QDOCS vulnerabilities

Products

• smart hospital 1
• Smart Schoo 1
• Smart School 1
• Smart School Management System 1

Latest QDOCS CVEs

Newest publication first

1. CVE-2026-4991 QDOCS Smart School Management System Admission Enquiry enquiry cross site scripting

   Published 2026-03-27

   Medium·CVSS 5.1

   A vulnerability was detected in QDOCS Smart School Management System up to 7.2. The impacted element is an unknown function of the file /admin/enquiry of the component Admission Enquiry Module. Performing a manipulation of the argument Note results in cross site scripting. The at...

2. CVE-2025-41107 Stored XSS in Smart School

   Published 2025-11-10

   Medium·CVSS 5.1

   Stored Cross Site Scripting (XSS) vulnerability in Smart School 7.0 due to lack of proper validation of user input when sending a POST request to '/online_admission', wich affects the parameters 'firstname', 'lastname', 'guardian_name' and others. This vulnerability could allow a...

3. CVE-2023-5495 QDocs Smart School HTTP POST Request sql injection

   Published 2023-10-10

   Medium·CVSS 6.3

   A vulnerability was found in QDocs Smart School 6.4.1. It has been classified as critical. This affects an unknown part of the file /course/filterRecords/ of the component HTTP POST Request Handler. The manipulation of the argument searchdata[0][title]/searchdata[0][searchfield]/...

4. CVE-2020-36011 A cross-site scripting (XSS) issue in Add Patient Form in QDOCS Smart Hospital Management System 3.1 allows a remote attacker to inject arbitrary code via the Name, Guardian Name, Email, Address, Rema...

   Published 2021-01-26

   Medium·CVSS 4.8

   A cross-site scripting (XSS) issue in Add Patient Form in QDOCS Smart Hospital Management System 3.1 allows a remote attacker to inject arbitrary code via the Name, Guardian Name, Email, Address, Remarks, or Any Known Allergies field.

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.