48 matches found
CVE-2023-46449
CVE-2023-46449 不正确的访问控制 视频POC链接 https://www.youtube.com/watch?v=H5QnsOKjs3s Sourcecodester Free and Open Source inventory management system v1.0 存在不正确的访问控制漏洞。任意用户可以通过密码更改功能中的IDOR（不安全的直接对象引用）更改其他用户的密码并接管账户。 复现步骤 1. 登录用户1 2. 访问密码更改功能 3. 配置代理（如Burp Suite）以拦截请求 4. 发送密码更改请求，拦截请求并操纵用户ID以更改其他用户的密码 5...
CVE-2026-90695
A vulnerability was found in SourceCodester Inventory Management System 1.0. Affected by this vulnerability is an unknown functionality of the file /api/vendorshandler.php of the component Vendor Management. Performing a manipulation results in cross site scripting. The attack is possible to be...
CVE-2026-90697
SourceCodester Inventory Management System 1.0 contains an authorization bypass in invoice.php. The root cause is the manipulation of the ID argument , allowing a remote, low-privilege attacker to access protected content with a low confidentiality impact (CVSS 3.1: 4.3 MEDIUM ). A proof-of-conce...
EUVD-2026-77329
A vulnerability was identified in SourceCodester Inventory Management System 1.0. This affects an unknown part of the file invoice.php. The manipulation of the argument ID leads to authorization bypass. It is possible to initiate the attack remotely. The exploit is publicly available and might be...
CVE-2026-90696
SourceCodester Inventory Management System 1.0 is affected by a cross-site scripting (XSS) vulnerability in the Product Management Module , specifically in the file /api/products_handler.php . Manipulating the Product_Name argument allows a remote, low-privilege attacker to inject malicious scrip...
EUVD-2026-77327
A vulnerability was determined in SourceCodester Inventory Management System 1.0. Affected by this issue is some unknown functionality of the file /api/productshandler.php of the component Product Management Module. Executing a manipulation of the argument ProductName can lead to cross site...
EUVD-2026-77320
A vulnerability was found in SourceCodester Inventory Management System 1.0. Affected by this vulnerability is an unknown functionality of the file /api/vendorshandler.php of the component Vendor Management. Performing a manipulation results in cross site scripting. The attack is possible to be...
CVE-2026-90695 SourceCodester Inventory Management System Vendor Management vendors_handler.php cross site scripting
A vulnerability was found in SourceCodester Inventory Management System 1.0. Affected by this vulnerability is an unknown functionality of the file /api/vendorshandler.php of the component Vendor Management. Performing a manipulation results in cross site scripting. The attack is possible to be...
EUVD-2026-77319
A vulnerability has been found in SourceCodester Inventory Management System 1.0. Affected is an unknown function of the file /api/customershandler.php of the component Customer Management Module. Such manipulation of the argument CustomerName leads to cross site scripting. The attack can be...
CVE-2026-90694 SourceCodester Inventory Management System Customer Management customers_handler.php cross site scripting
A vulnerability has been found in SourceCodester Inventory Management System 1.0. Affected is an unknown function of the file /api/customershandler.php of the component Customer Management Module. Such manipulation of the argument CustomerName leads to cross site scripting. The attack can be...
EUVD-2026-40088
A weakness has been identified in SourceCodester Inventory Management System 1.0. This vulnerability affects unknown code of the file /api/usershandler.php of the component User Registration Endpoint. This manipulation of the argument role causes improper access controls. Remote exploitation of t...
CVE-2023-4437
A vulnerability, which was classified as critical, was found in SourceCodester Inventory Management System 1.0. Affected is an unknown function of the file app/ajax/searchsellpaymenreport.php. The manipulation of the argument customer leads to sql injection. It is possible to launch the attack...
CVE-2023-4557
A vulnerability classified as critical has been found in SourceCodester Inventory Management System 1.0. Affected is an unknown function of the file app/ajax/searchpurchasepaymenreport.php. The manipulation of the argument customer leads to sql injection. It is possible to launch the attack...
CVE-2025-14229 SourceCodester Inventory Management System SVC Report Export csv injection
A security vulnerability has been detected in SourceCodester Inventory Management System 1.0. The affected element is an unknown function of the component SVC Report Export. Such manipulation leads to csv injection. It is possible to launch the attack remotely. The exploit has been disclosed...
EUVD-2024-49862
Malicious code in bioql PyPI...
EUVD-2023-54298
Malicious code in bioql PyPI...
EUVD-2023-54073
Malicious code in bioql PyPI...
EUVD-2023-54074
Malicious code in bioql PyPI...