CVE-2021-41649

CVE-2021-41649 CVE-2021-41649 online-shopping-system 中的 SQL 注入 该 online-shopping-system 容易受到未经验证的基于错误/布尔的盲注以及基于错误的 SQL 注入攻击。 /homeaction.php 页面上的 catid 参数未对用户输入进行过滤，攻击者可以从底层 MySQL 数据库中提取敏感数据。 应用程序链接 online-shopping-system 受影响的组件与参数 URL: /homeaction.php 参数: catid POC SQLMAP 载荷 /homeaction.php 页面上的...

CVE-2021-41648

CVE-2021-41648 CVE-2021-41648 在线购物系统中的SQL注入漏洞 该在线购物系统容易受到未经身份验证的基于错误/布尔盲注以及基于错误的SQL注入攻击。 /action.php页面上的proId参数未对用户输入进行过滤，攻击者可以从底层MySQL数据库中提取敏感数据。 应用程序链接 online-shopping-system 受影响的组件及参数 URL: /action.php 参数: proId POC SQLMAP 载荷 /action.php 页面上的 proId 参数 参数: proId POST 类型: 基于布尔的盲注 标题: OR 布尔盲注 -...

CVE-2025-51970

CVE-2025-51970 CVE-2025-51970 - 在线购物系统高级版中的SQL注入 摘要 在 PuneethReddyHC 的 Online Shopping System Advanced 项目中发现了一个严重的SQL注入漏洞。该漏洞存在于 action.php 中，未能正确清理来自 keyword POST参数的用户输入。攻击者可以注入恶意SQL以提取数据或篡改数据库。 技术细节 漏洞类型 ：SQL注入 受影响文件 ：action.php 参数 ：keyword（通过POST） 受影响版本 ：1.0 攻击类型 ：远程 影响 ：未经授权的数据访问、数据库操作...

CVE-2024-40498

CVE-2024-40498 受影响的应用 online-shopping-system-advanced 1.0 https://github.com/PuneethReddyHC/online-shopping-system-advanced 描述 文件 register.php 处理用户注册。在第117行，POST参数 "$address1" 和 $address2" 未经过滤，与电子邮件、姓名和号码不同，这导致在 VALUES 语句评估期间发生SQL注入。要利用此漏洞，向 "register.php" 文件发送一个POST请求，添加一个 "address1"...

CVE-2025-61246

CVE-2025-61246 - 在线购物系统 SQL 注入漏洞 概述 本仓库包含 CVE-2025-61246 的概念验证（PoC），该漏洞是 PHP 在线购物系统应用程序中发现的严重 SQL 注入漏洞。攻击者可通过时间盲注利用该漏洞执行任意 SQL 命令。 漏洞详情 CVE ID ：CVE-2025-61246 漏洞类型 ：SQL 注入（时间盲注） 受影响组件 ：/online-shopping-system-php-master/reviewaction.php 受影响版本 ：1.0 易受攻击参数 ：proId 攻击向量...

PuneethReddyHC Online Shopping System homeaction.php SQL Injection

An unauthenticated SQL injection vulnerability exists in PuneethReddyHC Online Shopping System through the /homeaction.php catid parameter. Using a post request does not sanitize the user input. id: CVE-2021-41649 info: name: PuneethReddyHC Online Shopping System homeaction.php SQL Injection...

CVE-2026-82701

A vulnerability was determined in code-projects Online Shopping System 1.0. Affected by this issue is some unknown functionality of the file /action.php of the component Search Functionality. This manipulation of the argument keyword causes sql injection. It is possible to initiate the attack...

CVE-2026-82700

A vulnerability was found in code-projects Online Shopping System 1.0. Affected by this vulnerability is an unknown functionality of the file /offersmail.php of the component Newsletter Subscription. The manipulation of the argument email results in cross site scripting. The attack may be perform...

EUVD-2026-68594

A vulnerability was determined in code-projects Online Shopping System 1.0. Affected by this issue is some unknown functionality of the file /action.php of the component Search Functionality. This manipulation of the argument keyword causes sql injection. It is possible to initiate the attack...

CVE-2026-82701

A SQL injection vulnerability exists in the Search Functionality of code-projects Online Shopping System 1.0 , specifically in the keyword parameter of /action.php. An unauthenticated remote attacker can manipulate this argument to inject SQL, achieving low impact on confidentiality, integrity, a...

CVE-2026-82701 code-projects Online Shopping System Search Functionality action.php sql injection

A vulnerability was determined in code-projects Online Shopping System 1.0. Affected by this issue is some unknown functionality of the file /action.php of the component Search Functionality. This manipulation of the argument keyword causes sql injection. It is possible to initiate the attack...

EUVD-2026-68530

A vulnerability was found in code-projects Online Shopping System 1.0. Affected by this vulnerability is an unknown functionality of the file /offersmail.php of the component Newsletter Subscription. The manipulation of the argument email results in cross site scripting. The attack may be perform...

CVE-2026-82700

A cross-site scripting (XSS) vulnerability exists in the Newsletter Subscription component of code-projects Online Shopping System 1.0 , specifically in the file /offersmail.php . Manipulation of the email argument allows a remote, unauthenticated attacker to inject script, resulting in low impac...

CVE-2025-52021

CVE-2025-52021 — SQL Injection cieca basata sul tempo in PuneethReddyHC / Online Shopping System Advanced v1.0 CVE: CVE-2025-52021 Titolo: SQL Injection cieca basata sul tempo tramite il parametro productid in editproduct.php Vendor / Repo: PuneethReddyHC —...

CVE-2026-79793

A vulnerability has been found in code-projects Online Shopping System 1.0. Affected by this vulnerability is an unknown functionality of the file /admin/sumitform.php. Such manipulation of the argument Success leads to cross site scripting. The attack may be launched remotely. The exploit has be...

CVE-2026-79793 code-projects Online Shopping System sumit_form.php cross site scripting

A vulnerability has been found in code-projects Online Shopping System 1.0. Affected by this vulnerability is an unknown functionality of the file /admin/sumitform.php. Such manipulation of the argument Success leads to cross site scripting. The attack may be launched remotely. The exploit has be...

CVE-2026-79793

code-projects Online Shopping System 1.0 is affected by a cross-site scripting (XSS) vulnerability in the file /admin/sumit_form.php , caused by insufficient input validation on the Success argument. The attack is remote and requires user interaction , but no authentication is needed. Impact is r...

CVE-2026-19998

A weakness has been identified in code-projects Online Shopping System 1.0. Impacted is an unknown function of the file offersmail.php. Executing a manipulation of the argument email can lead to cross site scripting. The attack may be performed from remote. The exploit has been made available to...

EUVD-2026-60064

A weakness has been identified in code-projects Online Shopping System 1.0. Impacted is an unknown function of the file offersmail.php. Executing a manipulation of the argument email can lead to cross site scripting. The attack may be performed from remote. The exploit has been made available to...

CVE-2026-19998

The CVE-2026-19998 entry concerns code-projects Online Shopping System 1.0, specifically the offersmail.php file. The vulnerability stems from manipulating the email parameter, enabling cross-site scripting (XSS). The description notes the attack can be performed remotely and that the exploit is ...