CVE-2024-51181

A Reflected Cross Site Scripting XSS vulnerability was found in /ifscfinder/admin/profile.php in PHPGurukul IFSC Code Finder Project v1.0, which allows remote attackers to execute arbitrary code via " searchifsccode" parameter...

CVE-2023-46791

The CVE entry CVE-2023-46791 is marked as withdrawn/rejected. Connected document PT-2023-30218 describes an unauthenticated SQL Injection in Online Matrimonial Project v1.0, where the filename parameter of pic3 in functions.php does not validate input, sending unfiltered data to the database. No ...

CVE-2023-44481

CVE-2023-44481 affects Leave Management System Project v1.0, where the authenticated attacker can exploit SQL injection through the setearnleave parameter in admin/setleaves.php. Root cause: unvalidated/unfiltered input sent to the database. Documented impact is high (CVE metrics show high confid...

CVE-2023-46793

Online Matrimonial Project v1.0 is vulnerable to multiple Unauthenticated SQL Injection vulnerabilities. The 'day' parameter in the 'register' function of the functions.php resource does not validate the characters received and they are sent unfiltered to the database...

Sql injection

Online Matrimonial Project v1.0 is vulnerable to multiple Unauthenticated SQL Injection vulnerabilities. The 'day' parameter in the 'register' function of the functions.php resource does not validate the characters received and they are sent unfiltered to the database...

CVE-2023-46797

CVE-2023-46797 is rejected/not used; this CVE entry does not represent an active vulnerability.

CVE-2023-46786

CVE-2023-46786 entry is rejected/not used and does not represent an active vulnerability.

CVE-2023-43740 Online Book Store Project v1.0 - Insecure File Upload

Online Book Store Project v1.0 is vulnerable to an Insecure File Upload vulnerability on the 'image' parameter of adminedit.php page, allowing an authenticated attacker to obtain Remote Code Execution on the server hosting the application...

CVE-2022-43213

CVE-2022-43213 affects Billing System Project v1.0, where a SQL injection vulnerability exists in the id parameter of editorder.php. The issue is caused by improper input handling, enabling an attacker to manipulate SQL queries. The NVD/NVD-derived metrics rate impact as critical (C:H, I:H, A:H) ...

Sql injection

Billing System Project v1.0 was discovered to contain a SQL injection vulnerability via the orderId parameter at fetchOrderData.php...

CVE-2022-43215

Billing System Project v1.0 was discovered to contain a SQL injection vulnerability via the endDate parameter at getOrderReport.php...

CVE-2022-43214

Billing System Project v1.0 was discovered to contain a SQL injection vulnerability via the orderId parameter at printOrder.php...

CVE-2022-43215

CVE-2022-43215 affects Billing System Project v1.0. The vulnerability is a SQL injection in the endDate parameter of the getOrderReport.php endpoint, as described across multiple sources. The issue arises from lack of input validation, enabling an attacker to influence SQL queries and potentially...

CVE-2022-43215

Billing System Project v1.0 was discovered to contain a SQL injection vulnerability via the endDate parameter at getOrderReport.php...

CVE-2022-41504

An arbitrary file upload vulnerability in the component /phpaction/editProductImage.php of Billing System Project v1.0 allows attackers to execute arbitrary code via a crafted PHP file...

CVE-2022-41504

CVE-2022-41504 is an arbitrary file upload vulnerability in the Billing System Project v1.0, specifically in the /php_action/editProductImage.php component. The issue allows an attacker to upload a crafted PHP file and achieve arbitrary code execution. The CVSS score is High (7.2) with network at...

CVE-2022-41498

CVE-2022-41498 affects the Billing System Project v1.0, with a confirmed SQL injection vulnerability exploitable via the id parameter at /phpinventory/editbrand.php. The CVE entry lists a base score of 7.2 (High, CVSS 3.1: AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H). The exploitation status is not provi...

CVE-2022-41437

Billing System Project v1.0 was discovered to contain a remote code execution RCE vulnerability via the component /phpaction/createProduct.php...

Remote code execution

Billing System Project v1.0 was discovered to contain a remote code execution RCE vulnerability via the component /phpaction/createProduct.php...

Sql injection

Billing System Project v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /phpinventory/editcategory.php...