CVE-2026-3402

This vulnerability allows an attacker to inject malicious scripts into the student record system, potentially compromising users' data or sessions when they visit the affected page. The attack can be executed remotely by manipulating a specific argument in the URL, making it easy for attackers to exploit.

This vulnerability allows an attacker to manipulate the database of the student management system by injecting harmful SQL code through the searchdata parameter, potentially exposing sensitive information or altering data. To exploit this, the attacker needs access to the search feature on the admin page.

An attacker can trick a logged-in user of the gym management system into unknowingly updating their profile information by sending them a malicious link. This vulnerability requires the user to be logged in and click on the link while visiting the attacker's site, potentially allowing the attacker to change the user's details without their consent.