School Event Management System Project School Event Management System — known CVE vulnerabilities

Every CVE whose affected-product data names School Event Management System Project School Event Management System, ordered by CVSS severity, with EPSS exploit prediction and CISA KEV status.

CVEs (3)

• CVE-2018-18793 — CVSS 9.8 (critical): School Event Management System 1.0 allows Arbitrary File Upload via event/controller.php?action=photos.
• CVE-2018-18795 — CVSS 9.8 (critical): School Event Management System 1.0 has SQL Injection via the student/index.php or event/index.php id parameter.
• CVE-2018-18794 — CVSS 8.8 (high): School Event Management System 1.0 allows CSRF via user/controller.php?action=edit.