PT-2023-17137 · Otcms · Otcms

Name of the Vulnerable Software and Affected Versions: OTCMS version 6.72 Description: A vulnerability was found in the function AutoRun of the file apiRun.php. The manipulation of the argument mode leads to cross-site scripting. The attack can be launched remotely. Recommendations: For OTCMS...

PT-2023-17039 · Unknown · Sourcecodester Alphaware Simple E-Commerce System

Name of the Vulnerable Software and Affected Versions: SourceCodester Alphaware Simple E-Commerce System version 1.0 Description: A critical issue has been found in the SourceCodester Alphaware Simple E-Commerce System, affecting an unknown part of the file admin/admin index.php. The manipulation...

PT-2023-16919 · Sourcecodester · Sourcecodester Computer Parts Sales/Inventory System

Name of the Vulnerable Software and Affected Versions: SourceCodester Computer Parts Sales and Inventory System version 1.0 Description: A critical vulnerability has been found in the system, affecting an unknown part of the file cust transac.php. The manipulation of the phonenumber argument lead...

EXIF Geolocation Data Not Stripped From brand logo

When the user uploads his logo, the uploaded image’s EXIF Geo-location Data does not get stripped. As a result, anyone can get sensitive information like user's Device ID, Geo Location, System Information, System version, ETC. Step to reproduce: 1. Upload logo with EXIF DATA, or download from her...

PT-2023-16874 · Unknown · Sourcecodester File Tracker Manager System

Name of the Vulnerable Software and Affected Versions: SourceCodester File Tracker Manager System version 1.0 Description: A problematic issue was found in the SourceCodester File Tracker Manager System, affecting an unknown part of the file normal/borrow1.php. The manipulation of the id argument...

CVE-2023-24653

Simple Customer Relationship Management System v1.0 was discovered to contain a SQL injection vulnerability via the oldpass parameter under the Change Password function...

Online Graduate Tracer System SQL注入漏洞

Online Graduate Tracer System is an online graduate tracer system by the individual developer Carlo Montero. SourceCodester Online Graduate Tracer System version 1.0 suffers from a SQL injection vulnerability that stems from incorrect manipulation of the parameter id resulting in sql injection...

CVE-2021-3855 Command Injection in Liman Central Management System

Improper Neutralization of Special Elements used in a Command 'Command Injection' vulnerability in Liman Central Management System Liman MYS HTTP/Controllers, CronMail, Jobs modules allows Command Injection. This issue affects Liman Central Management System: from 1.7.0 before 1.8.3-462...

CVE-2023-22804

LS ELECTRIC XBC-DN32U with operating system version 01.80 is missing authentication to create users on the PLC. This could allow an attacker to create and use an account with elevated privileges and take control of the device...

SUSE CVE-2019-14194

An issue was discovered in Das U-Boot through 2019.07. There is an unbounded memcpy with a failed length check at nfsreadreply when calling storeblock in the NFSv2 case...

Online Tours & Travels Management System SQL注入漏洞

Online Tours & Travels Management System is an online travel management system by Mayuri K. Individual developer. A SQL injection vulnerability exists in Online Tours & Travels Management System version 1.0, which stems from an incorrect manipulation of the parameter bookingid that can lead to sq...

PT-2023-14970 · Unknown · Online Graduate Tracer System

Name of the Vulnerable Software and Affected Versions: Online Graduate Tracer System version 1.0.0 Description: A cross-site scripting issue allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the name parameter. Recommendations: For Online Graduate Trace...

CVE-2022-48091

Tramyardg hotel-mgmt-system version 2022.4 is vulnerable to Cross Site Scripting XSS via processupdateprofile.php...

CVE-2022-46956

Dynamic Transaction Queuing System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /admin/manageuser.php...

PT-2022-27165 · Unknown · Automotive Shop Management System

Name of the Vulnerable Software and Affected Versions: Automotive Shop Management System version 1.0 Description: The issue allows deletion of any file via the "/asms/classes/Master.php?f=delete img" API endpoint. Recommendations: For Automotive Shop Management System version 1.0, as a temporary...

PT-2022-25395 · Unknown · Phpgurukul Blood Bank & Donor Management System

Name of the Vulnerable Software and Affected Versions: Phpgurukul Blood Donor Management System version 1.0 Description: The issue allows Cross Site Scripting via the Add Blood Group Name Feature. Recommendations: For Phpgurukul Blood Donor Management System version 1.0, consider disabling the Ad...

CVE-2022-43352

Sanitization Management System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /php-sms/classes/Master.php?f=deletequote...

Food Ordering Management System 跨站脚本漏洞

Food Ordering Management System is a food ordering management system by Carlo Montero personal developer. It provides an online platform to order food from a restaurant or fast food chain. A security vulnerability exists in Food Ordering Management System v1.0, which was discovered to contain a...

CVE-2022-43226

Online Diagnostic Lab Management System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /odlms/?page=appointments/viewappointment...

PT-2022-26767 · Unknown · Online Diagnostic Lab Management System

Name of the Vulnerable Software and Affected Versions: Online Diagnostic Lab Management System version 1.0 Description: The issue is related to a SQL injection vulnerability. This vulnerability can be exploited via the id parameter at the "/appointments/update status.php" API endpoint...