1602 matches found
CVE-2024-1399 Restaurant Menu and Food Ordering <= 2.4.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
The Restaurant Menu – Food Ordering System – Table Reservation plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's shortcodes in all versions up to, and including, 2.4.0 due to insufficient input sanitization and output escaping on user supplied attributes. This mak...
WordPress Restaurant Menu and Food Ordering plugin <= 2.4.0 - Authenticated Stored Cross-Site Scripting via Shortcode vulnerability
Authenticated Stored Cross-Site Scripting via Shortcode vulnerability discovered by Lucio Sá in WordPress Plugin Restaurant Menu – Food Ordering System – Table Reservation versions = 2.4.0...
WordPress Restaurant Menu – Food Ordering System – Table Reservation Plugin <= 2.4.0 is vulnerable to Cross Site Scripting (XSS)
Software Restaurant Menu – Food Ordering System – Table Reservation Type Plugin Vulnerable versions = 2.4.0 Fixed in 2.4.1 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2024-1399 Patch priority Low CVSS severity Low 6.5 Developer Claim ownership PSID...
CVE-2024-32167
Sourcecodester Online Medicine Ordering System 1.0 is vulnerable to Arbitrary file deletion vulnerability as the backend settings have the function of deleting pictures to delete any files...
CVE-2024-32167
Sourcecodester Online Medicine Ordering System 1.0 is vulnerable to Arbitrary file deletion vulnerability as the backend settings have the function of deleting pictures to delete any files...
CVE-2024-32167
CVE-2024-32167 involves the Sourcecodester Online Medicine Ordering System 1.0. The vulnerability is an Arbitrary file deletion flaw caused by a backend function intended for deleting pictures, which can be abused to delete arbitrary files. Reported impact aligns with high integrity and availabil...
CVE-2024-32167
Sourcecodester Online Medicine Ordering System 1.0 is vulnerable to Arbitrary file deletion vulnerability as the backend settings have the function of deleting pictures to delete any files...
CVE-2024-5745
A vulnerability was found in itsourcecode Bakery Online Ordering System 1.0. It has been classified as critical. Affected is an unknown function of the file /admin/modules/product/controller.php?action=add. The manipulation of the argument image leads to unrestricted upload. It is possible to...
CVE-2024-5745
CVE-2024-5745 affects itsourcecode Bakery Online Ordering System version 1.0. The issue exists in an unknown function within /admin/modules/product/controller.php?action=add where manipulation of the image parameter enables unrestricted file uploads, allowing remote exploitation. Multiple sources...
CVE-2024-5745 itsourcecode Bakery Online Ordering System unrestricted upload
A vulnerability was found in itsourcecode Bakery Online Ordering System 1.0. It has been classified as critical. Affected is an unknown function of the file /admin/modules/product/controller.php?action=add. The manipulation of the argument image leads to unrestricted upload. It is possible to...
CVE-2024-5636
A vulnerability was found in itsourcecode Bakery Online Ordering System 1.0. It has been rated as critical. Affected by this issue is some unknown functionality of the file report/index.php. The manipulation of the argument procduct leads to sql injection. The attack may be launched remotely. The...
CVE-2024-5636 itsourcecode Bakery Online Ordering System index.php sql injection
A vulnerability was found in itsourcecode Bakery Online Ordering System 1.0. It has been rated as critical. Affected by this issue is some unknown functionality of the file report/index.php. The manipulation of the argument procduct leads to sql injection. The attack may be launched remotely. The...
CVE-2024-5635 itsourcecode Bakery Online Ordering System index.php sql injection
A vulnerability was found in itsourcecode Bakery Online Ordering System 1.0. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the file index.php. The manipulation of the argument txtsearch leads to sql injection. The attack can be launched remotely...
CVE-2024-32579
Technical details about CVE-2024-32579 are not publicly provided in the supplied documents. Current data confirms a Stored XSS issue in GloriaFood plugin versions up to 2.4.1; monitor for official advisories and patches.
WordPress Restaurant Menu – Food Ordering System – Table Reservation plugin <= 2.4.1 - Cross Site Scripting (XSS) vulnerability
Cross Site Scripting XSS vulnerability discovered by wpdabh Patchstack Alliance in WordPress Plugin Restaurant Menu – Food Ordering System – Table Reservation versions = 2.4.1...
WordPress Restaurant Menu – Food Ordering System – Table Reservation Plugin <= 2.4.1 is vulnerable to Cross Site Scripting (XSS)
Software Restaurant Menu – Food Ordering System – Table Reservation Type Plugin Vulnerable versions = 2.4.1 Fixed in 2.4.2 OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2024-32579 Patch priority Low CVSS severity Low 6.5 Developer Claim ownership PSID e783a9e89164...
PT-2024-22386 · Unknown · Open Source Medicine Ordering System
Name of the Vulnerable Software and Affected Versions: Open Source Medicine Ordering System version 1.0 Description: The issue is related to a SQL injection vulnerability. This vulnerability can be exploited via the date parameter at the "/admin/reports/index.php" API endpoint. Recommendations: F...
Online Medicine Ordering System SQL Injection Vulnerability
Online Medicine Ordering System is an online medicine ordering system by Carlo Montero, an individual developer. A SQL injection vulnerability exists in Online Medicine Ordering System v1.0, which is caused by a SQL injection vulnerability in the date parameter of /admin/reports/index.php...
CVE-2024-28303
Open Source Medicine Ordering System v1.0 is vulnerable to a SQL injection via the date parameter in /admin/reports/index.php. Affected component: the web application’s reports endpoint. Root cause (as described): unsafely interpolating user-supplied date input into SQL queries leading to potenti...