PT-2024-20874 · Code Projects · Code-Projects Simple School Managment System

Name of the Vulnerable Software and Affected Versions: Code-projects Simple School Managment System version 1.0 Description: The issue allows Authentication Bypass via the username and password parameters at the "School/index.php" endpoint. Recommendations: For Code-projects Simple School Managme...

CVE-2024-25306: Improper Neutralization of Special Elements used in an SQL Command

Code-projects Simple School Managment System 1.0 allows SQL Injection via the 'aname' parameter at "School/index.php"...

CVE-2024-25305: Improper Neutralization of Special Elements used in an SQL Command

Code-projects Simple School Managment System 1.0 allows Authentication Bypass via the username and password parameters at School/index.php...

CVE-2024-25304: Improper Neutralization of Special Elements used in an SQL Command

Code-projects Simple School Managment System 1.0 allows SQL Injection via the 'apass' parameter at "School/index.php."...

CVE-2024-24393

CVE-2024-24393 : Pichome v1.1.01 contains an index.php file upload vulnerability that allows a remote attacker to execute arbitrary code via a crafted POST request. Severity is high (CVSS v3.1: 9.8, Network, No user interaction). Connected sources corroborate a remote code execution impact from a...

PT-2024-20380

Name of the Vulnerable Software and Affected Versions Pichome version 1.1.01 Description A remote attacker can execute arbitrary code via a crafted POST request to the index.php file, exploiting a File Upload vulnerability. This allows for unrestricted file upload, potentially leading to code...

CVE-2024-24393: Unrestricted Upload of File with Dangerous Type

File Upload vulnerability index.php in Pichome v.1.1.01 allows a remote attacker to execute arbitrary code via crafted POST request...

CVE-2024-22569

POSCMS v4.6.2 contains a Stored XSS vulnerability. A crafted payload to /index.php?c=install&m=index&step=2&is_install_db=0 can cause arbitrary code execution. The connected PT-2024-19489 advisory notes a workaround to restrict access to that endpoint until a patch is available; no patch/version ...

CVE-2024-22569: Improper Neutralization of Input During Web Page Generation

Stored Cross-Site Scripting XSS vulnerability in POSCMS v4.6.2, allows attackers to execute arbitrary code via a crafted payload to /index.php?c=install&m=index&step=2&isinstalldb=0...

CVE-2023-51813

CVE-2023-51813 describes a CSRF vulnerability in the Free Open-Source Inventory Management System v1.0. The issue arises via the staff_list parameter in the index.php component, allowing a remote attacker to execute arbitrary code. The available documents do not specify affected build details bey...

CVE-2023-51813: Cross-Site Request Forgery (CSRF)

Cross Site Request Forgery CSRF vulnerability in Free Open-Source Inventory Management System v.1.0 allows a remote attacker to execute arbitrary code via the stafflist parameter in the index.php component...

CVE-2024-0958: Improper Neutralization of Input During Web Page Generation

A vulnerability was found in CodeAstro Stock Management System 1.0 and classified as problematic. This issue affects some unknown processing of the file /index.php of the component Add Category Handler. The manipulation of the argument Category Name/Category Description leads to cross site...

CVE-2024-0946: Server-Side Request Forgery (SSRF)

A vulnerability classified as critical was found in 60IndexPage up to 1.8.5. This vulnerability affects unknown code of the file /apply/index.php of the component Parameter Handler. The manipulation of the argument url leads to server-side request forgery. The attack can be initiated remotely. Th...

CVE-2024-22922

An issue in Projectworlds Vistor Management Systemin PHP v.1.0 allows a remtoe attacker to escalate privileges via a crafted script to the login page in the POST/index.php...

CVE-2024-22922

An issue in Projectworlds Vistor Management Systemin PHP v.1.0 allows a remtoe attacker to escalate privileges via a crafted script to the login page in the POST/index.php...

PT-2024-20384

Name of the Vulnerable Software and Affected Versions LeptonCMS version 7.0.0 Description An arbitrary file upload vulnerability allows authenticated attackers to execute arbitrary PHP code by uploading crafted PHP files to the backend/languages/index.php languages area. This enables the executio...

CVE-2024-22922: Improper Privilege Management

An issue in Projectworlds Vistor Management Systemin PHP v.1.0 allows a remtoe attacker to escalate privileges via a crafted script to the login page in the POST/index.php...

CVE-2024-24399: Unrestricted Upload of File with Dangerous Type

An arbitrary file upload vulnerability in LEPTON v7.0.0 allows authenticated attackers to execute arbitrary PHP code by uploading this code to the backend/languages/index.php languages area...

Sql injection

A vulnerability was found in CXBSoft Url-shorting up to 1.3.1. It has been rated as critical. Affected by this issue is some unknown functionality of the file index.php. The manipulation of the argument url leads to sql injection. The exploit has been disclosed to the public and may be used...

CVE-2024-0524 CXBSoft Url-shorting index.php sql injection

A vulnerability was found in CXBSoft Url-shorting up to 1.3.1. It has been rated as critical. Affected by this issue is some unknown functionality of the file index.php. The manipulation of the argument url leads to sql injection. The exploit has been disclosed to the public and may be used...