GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg Before The Vulnopticon Conference - Registration
Search

Find a vulnerability

Search criteria

    2 vulnerabilities by Applied Software Consultants

    GCVE-1988-2026-0251

    Vulnerability from gna-1988 – Published: 2026-09-08 08:13 – Updated: 2026-09-11 07:39
    VLAI
    Title
    Full disclosure: Edupage web and mobile application authorization bypass leaks PII and IBAN codes
    Summary
    VULNERABILITY Both authenticated and publicly accessible anonymous guest accounts on Edupage portal allow an attacker to capture the complete list of user IDs, names (students, parents, and teachers), and the associated banking details (IBAN codes) Full disclosure report: https://jkosik.github.io/posts/edupage/ Reference: https://www.edupage.org/ VENDOR: Applied Software Consultants PRODUCT: Edupage - https://www.edupage.org/ Web application and also mobile application (at least 2024.0.25 2.1.72) AFFECTED COMPONENT Edupage Payment module ATTACK TYPE Remote DISCOVERER Juraj Kosik CVE CVE-2025-70561 _______________________________________________ Sent through the Full Disclosure mailing list https://nmap.org/mailman/listinfo/fulldisclosure Web Archives & RSS: https://seclists.org/fulldisclosure/
    Severity
    No CVSS data available.
    Assigner
    References
    Impacted products
    Credits
    Juraj Kosik
    To clipboard 

    {
  "containers": {
    "cna": {
      "affected": [
        {
          "product": "Full disclosure Edupage",
          "vendor": "Applied Software Consultants",
          "versions": [
            {
              "status": "affected",
              "version": "unknown"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Juraj Kosik"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "VULNERABILITY\nBoth authenticated and publicly accessible anonymous guest accounts on\nEdupage portal allow an attacker to capture the complete list of user IDs,\nnames (students, parents, and teachers), and the associated banking details\n(IBAN codes)\n\nFull disclosure report: https://jkosik.github.io/posts/edupage/\nReference: https://www.edupage.org/\n\nVENDOR:\nApplied Software Consultants\n\nPRODUCT:\nEdupage - https://www.edupage.org/\nWeb application and also mobile application (at least 2024.0.25 2.1.72)\n\nAFFECTED COMPONENT\nEdupage Payment module\n\nATTACK TYPE\nRemote\n\nDISCOVERER\nJuraj Kosik\n\nCVE\nCVE-2025-70561\n_______________________________________________\nSent through the Full Disclosure mailing list\nhttps://nmap.org/mailman/listinfo/fulldisclosure\nWeb Archives \u0026 RSS: https://seclists.org/fulldisclosure/"
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-11T07:39:27Z",
        "orgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
        "shortName": "VULNARCHIVE"
      },
      "references": [
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://vuln.freearchive.org/archive/full-disclosure/2026/May/3"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://seclists.org/fulldisclosure/2026/May/3"
        },
        {
          "url": "https://jkosik.github.io/posts/edupage/"
        },
        {
          "url": "https://nmap.org/mailman/listinfo/fulldisclosure"
        },
        {
          "url": "https://seclists.org/fulldisclosure/"
        },
        {
          "url": "https://www.edupage.org/"
        }
      ],
      "source": {
        "defect": [
          "https://seclists.org/fulldisclosure/2026/May/3"
        ],
        "discovery": "EXTERNAL"
      },
      "title": "Full disclosure: Edupage web and mobile application authorization bypass leaks PII and IBAN codes",
      "x_gcve": [
        {
          "recordType": "advisory",
          "relationships": [],
          "vulnId": "GCVE-1988-2026-0251",
          "x_vulnarchive": {
            "archiveUrl": "https://vuln.freearchive.org/archive/full-disclosure/2026/May/3",
            "automated": true,
            "contentSha256": "f0c00c3375b0a15c7991e33bfcc9c10bad4a82e4ecefb8da5d4667c2d9748705",
            "evidenceScore": 6,
            "messageId": "",
            "originalUrl": "https://seclists.org/fulldisclosure/2026/May/3",
            "policy": "vulnarchive-1",
            "sourceFormat": "text/html",
            "sourcePublishedAt": "2026-05-12T10:39:30Z"
          }
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
    "assignerShortName": "VULNARCHIVE",
    "datePublished": "2026-09-08T08:13:42Z",
    "dateUpdated": "2026-09-11T07:39:27Z",
    "state": "PUBLISHED",
    "vulnId": "GCVE-1988-2026-0251"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

    GCVE-1988-2026-0252

    Vulnerability from gna-1988 – Published: 2026-09-08 08:13 – Updated: 2026-09-11 07:39
    VLAI
    Title
    Full disclosure: Impersonation attacks on Edupage portal
    Summary
    VULNERABILITY Non-sanitised submission of malicious SVG files on the Edupage portal in combination with CSRF vulnerability allows triggering various actions on behalf of other users, e.g. identity spoofing, sending fake messages, giving fake approvals, etc. Full disclosure report: https://jkosik.github.io/posts/edupage/ Reference: https://www.edupage.org/ VENDOR: Applied Software Consultants PRODUCT: Edupage - https://www.edupage.org/ Web application and also mobile application (at least 2024.0.25 2.1.72) AFFECTED COMPONENT Edupage web and mobile application - multiple pages with missing CSRF token and multiple pages allowing attachment uploads. ATTACK TYPE Remote DISCOVERER Juraj Kosik CVE CVE-2025-70562 CVE-2025-70563 _______________________________________________ Sent through the Full Disclosure mailing list https://nmap.org/mailman/listinfo/fulldisclosure Web Archives & RSS: https://seclists.org/fulldisclosure/
    Severity
    No CVSS data available.
    Assigner
    References
    Impacted products
    Credits
    Juraj Kosik
    To clipboard 

    {
  "containers": {
    "cna": {
      "affected": [
        {
          "product": "Full disclosure Impersonation",
          "vendor": "Applied Software Consultants",
          "versions": [
            {
              "status": "affected",
              "version": "unknown"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Juraj Kosik"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "VULNERABILITY\nNon-sanitised submission of malicious SVG files on the Edupage portal in\ncombination with CSRF vulnerability allows triggering various actions on\nbehalf of other users, e.g. identity spoofing, sending fake messages,\ngiving fake approvals, etc.\n\nFull disclosure report: https://jkosik.github.io/posts/edupage/\nReference: https://www.edupage.org/\n\nVENDOR:\nApplied Software Consultants\n\nPRODUCT:\nEdupage - https://www.edupage.org/\nWeb application and also mobile application (at least 2024.0.25 2.1.72)\n\nAFFECTED COMPONENT\nEdupage web and mobile application - multiple pages with missing CSRF token\nand multiple pages allowing attachment uploads.\n\nATTACK TYPE\nRemote\n\nDISCOVERER\nJuraj Kosik\n\nCVE\nCVE-2025-70562\nCVE-2025-70563\n_______________________________________________\nSent through the Full Disclosure mailing list\nhttps://nmap.org/mailman/listinfo/fulldisclosure\nWeb Archives \u0026 RSS: https://seclists.org/fulldisclosure/"
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-11T07:39:33Z",
        "orgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
        "shortName": "VULNARCHIVE"
      },
      "references": [
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://vuln.freearchive.org/archive/full-disclosure/2026/May/4"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://seclists.org/fulldisclosure/2026/May/4"
        },
        {
          "url": "https://jkosik.github.io/posts/edupage/"
        },
        {
          "url": "https://nmap.org/mailman/listinfo/fulldisclosure"
        },
        {
          "url": "https://seclists.org/fulldisclosure/"
        },
        {
          "url": "https://www.edupage.org/"
        }
      ],
      "source": {
        "defect": [
          "https://seclists.org/fulldisclosure/2026/May/4"
        ],
        "discovery": "EXTERNAL"
      },
      "title": "Full disclosure: Impersonation attacks on Edupage portal",
      "x_gcve": [
        {
          "recordType": "advisory",
          "relationships": [],
          "vulnId": "GCVE-1988-2026-0252",
          "x_vulnarchive": {
            "archiveUrl": "https://vuln.freearchive.org/archive/full-disclosure/2026/May/4",
            "automated": true,
            "contentSha256": "af883f4d6525af5afb39baf60c32c4eeb9f767b44447dc0edb11edda3a94e42b",
            "evidenceScore": 6,
            "messageId": "",
            "originalUrl": "https://seclists.org/fulldisclosure/2026/May/4",
            "policy": "vulnarchive-1",
            "sourceFormat": "text/html",
            "sourcePublishedAt": "2026-05-12T10:46:55Z"
          }
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
    "assignerShortName": "VULNARCHIVE",
    "datePublished": "2026-09-08T08:13:42Z",
    "dateUpdated": "2026-09-11T07:39:33Z",
    "state": "PUBLISHED",
    "vulnId": "GCVE-1988-2026-0252"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}