CVE-2018-19923

An issue was discovered in Sales & Company Management System SCMS through 2018-06-06. There is member/memberemail.php?action=edit CSRF...

CVE-2018-19925

An issue was discovered in Sales & Company Management System SCMS through 2018-06-06. It has SQL injection via the member/memberorder.php type parameter, related to the Ostate parameter...

CVE-2018-19924

An issue was discovered in Sales & Company Management System SCMS through 2018-06-06. An email address can be modified in between the request for a validation code and the entry of the validation code, leading to storage of an XSS payload contained in the modified address...

EUVD-2018-11597

Malware in sbrugna...

EUVD-2018-11596

Malware in sbrugna...

EUVD-2018-11338

Malware in sbrugna...

EUVD-2018-11595

Malware in sbrugna...

Coman 1.0 - 'id' SQL Injection

Exploit Title: Coman - Company Management System 1.0 - SQL Injection Dork: N/A Date: 2019-01-20 Exploit Author: Ihsan Sencan Vendor Homepage: http://ragob.com/ Software Link: https://codecanyon.net/item/coman-company-management-system/17799270 Version: 1.0 Category: Webapps Tested on:...

Coman 1.0 - id SQL Injection

Coman 1.0 - id SQL Injection Exploit Title: Coman - Company Management System 1.0 - SQL Injection Dork: N/A Date: 2019-01-20 Exploit Author: Ihsan Sencan Vendor Homepage: http://ragob.com/ Software Link: https://codecanyon.net/item/coman-company-management-system/17799270 Version: 1.0 Category:...

CVE-2018-19923

An issue was discovered in Sales & Company Management System SCMS through 2018-06-06. There is member/memberemail.php?action=edit CSRF...

Input validation

An issue was discovered in Sales & Company Management System SCMS through 2018-06-06. An email address can be modified in between the request for a validation code and the entry of the validation code, leading to storage of an XSS payload contained in the modified address...

CVE-2018-19924

An issue was discovered in Sales & Company Management System SCMS through 2018-06-06. An email address can be modified in between the request for a validation code and the entry of the validation code, leading to storage of an XSS payload contained in the modified address...

CVE-2018-19924: Improper Neutralization of Input During Web Page Generation

An issue was discovered in Sales & Company Management System SCMS through 2018-06-06. An email address can be modified in between the request for a validation code and the entry of the validation code, leading to storage of an XSS payload contained in the modified address...

CVE-2018-19923: Cross-Site Request Forgery (CSRF)

An issue was discovered in Sales & Company Management System SCMS through 2018-06-06. There is member/memberemail.php?action=edit CSRF...

CVE-2018-19925: Improper Neutralization of Special Elements used in an SQL Command

An issue was discovered in Sales & Company Management System SCMS through 2018-06-06. It has SQL injection via the member/memberorder.php type parameter, related to the Ostate parameter...

PT-2018-15168

Name of the Vulnerable Software and Affected Versions Sales & Company Management System SCMS versions prior to 2018-06-06 Description An issue allows modification of an email address between the request for a validation code and the entry of the validation code. This can lead to storage of an XSS...

PT-2018-15167

Name of the Vulnerable Software and Affected Versions Sales & Company Management System SCMS versions prior to 2018-06-06 Description An issue was discovered in the system, where there is a CSRF vulnerability in the member email.php file, specifically when the action parameter is set to edit...

PT-2018-15169

Name of the Vulnerable Software and Affected Versions Sales & Company Management System SCMS versions prior to 2018-06-06 Description The issue is related to SQL injection via the type parameter in the "member/member order.php" endpoint, specifically involving the O state parameter. Recommendatio...

Sales & Company Management System Privilege Permission and Access Control Vulnerability

Sales & Company Management System SCMS is a sales and company management system. The system includes features such as customer management, product management and tax management. A privilege permission and access control vulnerability exists in SCMS 2018-06-06 and prior versions, which can be...

Design/Logic Flaw

An issue was discovered in Sales & Company Management System SCMS through 2018-06-06. There is a discrepancy in username checking between a component that does string validation, and a component that is supposed to query a MySQL database. Thus, it is possible to register a new account with a...