https://patchthecve.com/CVEs with upgrade or downgrade fix stepshttps://patchthecve.com/cve/CVE-2025-51567.htmlhttps://patchthecve.com/cve/CVE-2025-51567.htmlWed, 17 Jun 2026 09:35:41 +0000CRITICAL 9.1: A SQL Injection was found in the /exam/user/profile.php page of kashipara Online Exam System V1.0, which allows remote attackers to execute arbitrary SQL command to get unauthorized database access via the rname, rcollage, rnumber, rgender and rpassword parameters in a POST HTTP request.https://patchthecve.com/cve/CVE-2025-28087.htmlhttps://patchthecve.com/cve/CVE-2025-28087.htmlWed, 17 Jun 2026 09:04:32 +0000CRITICAL 9.8: Sourcecodester Online Exam System 1.0 is vulnerable to SQL Injection via dash.php.https://patchthecve.com/cve/CVE-2024-10353.htmlhttps://patchthecve.com/cve/CVE-2024-10353.htmlWed, 17 Jun 2026 06:55:28 +0000MEDIUM 6.3: A vulnerability classified as critical has been found in SourceCodester Online Exam System 1.0. Affected is an unknown function of the file /admin-dashboard. The manipulation leads to improper access controls. It is possible to launch the attack remotely. The exploit has been disclosed to the publichttps://patchthecve.com/cve/CVE-2024-40480.htmlhttps://patchthecve.com/cve/CVE-2024-40480.htmlWed, 17 Jun 2026 07:45:56 +0000CRITICAL 9.8: A Broken Access Control vulnerability was found in /admin/update.php and /admin/dashboard.php in Kashipara Online Exam System v1.0, which allows remote unauthenticated attackers to view administrator dashboard and delete valid user accounts via the direct URL access.https://patchthecve.com/cve/CVE-2024-40479.htmlhttps://patchthecve.com/cve/CVE-2024-40479.htmlWed, 17 Jun 2026 07:45:56 +0000HIGH 8.1: A SQL injection vulnerability in "/admin/quizquestion.php" in Kashipara Online Exam System v1.0 allows remote attackers to execute arbitrary SQL commands via the "eid" parameter.https://patchthecve.com/cve/CVE-2024-40478.htmlhttps://patchthecve.com/cve/CVE-2024-40478.htmlWed, 17 Jun 2026 07:45:56 +0000MEDIUM 5.4: A Stored Cross Site Scripting (XSS) vulnerability was found in "/admin/afeedback.php" in Kashipara Online Exam System v1.0, which allows remote attackers to execute arbitrary code via "rname" and "email" parameter fields