Purchase Order Management 跨站脚本漏洞

Sourcecodester Purchase Order Management System is a simple purchase order management system used to manage the purchase order records of a particular company. A security vulnerability exists in Purchase Order Management v1.0, which was discovered to contain a Reflected Cross Site Scripting XSS...

PT-2023-22335

Name of the Vulnerable Software and Affected Versions Purchase Order Management version 1.0 Description The issue is related to a reflected cross-site scripting XSS vulnerability. This vulnerability occurs via the password parameter at the "/purchase order/classes/login.php" API endpoint...

CVE-2023-29622

Purchase Order Management v1.0 was discovered to contain a SQL injection vulnerability via the password parameter at /purchaseorder/admin/login.php...

CVE-2023-29622

Purchase Order Management v1.0 was discovered to contain a SQL injection vulnerability via the password parameter at /purchaseorder/admin/login.php...

CVE-2023-29623

Purchase Order Management v1.0 was discovered to contain a reflected cross-site scripting XSS vulnerability via the password parameter at /purchaseorder/classes/login.php...

CVE-2023-29621

Purchase Order Management v1.0 was discovered to contain an arbitrary file upload vulnerability which allows attackers to execute arbitrary code via a crafted file uploaded to the server...

PT-2023-22334 · Unknown · Purchase Order Management

Name of the Vulnerable Software and Affected Versions: Purchase Order Management version 1.0 Description: The issue is related to a SQL injection vulnerability. This vulnerability can be exploited via the password parameter at the "/purchase order/admin/login.php" API endpoint. Recommendations: F...

CVE-2023-29622

CVE-2023-29622 affects Purchase Order Management v1.0 via a SQL injection in /purchase_order/admin/login.php using the password parameter. Affected software/component: Purchase Order Management v1.0. Root cause: insufficient input sanitization leading to arbitrary SQL execution. Impact per source...

CVE-2023-29621

CVE-2023-29621 concerns Purchase Order Management v1.0, where an arbitrary file upload vulnerability may allow attackers to execute arbitrary code on the server via crafted uploads. The provided connected documents confirm the affected software and the underlying issue, but do not specify any ven...

PT-2023-22333

Name of the Vulnerable Software and Affected Versions Purchase Order Management version 1.0 Description The issue allows attackers to execute arbitrary code via a crafted file uploaded to the server. This is due to an arbitrary file upload vulnerability. Recommendations For Purchase Order...

CVE-2023-29621: Unrestricted Upload of File with Dangerous Type

Purchase Order Management v1.0 was discovered to contain an arbitrary file upload vulnerability which allows attackers to execute arbitrary code via a crafted file uploaded to the server...

What is Cloud Mining and How Does it Work?

By Owais Sultan Cloud mining is a way for you to purchase mining power from a remote data centre. Cloud mining… This is a post from HackRead.com Read the original post: What is Cloud Mining and How Does it Work?...

What is Cloud Mining and How Does it Work?

By Owais Sultan Cloud mining is a way for you to purchase mining power from a remote data centre. Cloud mining… This is a post from HackRead.com Read the original post: What is Cloud Mining and How Does it Work?...

Purchase Order Management-1.0 - Local File Inclusion

Title: Purchase Order Management-1.0 - Local File Inclusion Author: nu11secur1ty Date: 03.06.2023 Vendor: https://www.sourcecodester.com/user/257130/activity Software: https://www.sourcecodester.com/php/14935/purchase-order-management-system-using-php-free-source-code.html Reference:...

Bond max-buyer might end up buying the max buy of the next epoch

Lines of code Vulnerability details The MuteBond.deposit function allows users to specify the amount of value they want to purchase bonds for or to set maxbuy to true. If maxbuy is set to true the amount specified in the value parameter is ignored and instead the maximum amount available for...

Attacker can front-run Bond buyer and make them buy it for a lower payout than expected

Lines of code Vulnerability details The MuteBond contract contains a feature in which after each purchase the epochStart increases by 5% of the time passed since epochStart, this in most cases lowers the bond's price i.e. buyer gets less payout for future purchases. An attacker can exploit this...

The price fee for fusion characters is incorrect.

Lines of code Vulnerability details Vulnerability details Price fee for fusion characters is incorrect. According to the docs Fusing To fuse a namespace NFT, the user specifies the trays and the tiles offsets within the trays to use. Note that the whole tray is always burned, even if you only use...

DEV-1101 enables high-volume AiTM campaigns with open-source phishing kit

Adversary-in-the-middle AiTM phishing kits are part of an increasing trend that is observed supplanting many other less advanced forms of phishing. AiTM phishing is capable of circumventing multifactor authentication MFA through reverse-proxy functionality. DEV-1101 is an actor tracked by Microso...

drawCoolDownPeriod of 0 may allow frontrunning the draw with a winning ticket purchase

Lines of code Vulnerability details Impact Frontiness rather than luck may determine the winner. Proof of Concept drawCoolDownPeriod may be set to 0. Then a ticket may be bought in the same block as the draw. This allows for frontrunning the randomly selected winning ticket with a ticket purchase...

Purchase Order Management 1.0 SQL Injection

Title: Purchase Order Management-1.0 - SQLi Author: nu11secur1ty Date: 03.06.2023 Vendor: https://www.sourcecodester.com/user/257130/activity Software: https://www.sourcecodester.com/php/14935/purchase-order-management-system-using-php-free-source-code.html Reference:...