6 matches found
CVE-2026-78365
Authorization Bypass Through User-Controlled Key in the supplier API in Roskus Prospero Flow CRM 4.0.0 through 5.3.1 allows any authenticated user to read and modify another company's supplier record, and to reassign it to their own company, via a PUT request to /api/supplier/id setting companyid...
CVE-2026-78365: Authorization Bypass Through User-Controlled Key
Authorization Bypass Through User-Controlled Key in the supplier API in Roskus Prospero Flow CRM 4.0.0 through 5.3.1 allows any authenticated user to read and modify another company's supplier record, and to reassign it to their own company, via a PUT request to /api/supplier/id setting companyid...
E-Commerce Website /pages/supplier_update.php SQL Injection Vulnerability
E-Commerce Website is an e-commerce website. E-Commerce Website suffers from a SQL injection vulnerability that originates from improper filtering of SQL statements submitted by the parameter suppid in the /pages/supplierupdate.php file, which can be exploited by an attacker to gain unauthorized...
PT-2025-41321
Name of the Vulnerable Software and Affected Versions code-projects E-Commerce Website version 1.0 Description A flaw exists in code-projects E-Commerce Website 1.0, specifically within the /pages/supplier update.php file. Manipulation of the supp id argument can lead to SQL injection. This issue...
PT-2025-37436
Name of the Vulnerable Software and Affected Versions: Campcodes Grocery Sales and Inventory System version 1.0 Description: A vulnerability exists in Campcodes Grocery Sales and Inventory System that allows for SQL injection. The issue is located in the /ajax.php?action=delete supplier file, whe...
