← Vulnerability feed

Vulnerability record · CVE-2024-40480 · published 12 August 2024

CVE-2024-40480: Jayesh online exam system improper access control vulnerability

Jayesh · Online Exam System

A Broken Access Control vulnerability was found in /admin/update.php and /admin/dashboard.php in Kashipara Online Exam System v1.0, which allows remote unauthenticated attackers to view administrator dashboard and delete valid user accounts via the direct URL access.

9.8 CVSS 3.1 Critical EPSS 0.53% · top 57.1% CWE-284 · Improper access control
9.8CVSS 3.1 base score
0.53%EPSS exploitation probability, 30 days
NoNot in CISA KEV
1Affected product versions listed by NVD
2References
17 Jun 2026Last modified by NVD

Description

A Broken Access Control vulnerability was found in /admin/update.php and /admin/dashboard.php in Kashipara Online Exam System v1.0, which allows remote unauthenticated attackers to view administrator dashboard and delete valid user accounts via the direct URL access.

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Affected products

1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

References

LinkTags
https://github.com/takekaramey/CVE_Writeup/blob/main/Kashipara/Online%20Exam%20System%20v1.0/Broken%20Access%20Control%2 Third Party Advisory
https://www.kashipara.com/project/php/3/online-exam-php-project-source-code-download Product

Track CVE-2024-40480 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

9.1CVE-2025-51567Jayesh online exam system sql injection vulnerabilityA SQL Injection was found in the /exam/user/profile.php page of kashipara Online Exam System V1.0, which allows remote attackers to execute arbitrary…EPSS 0.40%8.1CVE-2024-40479Jayesh online exam system sql injection vulnerabilityA SQL injection vulnerability in "/admin/quizquestion.php" in Kashipara Online Exam System v1.0 allows remote attackers to execute arbitrary SQL comm…EPSS 0.80%5.4CVE-2024-40478Jayesh online exam system cross-site scripting vulnerabilityA Stored Cross Site Scripting (XSS) vulnerability was found in "/admin/afeedback.php" in Kashipara Online Exam System v1.0, which allows remote attac…EPSS 0.64%

Source: NIST National Vulnerability Database (record CVE-2024-40480), CISA KEV, FIRST EPSS (scores of 2026-09-29). This page is refreshed as NVD updates the record.