Lopalopa vulnerabilities
We track 18 vulnerabilities in Lopalopa products across 4 products. 18 are rated high or critical, and none are known to be exploited. The most recent was published on May 5, 2025.
Latest Lopalopa vulnerabilities
- 8.8 High severity
Online Service Management Portal: Improper Neutralization of Special Elements used in an SQL Command
kashipara Online Service Management Portal V1.0 is vulnerable to SQL Injection in /osms/Requester/Requesterchangepass.php via the parameter: rPassword.
- 7.5 High severity
E-learning Management System: Out-of-bounds Read
A Directory Listing issue was found in Kashipara E-Learning Management System v1.0, which allows remote attackers to access sensitive files and directories via /admin/uploads.
- 9.8 Critical severity
E-learning Management System: Improper Neutralization of Special Elements used in an SQL Command
A SQL Injection was found in /admin/delete_event.php in kashipara E-learning Management System v1.0, which allows remote attackers to execute arbitrary SQL commands to get unauthorized database access via the id parameter.
- 9.8 Critical severity
E-learning Management System: Improper Neutralization of Special Elements used in an SQL Command
A SQL Injection was found in /remove_sent_message.php in kashipara E-learning Management System v1.0, which allows remote attackers to execute arbitrary SQL commands to get unauthorized database access via the id parameter.
- 9.8 Critical severity
E-learning Management System: Improper Neutralization of Special Elements used in an SQL Command
A SQL Injection was found in /admin/edit_content.php in kashipara E-learning Management System v1.0, which allows remote attackers to execute arbitrary SQL commands to get unauthorized database access via the title and content parameters.
- 9.8 Critical severity
E-learning Management System: Improper Neutralization of Special Elements used in an SQL Command
A SQL Injection vulnerability was found in /admin/edit_teacher.php in kashipara E-learning Management System v1.0, which allows remote attackers to execute arbitrary SQL commands to get unauthorized database access via the department parameter.
- 9.8 Critical severity
E-learning Management System: Improper Neutralization of Special Elements used in an SQL Command
A SQL Injection was found in /student_signup.php in kashipara E-learning Management System v1.0, which allows remote attackers to execute arbitrary SQL commands to get unauthorized database access via the username, firstname, lastname, and class_id parameters.
- 7.2 High severity
E-learning Management System: Improper Neutralization of Special Elements used in an SQL Command
A SQL Injection was found in /admin/edit_user.php of kashipara E-learning Management System v1.0, which allows remote attackers to execute arbitrary SQL commands to get unauthorized database access via the firstname, lastname, and username parameters.
- 8.8 High severity
E-learning Management System: Improper Neutralization of Special Elements used in an SQL Command
A SQL Injection vulnerability was found in /search_class.php of kashipara E-learning Management System v1.0, which allows remote attackers to execute arbitrary SQL commands to get unauthorized database access via the school_year parameter.
- 9.8 Critical severity
E-learning Management System: Improper Neutralization of Special Elements used in an SQL Command
A SQL Injection vulnerability was found in /teacher_signup.php of kashipara E-learning Management System v1.0, which allows remote attackers to execute arbitrary SQL command to get unauthorized database access via the firstname, lastname, and class_id paramete
- 7.2 High severity
e_learning_management_system_project: Improper Neutralization of Special Elements used in an SQL Command
A SQL Injection vulnerability was found in /admin/calendar_of_events.php in kashipara E-learning Management System Project 1.0 via the date_start, date_end, and title parameters.
- 7.2 High severity
e_learning_management_system_project: Improper Neutralization of Special Elements used in an SQL Command
A SQL Injection vulnerability was found in /admin/add_subject.php in kashipara E-learning Management System Project 1.0 via the subject_code parameter.
- 7.2 High severity
e_learning_management_system_project: Improper Neutralization of Special Elements used in an SQL Command
A SQL Injection vulnerability was found in /admin/add_content.php in kashipara E-learning Management System Project 1.0 via the title and content parameters.
- 7.2 High severity
e_learning_management_system_project: Improper Neutralization of Special Elements used in an SQL Command
A SQL Injection vulnerability was found in /admin/school_year.php in kashipara E-learning Management System Project 1.0 via the school_year parameter.
- 9.8 Critical severity
e_learning_management_system_project: Improper Neutralization of Special Elements used in an SQL Command
A SQL Injection vulnerability was found in /admin/login.php in kashipara E-learning Management System Project 1.0 via the username and password parameters.
- 7.2 High severity
e_learning_management_system_project: Improper Neutralization of Special Elements used in an SQL Command
A SQL Injection vulnerability was found in /admin/edit_student.php in KASHIPARA E-learning Management System Project 1.0 via the cys, un, ln, fn, and id parameters.
- 8.8 High severity
Music Management System: Unrestricted Upload of File with Dangerous Type
An Unrestricted file upload vulnerability was found in "/music/ajax.php?action=save_playlist" in Kashipara Music Management System v1.0. This allows attackers to execute arbitrary code via uploading a crafted PHP file.
- 8.6 High severity
dynamic_lab_management_system: Improper Neutralization of Special Elements used in an SQL Command
SQL injection vulnerability in Dynamic Lab Management System Project in PHP v.1.0 allows a remote attacker to execute arbitrary code via a crafted script.