CVE-2021-41649

CVE-2021-41649 CVE-2021-41649 Inyección SQL en online-shopping-system El online-shopping-system es vulnerable a ataques de inyección SQL de tipo error/boolean-based blind y error-based sin autenticación. El parámetro catid en la página /homeaction.php no sanitiza la entrada del usuario, por lo qu...

CVE-2021-41648

CVE-2021-41648 CVE-2021-41648 Inyección SQL en online-shopping-system El sistema online-shopping-system es vulnerable a ataques de inyección SQL no autenticados, ciegos basados en errores/booleanos y basados en errores. El parámetro proId en la página /action.php no sanitiza la entrada del usuari...

CVE-2024-50968

CVE-2024-50968 描述 itsourcecode Agri-Trading Online Shopping System 1.0 的“添加到购物车”功能存在业务逻辑漏洞，允许远程攻击者在向购物车添加产品时操纵 quant 参数。通过将数量值设置为 -0，攻击者可以利用应用程序总价计算逻辑中的缺陷。此漏洞导致总价降至零，使攻击者能够将商品添加到购物车并继续结账。 漏洞类型 业务逻辑漏洞 产品供应商 itsourcecode 受影响产品代码库： Agri-Trading Online Shopping System - 1.0 受影响组件： 其 sourcecode...

CVE-2024-40498

CVE-2024-40498 Aplicación afectada online-shopping-system-advanced 1.0 https://github.com/PuneethReddyHC/online-shopping-system-advanced Descripción El archivo register.php gestiona el registro de usuarios. En la línea 117, los parámetros POST "$address1" and $address2" no están sanitizados, a...

PuneethReddyHC Online Shopping System homeaction.php SQL Injection

An unauthenticated SQL injection vulnerability exists in PuneethReddyHC Online Shopping System through the /homeaction.php catid parameter. Using a post request does not sanitize the user input. id: CVE-2021-41649 info: name: PuneethReddyHC Online Shopping System homeaction.php SQL Injection...

CVE-2025-52021

CVE-2025-52021 — Inyección SQL Ciega Basada en Tiempo en PuneethReddyHC / Online Shopping System Advanced v1.0 CVE: CVE-2025-52021 Título: Inyección SQL Ciega Basada en Tiempo a través del parámetro productid en editproduct.php Vendor / Repo: PuneethReddyHC —...

CVE-2025-51970

CVE-2025-51970 CVE-2025-51970 - Inyección SQL en Online Shopping System Advanced Resumen Se descubrió una vulnerabilidad crítica de inyección SQL en el proyecto Online Shopping System Advanced de PuneethReddyHC. La falla reside en action.php, que no sanea adecuadamente la entrada del usuario...

CVE-2025-61246

CVE-2025-61246 - Vulnerabilidad de Inyección SQL en Sistema de Compras en Línea Descripción general Este repositorio contiene una Prueba de Concepto PoC para CVE-2025-61246 , una vulnerabilidad crítica de Inyección SQL descubierta en la aplicación PHP Sistema de Compras en Línea. La vulnerabilida...

CVE-2026-85643

A flaw has been found in code-projects Online Shopping System 1.0. Impacted is the function mysqliquery of the file admin/adduser.php. Executing a manipulation of the argument mobile can lead to sql injection. The attack may be performed from remote. The exploit has been published and may be used...

CVE-2026-85643 code-projects Online Shopping System adduser.php mysqli_query sql injection

A flaw has been found in code-projects Online Shopping System 1.0. Impacted is the function mysqliquery of the file admin/adduser.php. Executing a manipulation of the argument mobile can lead to sql injection. The attack may be performed from remote. The exploit has been published and may be used...

CVE-2026-85643

code-projects Online Shopping System 1.0 is vulnerable to SQL injection in the mysqli_query function within admin/adduser.php , via manipulation of the mobile argument. The attack is exploitable remotely but requires high privileges (authenticated admin access). CVSS 3.1 scores it 4.7 (MEDIUM) wi...

EUVD-2026-71713

A flaw has been found in code-projects Online Shopping System 1.0. Impacted is the function mysqliquery of the file admin/adduser.php. Executing a manipulation of the argument mobile can lead to sql injection. The attack may be performed from remote. The exploit has been published and may be used...

CVE-2026-85643 code-projects Online Shopping System adduser.php mysqli_query sql injection

A flaw has been found in code-projects Online Shopping System 1.0. Impacted is the function mysqliquery of the file admin/adduser.php. Executing a manipulation of the argument mobile can lead to sql injection. The attack may be performed from remote. The exploit has been published and may be used...

PT-2026-86240

A flaw has been found in code-projects Online Shopping System 1.0. Impacted is the function mysqli query of the file admin/adduser.php. Executing a manipulation of the argument mobile can lead to sql injection. The attack may be performed from remote. The exploit has been published and may be use...

CVE-2026-85643: Improper Neutralization of Special Elements used in an SQL Command

A flaw has been found in code-projects Online Shopping System 1.0. Impacted is the function mysqliquery of the file admin/adduser.php. Executing a manipulation of the argument mobile can lead to sql injection. The attack may be performed from remote. The exploit has been published and may be used...

CVE-2026-82701

A vulnerability was determined in code-projects Online Shopping System 1.0. Affected by this issue is some unknown functionality of the file /action.php of the component Search Functionality. This manipulation of the argument keyword causes sql injection. It is possible to initiate the attack...

CVE-2026-82700

A vulnerability was found in code-projects Online Shopping System 1.0. Affected by this vulnerability is an unknown functionality of the file /offersmail.php of the component Newsletter Subscription. The manipulation of the argument email results in cross site scripting. The attack may be perform...

CVE-2026-82701 code-projects Online Shopping System Search Functionality action.php sql injection

A vulnerability was determined in code-projects Online Shopping System 1.0. Affected by this issue is some unknown functionality of the file /action.php of the component Search Functionality. This manipulation of the argument keyword causes sql injection. It is possible to initiate the attack...

EUVD-2026-68594

A vulnerability was determined in code-projects Online Shopping System 1.0. Affected by this issue is some unknown functionality of the file /action.php of the component Search Functionality. This manipulation of the argument keyword causes sql injection. It is possible to initiate the attack...

CVE-2026-82701

A SQL injection vulnerability exists in the Search Functionality of code-projects Online Shopping System 1.0 , specifically in the keyword parameter of /action.php. An unauthenticated remote attacker can manipulate this argument to inject SQL, achieving low impact on confidentiality, integrity, a...