CVE-2021-41648

CVE-2021-41648 CVE-2021-41648 Inyección SQL en online-shopping-system El sistema online-shopping-system es vulnerable a ataques de inyección SQL no autenticados, ciegos basados en errores/booleanos y basados en errores. El parámetro proId en la página /action.php no sanitiza la entrada del usuari...

PuneethReddyHC Online Shopping System homeaction.php SQL Injection

An unauthenticated SQL injection vulnerability exists in PuneethReddyHC Online Shopping System through the /homeaction.php catid parameter. Using a post request does not sanitize the user input. id: CVE-2021-41649 info: name: PuneethReddyHC Online Shopping System homeaction.php SQL Injection...

CVE-2021-41649

CVE-2021-41649 CVE-2021-41649 Inyección SQL en online-shopping-system El online-shopping-system es vulnerable a ataques de inyección SQL de tipo error/boolean-based blind y error-based sin autenticación. El parámetro catid en la página /homeaction.php no sanitiza la entrada del usuario, por lo qu...

CVE-2024-40498

CVE-2024-40499 影響を受けるアプリケーション online-shopping-system-advanced 1.0 https://github.com/PuneethReddyHC/online-shopping-system-advanced 説明 ファイル register.php はユーザー登録を処理します。117行目では、POSTパラメータ "$address1" と "$address2" が、メールアドレス、名前、電話番号とは異なりサニタイズされていません。そのため、VALUES 文の評価中にSQLインジェクションが発生します。...

CVE-2025-61246

CVE-2025-61246 - オンラインショッピングシステムにおけるSQLインジェクション脆弱性 概要 このリポジトリには、CVE-2025-61246 の概念実証（PoC）が含まれています。これは、オンラインショッピングシステムPHPアプリケーションで発見された重大なSQLインジェクション脆弱性です。この脆弱性により、認証されていない攻撃者が、時間ベースのブラインドSQLインジェクションを通じて任意のSQLコマンドを実行できる可能性があります。 脆弱性の詳細 CVE ID : CVE-2025-61246 脆弱性タイプ : SQLインジェクション（時間ベースブラインド）...

CVE-2025-52021

CVE-2025-52021 — Inyección SQL Ciega Basada en Tiempo en PuneethReddyHC / Online Shopping System Advanced v1.0 CVE: CVE-2025-52021 Título: Inyección SQL Ciega Basada en Tiempo a través del parámetro productid en editproduct.php Vendor / Repo: PuneethReddyHC —...

CVE-2025-51970

CVE-2025-51970 CVE-2025-51970 - 在线购物系统高级版中的SQL注入 摘要 在 PuneethReddyHC 的 Online Shopping System Advanced 项目中发现了一个严重的SQL注入漏洞。该漏洞存在于 action.php 中，未能正确清理来自 keyword POST参数的用户输入。攻击者可以注入恶意SQL以提取数据或篡改数据库。 技术细节 漏洞类型 ：SQL注入 受影响文件 ：action.php 参数 ：keyword（通过POST） 受影响版本 ：1.0 攻击类型 ：远程 影响 ：未经授权的数据访问、数据库操作...

CVE-2026-85643

A flaw has been found in code-projects Online Shopping System 1.0. Impacted is the function mysqliquery of the file admin/adduser.php. Executing a manipulation of the argument mobile can lead to sql injection. The attack may be performed from remote. The exploit has been published and may be used...

CVE-2026-85643 code-projects Online Shopping System adduser.php mysqli_query sql injection

A flaw has been found in code-projects Online Shopping System 1.0. Impacted is the function mysqliquery of the file admin/adduser.php. Executing a manipulation of the argument mobile can lead to sql injection. The attack may be performed from remote. The exploit has been published and may be used...

CVE-2026-85643

code-projects Online Shopping System 1.0 is vulnerable to SQL injection in the mysqli_query function within admin/adduser.php , via manipulation of the mobile argument. The attack is exploitable remotely but requires high privileges (authenticated admin access). CVSS 3.1 scores it 4.7 (MEDIUM) wi...

EUVD-2026-71713

A flaw has been found in code-projects Online Shopping System 1.0. Impacted is the function mysqliquery of the file admin/adduser.php. Executing a manipulation of the argument mobile can lead to sql injection. The attack may be performed from remote. The exploit has been published and may be used...

PT-2026-86240

A flaw has been found in code-projects Online Shopping System 1.0. Impacted is the function mysqli query of the file admin/adduser.php. Executing a manipulation of the argument mobile can lead to sql injection. The attack may be performed from remote. The exploit has been published and may be use...

CVE-2026-82701

A vulnerability was determined in code-projects Online Shopping System 1.0. Affected by this issue is some unknown functionality of the file /action.php of the component Search Functionality. This manipulation of the argument keyword causes sql injection. It is possible to initiate the attack...

CVE-2026-82700

A vulnerability was found in code-projects Online Shopping System 1.0. Affected by this vulnerability is an unknown functionality of the file /offersmail.php of the component Newsletter Subscription. The manipulation of the argument email results in cross site scripting. The attack may be perform...

CVE-2026-82701 code-projects Online Shopping System Search Functionality action.php sql injection

A vulnerability was determined in code-projects Online Shopping System 1.0. Affected by this issue is some unknown functionality of the file /action.php of the component Search Functionality. This manipulation of the argument keyword causes sql injection. It is possible to initiate the attack...

EUVD-2026-68594

A vulnerability was determined in code-projects Online Shopping System 1.0. Affected by this issue is some unknown functionality of the file /action.php of the component Search Functionality. This manipulation of the argument keyword causes sql injection. It is possible to initiate the attack...

CVE-2026-82701

A SQL injection vulnerability exists in the Search Functionality of code-projects Online Shopping System 1.0 , specifically in the keyword parameter of /action.php. An unauthenticated remote attacker can manipulate this argument to inject SQL, achieving low impact on confidentiality, integrity, a...

CVE-2026-82700

A cross-site scripting (XSS) vulnerability exists in the Newsletter Subscription component of code-projects Online Shopping System 1.0 , specifically in the file /offersmail.php . Manipulation of the email argument allows a remote, unauthenticated attacker to inject script, resulting in low impac...

EUVD-2026-68530

A vulnerability was found in code-projects Online Shopping System 1.0. Affected by this vulnerability is an unknown functionality of the file /offersmail.php of the component Newsletter Subscription. The manipulation of the argument email results in cross site scripting. The attack may be perform...

PT-2026-83846

Name of the Vulnerable Software and Affected Versions code-projects Online Shopping System version 1.0 Description An issue exists in the Search Functionality component within the '/action.php' endpoint. Remote manipulation of the keyword argument allows for SQL injection, a technique where...