CVE-2021-3262

Description

TripSpark VEO Transportation-2.2.x-XP_BB-20201123-184084 NovusEDU-2.2.x-XP_BB-20201123-184084 allows unsafe data inputs in POST body parameters from end users without sanitizing using server-side logic. It was possible to inject custom SQL commands into the "Student Busing Information" search queries.

Reserved 2021-01-22 | Published 2023-08-29 | Updated 2024-10-02 | Assigner mitre

References

tripspark.com

veo.com

susos.co/...covered-sql-injection-in-tripspark-veo-transport

cve.org (CVE-2021-3262)

nvd.nist.gov (CVE-2021-3262)

Download JSON