Kashipara Group vulnerabilities
We track 28 vulnerabilities in Kashipara Group products across 5 products. 28 are rated high or critical, and none are known to be exploited. The most recent was published on May 13, 2025.
Latest Kashipara Group vulnerabilities
- 9.8 Critical severity
Billing Software: Improper Neutralization of Special Elements used in an SQL Command
Billing Software v1.0 is vulnerable to multiple Unauthenticated SQL Injection vulnerabilities. The 'username' parameter of the loginCheck.php resource does not validate the characters received and they are sent unfiltered to the database.
- 9.8 Critical severity
Travel Website: Improper Neutralization of Special Elements used in an SQL Command
Travel Website v1.0 is vulnerable to multiple Unauthenticated SQL Injection vulnerabilities. The 'username' parameter of the signupAction.php resource does not validate the characters received and they are sent unfiltered to the database.
- 9.8 Critical severity
Travel Website: Improper Neutralization of Special Elements used in an SQL Command
Travel Website v1.0 is vulnerable to multiple Unauthenticated SQL Injection vulnerabilities. The 'username' parameter of the loginAction.php resource does not validate the characters received and they are sent unfiltered to the database.
- 9.8 Critical severity
Travel Website: Improper Neutralization of Special Elements used in an SQL Command
Travel Website v1.0 is vulnerable to multiple Unauthenticated SQL Injection vulnerabilities. The 'city' parameter of the hotelSearch.php resource does not validate the characters received and they are sent unfiltered to the database.
- 9.8 Critical severity
Travel Website: Improper Neutralization of Special Elements used in an SQL Command
Travel Website v1.0 is vulnerable to multiple Unauthenticated SQL Injection vulnerabilities. The 'hotelId' parameter of the hotelDetails.php resource does not validate the characters received and they are sent unfiltered to the database.
- 9.8 Critical severity
Travel Website: Improper Neutralization of Special Elements used in an SQL Command
Travel Website v1.0 is vulnerable to multiple Unauthenticated SQL Injection vulnerabilities. The 'hotelIDHidden' parameter of the generateReceipt.php resource does not validate the characters received and they are sent unfiltered to the database.
- 9.8 Critical severity
Travel Website: Improper Neutralization of Special Elements used in an SQL Command
Travel Website v1.0 is vulnerable to multiple Unauthenticated SQL Injection vulnerabilities. The 'hotelIDHidden' parameter of the booking.php resource does not validate the characters received and they are sent unfiltered to the database.
- 8.8 High severity
Online Notice Board System: Unrestricted Upload of File with Dangerous Type
Online Notice Board System v1.0 is vulnerable to an Insecure File Upload vulnerability on the 'f' parameter of user/update_profile_pic.php page, allowing an authenticated attacker to obtain Remote Code Execution on the server hosting the application.
- 9.8 Critical severity
Online Notice Board System: Improper Neutralization of Special Elements used in an SQL Command
Online Notice Board System v1.0 is vulnerable to multiple Unauthenticated SQL Injection vulnerabilities. The 'dd' parameter of the user/update_profile.php resource does not validate the characters received and they are sent unfiltered to the database.
- 9.8 Critical severity
Online Notice Board System: Improper Neutralization of Special Elements used in an SQL Command
Online Notice Board System v1.0 is vulnerable to multiple Unauthenticated SQL Injection vulnerabilities. The 'e' parameter of the login.php resource does not validate the characters received and they are sent unfiltered to the database.
- 9.8 Critical severity
Online Notice Board System: Improper Neutralization of Special Elements used in an SQL Command
Online Notice Board System v1.0 is vulnerable to multiple Unauthenticated SQL Injection vulnerabilities. The 'dd' parameter of the registration.php resource does not validate the characters received and they are sent unfiltered to the database.
- 9.8 Critical severity
Billing Software: Improper Neutralization of Special Elements used in an SQL Command
Billing Software v1.0 is vulnerable to multiple Unauthenticated SQL Injection vulnerabilities. The 'custmer_details' parameter of the submit_material_list.php resource does not validate the characters received and they are sent unfiltered to the database.
- 9.8 Critical severity
Billing Software: Improper Neutralization of Special Elements used in an SQL Command
Billing Software v1.0 is vulnerable to multiple Unauthenticated SQL Injection vulnerabilities. The 'quantity[]' parameter of the submit_delivery_list.php resource does not validate the characters received and they are sent unfiltered to the database.
- 9.8 Critical severity
Billing Software: Improper Neutralization of Special Elements used in an SQL Command
Billing Software v1.0 is vulnerable to multiple Unauthenticated SQL Injection vulnerabilities. The 'bank_details' parameter of the party_submit.php resource does not validate the characters received and they are sent unfiltered to the database.
- 9.8 Critical severity
Billing Software: Improper Neutralization of Special Elements used in an SQL Command
Billing Software v1.0 is vulnerable to multiple Unauthenticated SQL Injection vulnerabilities. The 'customer_details' parameter of the buyer_invoice_submit.php resource does not validate the characters received and they are sent unfiltered to the database.
- 9.8 Critical severity
Billing Software: Improper Neutralization of Special Elements used in an SQL Command
Billing Software v1.0 is vulnerable to multiple Unauthenticated SQL Injection vulnerabilities. The 'buyer_address' parameter of the buyer_detail_submit.php resource does not validate the characters received and they are sent unfiltered to the database.
- 9.8 Critical severity
Billing Software: Improper Neutralization of Special Elements used in an SQL Command
Billing Software v1.0 is vulnerable to multiple Unauthenticated SQL Injection vulnerabilities. The 'id' parameter of the partylist_edit_submit.php resource does not validate the characters received and they are sent unfiltered to the database.
- 9.8 Critical severity
Billing Software: Improper Neutralization of Special Elements used in an SQL Command
Billing Software v1.0 is vulnerable to multiple Unauthenticated SQL Injection vulnerabilities. The 'cancelid' parameter of the material_bill.php resource does not validate the characters received and they are sent unfiltered to the database.
- 9.8 Critical severity
Billing Software: Improper Neutralization of Special Elements used in an SQL Command
Billing Software v1.0 is vulnerable to multiple Unauthenticated SQL Injection vulnerabilities. The 'itemnameid' parameter of the material_bill.php?action=itemRelation resource does not validate the characters received and they are sent unfiltered to the databa
- 9.8 Critical severity
Job Portal: Improper Neutralization of Special Elements used in an SQL Command
Job Portal v1.0 is vulnerable to multiple Unauthenticated SQL Injection vulnerabilities. The 'JobId' parameter of the Employer/DeleteJob.php resource does not validate the characters received and they are sent unfiltered to the database.
- 9.8 Critical severity
Job Portal: Improper Neutralization of Special Elements used in an SQL Command
Job Portal v1.0 is vulnerable to multiple Unauthenticated SQL Injection vulnerabilities. The 'txtUser' parameter of the login.php resource does not validate the characters received and they are sent unfiltered to the database.
- 9.8 Critical severity
Job Portal: Improper Neutralization of Special Elements used in an SQL Command
Job Portal v1.0 is vulnerable to multiple Unauthenticated SQL Injection vulnerabilities. The 'cmbQual' parameter of the Employer/InsertWalkin.php resource does not validate the characters received and they are sent unfiltered to the database.
- 9.8 Critical severity
Job Portal: Improper Neutralization of Special Elements used in an SQL Command
Job Portal v1.0 is vulnerable to multiple Unauthenticated SQL Injection vulnerabilities. The 'cmbQual' parameter of the Employer/InsertJob.php resource does not validate the characters received and they are sent unfiltered to the database.
- 8.8 High severity
Student Information System: Improper Neutralization of Special Elements used in an SQL Command
Student Information System v1.0 is vulnerable to multiple Authenticated SQL Injection vulnerabilities. The 'coursename' parameter of the marks.php resource does not validate the characters received and they are sent unfiltered to the database.
- 8.8 High severity
Student Information System: Improper Neutralization of Special Elements used in an SQL Command
Student Information System v1.0 is vulnerable to multiple Authenticated SQL Injection vulnerabilities. The 'coursecode' parameter of the marks.php resource does not validate the characters received and they are sent unfiltered to the database.
- 8.8 High severity
Student Information System: Improper Neutralization of Special Elements used in an SQL Command
Student Information System v1.0 is vulnerable to multiple Authenticated SQL Injection vulnerabilities. The 'id' parameter of the marks.php resource does not validate the characters received and they are sent unfiltered to the database.
- 9.8 Critical severity
Student Information System: Improper Neutralization of Special Elements used in an SQL Command
Student Information System v1.0 is vulnerable to an unauthenticated SQL Injection vulnerability on the 'regno' parameter of index.php page, allowing an external attacker to dump all the contents of the database contents and bypass the login control.
- 8.8 High severity
Student Information System: Unrestricted Upload of File with Dangerous Type
Student Information System v1.0 is vulnerable to an Insecure File Upload vulnerability on the 'photo' parameter of my-profile page, allowing an authenticated attacker to obtain Remote Code Execution on the server hosting the application.