CVE-2020-29205

XSS in signup form in Project Worlds Online Examination System 1.0 allows remote attacker to inject arbitrary code via the name field...

CVE-2020-29205

CVE-2020-29205 affects SourceCodester Worlds Online Examination System 1.0. An XSS vulnerability exists in the signup form where an attacker can inject arbitrary code via the name field. Root cause appears to be insufficient input sanitization in the signup logic. Impact is described as cross-sit...

CVE-2020-29205

XSS in signup form in Project Worlds Online Examination System 1.0 allows remote attacker to inject arbitrary code via the name field...

Student Result Management System 1.0 SQL Injection

Exploit Title: Student Result Management System 1.0 - Multiple SQL Injection Vulnerabilities Date: 2020-10-02 Exploit Author: b1nary Vendor Homepage: https://projectworlds.in/free-projects/php-projects/student-result-management-system-project-in-php/ Software Link:...

Remote code execution

Arbitrary File Upload in the Vehicle Image Upload component in Project Worlds Car Rental Management System v1.0 allows attackers to conduct remote code execution...

CVE-2020-24199

Arbitrary File Upload in the Vehicle Image Upload component in Project Worlds Car Rental Management System v1.0 allows attackers to conduct remote code execution...

Car Rental Management System 1.0 Remote Code Execution

Exploit Title: Car Rental Management System v1.0 - Unauthenticated RCE Exploit Author: Adeeb Shah @hyd3sec Shout out: Bobby Cooke boku Date: August 3, 2020 Vendor Homepage: https://projectworlds.in Software Link:...

Design/Logic Flaw

An issue was discovered in Project Worlds Official Car Rental System 1. It allows the admin user to run commands on the server with their account because the upload section on the file-manager page contains an arbitrary file upload vulnerability via addcars.php. There are no upload restrictions f...

CVE-2020-11544

Project Worlds Official Car Rental System 1 contains an arbitrary file upload vulnerability in the file-manager upload section (add_cars.php). There are no restrictions on executable file uploads, allowing an admin to run commands on the server with their account. The connected reports confirm th...

CVE-2020-11545

Project Worlds Official Car Rental System 1 is vulnerable to multiple SQL injection issues, as demonstrated by the email and parameters account.php, uname and pass parameters login.php, and id parameter bookcar.php This allows an attacker to dump the MySQL database and to bypass the login...