CVE-2024-12305

An object-level access control vulnerability in Unifiedtransform version 2.0 and potentially earlier versions allows unauthorized access to student grades. A malicious student user can view grades of other students by manipulating the student_id parameter in the marks viewing endpoint. The vulnerability exists due to insufficient access control checks in MarkController.php. At the time of publication of the CVE no patch is available.

• CWE-639

• https://huntr.com/bounties/90a7299e-9233-43fd-b666-7375c4fdbb3c

Published

Dec 9, 2024

Last Modified

Jun 17, 2026

Status

Deferred

• Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2024-1230The SimpleShop plugin for WordPress is vulnerable to Cross-S…4.3
• CVE-2024-12300The AR for WordPress plugin for WordPress is vulnerable to u…3.7
• CVE-2024-12301The JSP Store Locator WordPress plugin through 1.0 does not …6.5
• CVE-2024-12302The Icegram Engage WordPress plugin before 3.1.32 does not …6.1
• CVE-2024-12303An issue has been discovered in GitLab CE/EE affecting all v…5.5
• CVE-2024-12304The Gutenberg Blocks with AI by Kadence WP – Page Builder Fe…5.4
• CVE-2024-12306Multiple access control vulnerabilities in Unifiedtransform …4.3
• CVE-2024-12307A function-level access control vulnerability in Unifiedtran…4.3
• CVE-2024-12308The Logo Slider WordPress plugin before 4.6.0 does not vali…5.4
• CVE-2024-12309The Rate My Post – Star Rating Plugin by FeedbackWP plugin f…5.3
• CVE-2024-1231The CM Download Manager WordPress plugin before 2.9.0 does …6.8
• CVE-2024-12310A vulnerability in Imprivata Enterprise Access Management (f…7