr – CWE-601: URL Redirection to Untrusted Site ('Open Redirect')CVE-2024-452487.5Multi-DNC – CWE-35: Path Traversal: '.../...//'CVE-2024-452499.8Cavok – CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2024-45256.1A vulnerability has been found in Campcodes Complete Web-Based School Management System 1.0 and classified as problematic. This vulnerabilit CVE-2024-452504.3ZKteco – CWE 200 Exposure of Sensitive Information to an Unauthorized Actor CVE-2024-452519.8Elsight – CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')