CVE-2025-7840

CVE-2025-7840 XSS 익스플로잇 저자 : Byte Reaper @ByteReaper0 설명 CVE-2025-7840 에 대한 개념 증명 익스플로잇입니다. 취약한 웹 애플리케이션 엔드포인트 중 예약 양식의 Firstname 매개변수에서 사용자 입력을 적절히 검사하지 않는 문제를 대상으로 합니다. 다음과 같은 GET 요청을 구성하면: /index.php?page=reserve&Firstname=&Lastname=test 공격자가 응답이 렌더링될 때 피해자의 브라우저에서 임의의 JavaScript를 삽입하고 실행할 수...

CVE-2023-49971

CVE-2023-49971 Customer Support System 1.0 - "firstname" 필드/매개변수의 Cross-Site Scripting XSS 취약점 "customerlist" 페이지 설명 : Customer Support System 1.0은 저장형 XSS에 취약합니다. Customer Support System 버전 1에 XSS 취약점이 존재합니다. 악의적인 공격자는 고객 편집/생성 시 "firstname" 필드/매개변수를 통해 JavaScript 코드를 삽입할 수 있습니다. 이 코드는...

SQL Injection Vulnerability in Sales and Inventory System (CNVD-2026-37981)

Sales and Inventory System is an enterprise resource planning system for sales and inventory management developed by itsourcecode. The Sales and Inventory System has a SQL injection vulnerability, which stems from incorrect handling of the parameter “firstname” in the...

CVE-2026-90574

A security flaw has been discovered in itsourcecode Sales and Inventory System 1.0. This affects an unknown function of the file /pages/emptransac.php?action=add. The manipulation of the argument firstname results in sql injection. The attack may be performed from remote. The exploit has been...

EUVD-2026-77055

A security flaw has been discovered in itsourcecode Sales and Inventory System 1.0. This affects an unknown function of the file /pages/emptransac.php?action=add. The manipulation of the argument firstname results in sql injection. The attack may be performed from remote. The exploit has been...

CVE-2026-90574

CVE-2026-90574 affects itsourcecode Sales and Inventory System 1.0 , specifically the file /pages/emp_transac.php?action=add. The SQL injection is triggered by manipulating the firstname argument, allowing a remote attacker with low privileges to compromise data. CVSS 3.1 scores it 6.3 (MEDIUM) w...

CVE-2026-90574 itsourcecode Sales and Inventory System emp_transac.php add sql injection

A security flaw has been discovered in itsourcecode Sales and Inventory System 1.0. This affects an unknown function of the file /pages/emptransac.php?action=add. The manipulation of the argument firstname results in sql injection. The attack may be performed from remote. The exploit has been...

CVE-2026-90525

A weakness has been identified in itsourcecode Sales and Inventory System 1.0. This affects an unknown function of the file /pages/custpostrans.php. Executing a manipulation of the argument firstname can lead to sql injection. The attack may be launched remotely. The exploit has been made availab...

CVE-2026-90525

CVE-2026-90525 affects itsourcecode Sales and Inventory System 1.0 , where a SQL injection vulnerability exists in the file /pages/cust_pos_trans.php. By manipulating the firstname parameter, an unauthenticated remote attacker can inject SQL, leading to low impact on confidentiality, integrity, a...

EUVD-2026-77023

A weakness has been identified in itsourcecode Sales and Inventory System 1.0. This affects an unknown function of the file /pages/custpostrans.php. Executing a manipulation of the argument firstname can lead to sql injection. The attack may be launched remotely. The exploit has been made availab...

CVE-2026-90525 itsourcecode Sales and Inventory System cust_pos_trans.php sql injection

A weakness has been identified in itsourcecode Sales and Inventory System 1.0. This affects an unknown function of the file /pages/custpostrans.php. Executing a manipulation of the argument firstname can lead to sql injection. The attack may be launched remotely. The exploit has been made availab...

CVE-2026-90525 itsourcecode Sales and Inventory System cust_pos_trans.php sql injection

A weakness has been identified in itsourcecode Sales and Inventory System 1.0. This affects an unknown function of the file /pages/custpostrans.php. Executing a manipulation of the argument firstname can lead to sql injection. The attack may be launched remotely. The exploit has been made availab...

CVE-2026-90574: Improper Neutralization of Special Elements used in an SQL Command

A security flaw has been discovered in itsourcecode Sales and Inventory System 1.0. This affects an unknown function of the file /pages/emptransac.php?action=add. The manipulation of the argument firstname results in sql injection. The attack may be performed from remote. The exploit has been...

PT-2026-90862

Name of the Vulnerable Software and Affected Versions itsourcecode Sales and Inventory System version 1.0 Description A remote SQL injection exists in the /pages/cust pos trans.php endpoint. This issue occurs when the firstname variable is manipulated, allowing an attacker to execute unauthorized...

CVE-2026-90525: Improper Neutralization of Special Elements used in an SQL Command

A weakness has been identified in itsourcecode Sales and Inventory System 1.0. This affects an unknown function of the file /pages/custpostrans.php. Executing a manipulation of the argument firstname can lead to sql injection. The attack may be launched remotely. The exploit has been made availab...

PT-2026-90931

Name of the Vulnerable Software and Affected Versions itsourcecode Sales and Inventory System version 1.0 Description A remote SQL injection flaw exists in the file /pages/emp transac.php?action=add. The issue occurs when the firstname argument is manipulated, allowing an attacker to execute...

EUVD-2026-72182

A vulnerability was detected in itsourcecode Sales and Inventory System 1.0. This affects an unknown part of the file /pages/custtransac.php?action=add. The manipulation of the argument firstname results in sql injection. It is possible to launch the attack remotely. The exploit is now public and...

CVE-2026-86234

A vulnerability was detected in itsourcecode Sales and Inventory System 1.0. This affects an unknown part of the file /pages/custtransac.php?action=add. The manipulation of the argument firstname results in sql injection. It is possible to launch the attack remotely. The exploit is now public and...

CVE-2026-86234: Improper Neutralization of Special Elements used in an SQL Command

A vulnerability was detected in itsourcecode Sales and Inventory System 1.0. This affects an unknown part of the file /pages/custtransac.php?action=add. The manipulation of the argument firstname results in sql injection. It is possible to launch the attack remotely. The exploit is now public and...

CVE-2026-86234 itsourcecode Sales and Inventory System cust_transac.php add sql injection

A vulnerability was detected in itsourcecode Sales and Inventory System 1.0. This affects an unknown part of the file /pages/custtransac.php?action=add. The manipulation of the argument firstname results in sql injection. It is possible to launch the attack remotely. The exploit is now public and...