CVE-2024-44313

TastyIgniter 3.7.6 contains an Incorrect Access Control vulnerability in the invoice function within Orders.php which allows unauthorized users to access and generate invoices due to missing permission checks...

CVE-2024-44314: Improper Authorization

TastyIgniter 3.7.6 contains an Incorrect Access Control vulnerability in the Orders Management System, allowing unauthorized users to update order statuses. The issue occurs in the indexonUpdateStatus function within Orders.php, which fails to verify if the user has permission to modify an order'...

CVE-2024-44313: Improper Access Control

TastyIgniter 3.7.6 contains an Incorrect Access Control vulnerability in the invoice function within Orders.php which allows unauthorized users to access and generate invoices due to missing permission checks...

CVE-2024-44313

TastyIgniter 3.7.6 contains an Incorrect Access Control vulnerability in the invoice function within Orders.php which allows unauthorized users to access and generate invoices due to missing permission checks...

CVE-2024-44313

TastyIgniter 3.7.6 contains an Incorrect Access Control vulnerability in the invoice function within Orders.php which allows unauthorized users to access and generate invoices due to missing permission checks...

CVE-2023-45334: Improper Neutralization of Special Elements used in an SQL Command

Online Food Ordering System v1.0 is vulnerable to multiple Unauthenticated SQL Injection vulnerabilities. The 'status' parameter of the routers/edit-orders.php resource does not validate the characters received and they are sent unfiltered to the database...

CVE-2023-24233

A stored cross-site scripting XSS vulnerability in the component /php-inventory-management-system/orders.php?o=add of Inventory Management System v1 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Client Name parameter...

PT-2023-19490

Name of the Vulnerable Software and Affected Versions Inventory Management System version v1 Description A stored cross-site scripting XSS issue in the /php-inventory-management-system/orders.php?o=add component allows attackers to execute arbitrary web scripts or HTML via a crafted payload...

CVE-2023-24233: Improper Neutralization of Input During Web Page Generation

A stored cross-site scripting XSS vulnerability in the component /php-inventory-management-system/orders.php?o=add of Inventory Management System v1 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Client Name parameter...

CVE-2022-42990: Improper Neutralization of Special Elements used in an SQL Command

Food Ordering Management System v1.0 was discovered to contain a SQL injection vulnerability via the component /foms/all-orders.php?status=Cancelled%20by%20Customer...

CVE-2022-32095

Hospital Management System v1.0 was discovered to contain a SQL injection vulnerability via the editid parameter at orders.php...

Sql injection

Hospital Management System v1.0 was discovered to contain a SQL injection vulnerability via the editid parameter at orders.php...

CVE-2022-32095

The CVE-2022-32095 entry affects Hospital Management System v1.0, with a SQL injection vulnerability in orders.php via the editid parameter. The root cause is an unsafeguarded editid input leading to data exposure of the database; impact is high (CVE metrics show high/critical in multiple scores)...

PT-2022-21093

Name of the Vulnerable Software and Affected Versions Hospital Management System version 1.0 Description The issue is related to a SQL injection vulnerability. This vulnerability can be exploited via the editid parameter at the "orders.php" endpoint. There is no information provided about the...

CVE-2022-32095: Improper Neutralization of Special Elements used in an SQL Command

Hospital Management System v1.0 was discovered to contain a SQL injection vulnerability via the editid parameter at orders.php...

CVE-2015-5532

Multiple cross-site scripting XSS vulnerabilities in the Paid Memberships Pro PMPro plugin before 1.8.4.3 for WordPress allow remote attackers to inject arbitrary web script or HTML via the 1 s parameter to membershiplevels.php, 2 memberslist.php, or 3 orders.php in adminpages/ or the 4 edit...

CVE-2015-5532: Improper Neutralization of Input During Web Page Generation

Multiple cross-site scripting XSS vulnerabilities in the Paid Memberships Pro PMPro plugin before 1.8.4.3 for WordPress allow remote attackers to inject arbitrary web script or HTML via the 1 s parameter to membershiplevels.php, 2 memberslist.php, or 3 orders.php in adminpages/ or the 4 edit...

CVE-2016-0765

Multiple cross-site scripting XSS vulnerabilities in eshop-orders.php in the eShop plugin 6.3.14 for WordPress allow remote attackers to inject arbitrary web script or HTML via the 1 page or 2 action parameter...

CVE-2016-0769

Multiple SQL injection vulnerabilities in eshop-orders.php in the eShop plugin 6.3.14 for WordPress allow 1 remote administrators to execute arbitrary SQL commands via the delid parameter or remote authenticated users to execute arbitrary SQL commands via the 2 view, 3 mark, or 4 change parameter...

CVE-2016-0765: Improper Neutralization of Input During Web Page Generation

Multiple cross-site scripting XSS vulnerabilities in eshop-orders.php in the eShop plugin 6.3.14 for WordPress allow remote attackers to inject arbitrary web script or HTML via the 1 page or 2 action parameter...