CVE-2020-36034

CRITICAL

School Faculty Scheduling System 1.0 - SQL Injection via manage_user.php id Parameter

Title source: llm
STIX 2.1

Description

SQL Injection vulnerability in oretnom23 School Faculty Scheduling System version 1.0, allows remote attacker to execute arbitrary code, escalate privilieges, and gain sensitive information via crafted payload to id parameter in manage_user.php.

References (3)

Core 3

Scores

CVSS v3 9.8
EPSS 0.0134
EPSS Percentile 67.8%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CISA SSVC

Vulnrichment
Exploitation poc
Automatable yes
Technical Impact total

Details

CWE
CWE-89
Status published
Products (1)
school_faculty_scheduling_system_project/school_faculty_scheduling_system 1.0
Published Aug 11, 2023
Tracked Since Feb 18, 2026