Employee Management System 1.0 - Cross Site Scripting (Stored)

Exploit Title: Employee Management System 1.0 - Stored Cross Site Scripting Date: 2020-10-16 Exploit Author: Ankita Pal Vendor Homepage: https://www.sourcecodester.com/php/14432/employee-management-system-using-php.html Software Link:...

CVE-2020-25272

CVE-2020-25272 corresponds to an XSS vulnerability in SourceCodester Online Bus Booking System 1.0, triggered via the name parameter in book_now.php. The available connected documents confirm the affected product and the vulnerability vector, but do not provide details on the exploitation status,...

CVE-2020-24193

A SQL injection vulnerability in login in Sourcecodetester Daily Tracker System 1.0 allows unauthenticated user to execute authentication bypass with SQL injection via the email parameter...

Authentication flaw

Kabir Alhasan Student Management System 1.0 is vulnerable to Authentication Bypass via "Username: admin' && Password: Write Something"...

School ERP System 1.0 Cross Site Request Forgery

Title: School ERP System 1.0 - Cross Site Request Forgery Add Admin Date: 2020-01-31 Exploit Author: J3rryBl4nks Vendor Homepage: https://sourceforge.net/projects/school-erp-ultimate/files/ Software Link: https://sourceforge.net/projects/school-erp-ultimate/files/ Version ERP-Ultimate Tested on...

School ERP System 1.0 - Cross Site Request Forgery (Add Admin)

Title: School ERP System 1.0 - Cross Site Request Forgery Add Admin Date: 2020-01-31 Exploit Author: J3rryBl4nks Vendor Homepage: https://sourceforge.net/projects/school-erp-ultimate/files/ Software Link: https://sourceforge.net/projects/school-erp-ultimate/files/ Version ERP-Ultimate CVE:...

Design/Logic Flaw

uploadimage.php in Employee Records System 1.0 allows upload and execution of arbitrary PHP code because file-extension validation is only on the client side. The attacker can modify global.js to allow the .php extension...

Cross site scripting

Sourcecodester Restaurant Management System 1.0 allows XSS via the "send a message" screen...

Adapt Inventory Management System 1.0 - SQL Injection

Adapt Inventory Management System 1.0 - SQL Injection Exploit Title: Adapt Inventory Management System 1.0 - SQL Injection Dork: N/A Date: 2019-01-10 Exploit Author: Ihsan Sencan Vendor Homepage: https://www.adaptinventory.com/ Software Link:...

Sql injection

internal/advancedcommentsystem/admin.php in Advanced Comment System 1.0 is prone to an SQL injection vulnerability because it fails to sufficiently sanitize user-supplied data before using it in an SQL query, allowing remote attackers to execute the sqli attack via a URL in the "page" parameter...

CVE-2018-18619

CVE-2018-18619 : The vulnerability affects the web app Advanced Comment System 1.0 , in the file internal/advanced_comment_system/admin.php . It is prone to an SQL injection because user-supplied data is not sufficiently sanitized before use in an SQL query, enabling remote attackers to trigger t...

CVE-2018-18797

School Attendance Monitoring System 1.0 has CSRF via /user/user/edit.php...

Design/Logic Flaw

School Event Management System 1.0 allows Arbitrary File Upload via event/controller.php?action=photos...

CVE-2018-18806

The CVE-2018-18806 vulnerability affects School Equipment Monitoring System 1.0. An SQL injection exists in the login flow, related to include/user.vb, enabling manipulation of the backend database according to sources such as NVD and CNVD. Public exploit content (Exploit-DB, ExploitPack, and 0da...

CVE-2018-18797

School Attendance Monitoring System 1.0 has CSRF via /user/user/edit.php...

CVE-2018-18795

School Event Management System 1.0 has SQL Injection via the student/index.php or event/index.php id parameter...

Facturation System 1.0 - modid SQL Injection Vulnerability

Exploit for php platform in category web applications Exploit Title: Facturation System 1.0 - 'modid' SQL Injection Exploit Author: Ihsan Sencan Vendor Homepage: http://obedalvarado.pw/simple-invoice/ Software Link: https://kent.dl.sourceforge.net/project/simple-invoice/simple-invoice-master.zip...

School Event Management System 1.0 - Cross-Site Request Forgery (Update Admin) Vulnerability

Exploit for php platform in category web applications Exploit Title: School Event Management System 1.0 - Cross-Site Request Forgery Update Admin Exploit Author: Ihsan Sencan Vendor Homepage: https://www.sourcecodester.com/users/janobe Software Link:...

Library Management System 1.0 - frmListBooks SQL Injection Vulnerability

Exploit for asp platform in category web applications Exploit Title: Library Management System 1.0 - 'frmListBooks' SQL Injection Exploit Author: Ihsan Sencan Vendor Homepage: https://www.sourcecodester.com/users/janobe Software Link:...

School Equipment Monitoring System 1.0 SQL Injection

Exploit Title: School Equipment Monitoring System 1.0 - 'login' SQL Injection Dork: N/A Date: 2018-10-29 Exploit Author: Ihsan Sencan Vendor Homepage: https://www.sourcecodester.com/users/janobe Software Link: https://www.sourcecodester.com/sites/default/files/download/janobe/sems0.zip Version: 1...