VULNERABILITY INTELLIGENCE
CVE-2014-1636
CVSS score7.5 HIGH
EPSS probability3.80%
CISA KEVNot currently listed
Published2014-01-22
Last modified2026-06-17
CVSS vectorAV:N/AC:L/Au:N/C:P/I:P/A:P
Description
Multiple SQL injection vulnerabilities in Command School Student Management System 1.06.01 allow remote attackers to execute arbitrary SQL commands via the id parameter in an edit action to (1) admin_school_names.php, (2) admin_subjects.php, (3) admin_grades.php, (4) admin_terms.php, (5) admin_school_years.php, (6) admin_sgrades.php, (7) admin_media_codes_1.php, (8) admin_infraction_codes.php, (9) admin_generations.php, (10) admin_relations.php, (11) admin_titles.php, or (12) health_allergies.php in sw/.
Weakness classification
- CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')