CVE-2022-40123: Improper Limitation of a Pathname to a Restricted Directory

mojoPortal v2.7 was discovered to contain a path traversal vulnerability via the "f" parameter at /DesignTools/CssEditor.aspx. This vulnerability allows authenticated attackers to read arbitrary files in the system...

Ambit Technologies Itech Movie Portal Script security vulnerabilities

Ambit Technologies Itech Movie Portal Script is a Movie Portal Script from Ambit Technologies, USA. A security vulnerability exists in Ambit Technologies Itech Movie Portal Script version 7.36, which stems from some unknown functionality in movie.php, where manipulation of the parameter f can lea...

PT-2022-21023

Name of the Vulnerable Software and Affected Versions Badminton Center Management System version 1.0 Description The issue concerns SQL Injection via the bcms/classes/Master.php endpoint, specifically when the f parameter is set to delete court. This allows for potential manipulation of database...

PT-2022-21012

Name of the Vulnerable Software and Affected Versions Online Fire Reporting System version 1.0 Description The issue allows for SQL Injection via the /ofrs/classes/Master.php?f=delete team API endpoint, specifically through the f parameter. This could potentially lead to unauthorized data access ...

PT-2022-20700

Name of the Vulnerable Software and Affected Versions Online Car Wash Booking System version 1.0 Description The issue concerns a SQL Injection vulnerability. It can be exploited via the /ocwbs/classes/Master.php API endpoint, specifically when the f parameter is set to delete booking...

PT-2022-21004

Name of the Vulnerable Software and Affected Versions ChatBot App with Suggestion version 1.0 Description The issue allows deletion of any file via the /simple chat bot/classes/Master.php API endpoint with the f parameter set to delete img. Recommendations For ChatBot App with Suggestion version...

PT-2022-20130

Name of the Vulnerable Software and Affected Versions Automotive Shop Management System version 1.0 Description The issue concerns a SQL Injection vulnerability. It can be exploited via the /asms/classes/Master.php?f=delete product API endpoint. Recommendations For Automotive Shop Management Syst...

PT-2022-20088

Name of the Vulnerable Software and Affected Versions Merchandise Online Store version 1.0 Description The issue concerns a SQL Injection vulnerability. It can be exploited via the /vloggers merch/classes/Master.php?f=pay order endpoint, specifically through the f parameter set to pay order...

PT-2022-20092

Name of the Vulnerable Software and Affected Versions Merchandise Online Store version 1.0 Description The issue concerns SQL Injection. It can be exploited via the /vloggers merch/classes/Master.php?f=delete cart endpoint, specifically through the f parameter set to delete cart. Recommendations...

PT-2022-20105

Name of the Vulnerable Software and Affected Versions Covid-19 Travel Pass Management System version 1.0 Description The issue concerns a SQL Injection vulnerability. It can be exploited via the /ctpms/classes/Master.php API endpoint, specifically when the f parameter is set to delete application...

PT-2022-20086

Name of the Vulnerable Software and Affected Versions Merchandise Online Store version 1.0 Description The issue concerns a SQL Injection vulnerability. It can be exploited via the /vloggers merch/classes/Master.php?f=delete order API endpoint. Recommendations For Merchandise Online Store version...

PT-2022-20087

Name of the Vulnerable Software and Affected Versions Merchandise Online Store version 1.0 Description The issue concerns SQL Injection. It can be exploited via the /vloggers merch/classes/Master.php API endpoint, specifically when the f parameter is set to delete featured. Recommendations For...

PT-2022-19811

Name of the Vulnerable Software and Affected Versions Money Transfer Management System version 1.0 Description The issue concerns a SQL Injection vulnerability. It can be exploited via the Master.php file, specifically through the f parameter set to delete fee. Recommendations For Money Transfer...

PT-2022-19009

Name of the Vulnerable Software and Affected Versions Home Owners Collection Management System version 1.0 Description A SQL injection issue was found in the Home Owners Collection Management System. The vulnerability can be exploited via the /hocms/classes/Master.php API endpoint, specifically...

PT-2022-18762

Name of the Vulnerable Software and Affected Versions Purchase Order Management System version 1.0 Description A SQL injection issue was found in the Purchase Order Management System. The vulnerability can be exploited via the /purchase order/classes/Master.php API endpoint, specifically through...

PT-2022-19004

Name of the Vulnerable Software and Affected Versions Car Driving School Managment System version 1.0 Description A SQL injection issue was found in the Car Driving School Managment System. The vulnerability can be exploited via the /cdsms/classes/Master.php API endpoint, specifically when the f...

PT-2022-19005

Name of the Vulnerable Software and Affected Versions Car Driving School Management System version 1.0 Description A SQL injection issue was found in the Car Driving School Management System. The vulnerability can be exploited via the /cdsms/classes/Master.php API endpoint, specifically through t...

PT-2022-19008

Name of the Vulnerable Software and Affected Versions Home Owners Collection Management System version 1.0 Description A SQL injection issue was found in the Home Owners Collection Management System. The vulnerability can be exploited via the /hocms/classes/Master.php API endpoint, specifically...

PT-2022-18768

Name of the Vulnerable Software and Affected Versions Simple Real Estate Portal System version 1.0 Description A SQL injection issue was found in the Simple Real Estate Portal System. The vulnerability can be exploited via the /reps/classes/Master.php API endpoint, specifically when the f paramet...

PT-2022-19007

Name of the Vulnerable Software and Affected Versions Home Owners Collection Management System version 1.0 Description A SQL injection issue was found in the Home Owners Collection Management System. The vulnerability can be exploited via the /hocms/classes/Master.php API endpoint, specifically...