CVE-2023-41521: Improper Neutralization of Special Elements used in an SQL Command

Student Attendance Management System v1 was discovered to contain multiple SQL injection vulnerabilities in createSessionTerm.php via the id, termId, and sessionName parameters...

CVE-2023-41524: Improper Neutralization of Special Elements used in an SQL Command

Student Attendance Management System v1 was discovered to contain a SQL injection vulnerability via the username parameter at index.php...

CVE-2023-41519: Improper Neutralization of Input During Web Page Generation

Student Attendance Management System v1 was discovered to contain a cross-site scripting XSS vulnerability via the sessionName parameter at createSessionTerm.php...

CVE-2023-41520: Improper Neutralization of Special Elements used in an SQL Command

Student Attendance Management System v1 was discovered to contain multiple SQL injection vulnerabilities in createClassArms.php via the classId and classArmName parameters...

CVE-2023-49979

A directory listing vulnerability in Customer Support System v1 allows attackers to list directories and sensitive files within the application without requiring authorization...

CVE-2023-49973

A cross-site scripting XSS vulnerability in Customer Support System v1 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the email parameter at /customersupport/index.php?page=customerlist...

Cross site scripting

A cross-site scripting XSS vulnerability in Customer Support System v1 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the subject parameter at /customersupport/index.php?page=newticket...

CVE-2023-49971

A cross-site scripting XSS vulnerability in Customer Support System v1 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the firstname parameter at /customersupport/index.php?page=customerlist...

Sql injection

Customer Support System v1 was discovered to contain a SQL injection vulnerability via the subject parameter at /customersupport/ajax.php?action=saveticket...

Sql injection

Customer Support System v1 was discovered to contain a SQL injection vulnerability via the email parameter at /customersupport/ajax.php...

Sql injection

Customer Support System v1 was discovered to contain a SQL injection vulnerability via the id parameter at /customersupport/index.php?page=editcustomer...

Sql injection

Customer Support System v1 was discovered to contain a SQL injection vulnerability via the username parameter at /customersupport/ajax.php?action=login...

CVE-2023-49968

The Customer Support System v1 is vulnerable to a SQL injection vulnerability in the /customer_support/manage_department.php page. The root cause is a lack of validation for the id parameter, which allows an attacker to execute arbitrary SQL commands on the MySQL database. This can be exploited t...

CVE-2023-49970

Customer Support System v1 is vulnerable to a SQL injection vulnerability due to a lack of validation on the subject parameter at the /customer_support/ajax.php?action=save_ticket endpoint. An attacker can execute arbitrary SQL commands against the MySQL database, potentially leading to the theft...

Authorization

A directory listing vulnerability in Customer Support System v1 allows attackers to list directories and sensitive files within the application without requiring authorization...

CVE-2023-49545

Customer Support System v1 is affected by a directory listing vulnerability that allows unauthenticated attackers to view directories and sensitive files. Specifically, accessing paths such as /customer_support/database/ or /customer_support/assets/ can expose important application files. The vul...

CVE-2023-24231

CVE-2023-24231 : A stored cross-site scripting (XSS) vulnerability exists in the Inventory Management System v1, specifically in the component at /php-inventory-management-system/categories.php. The issue arises when a crafted payload is injected into the Categories Name parameter, allowing an at...

CVE-2021-41659

SQL injection vulnerability in Sourcecodester Banking System v1 by oretnom23, allows attackers to execute arbitrary SQL commands via the username or password field...

Sql injection

SQL injection vulnerability in Sourcecodester Banking System v1 by oretnom23, allows attackers to execute arbitrary SQL commands via the username or password field...

Sql injection

The username and password field of login in Lodging Reservation Management System V1 can give access to any user by using SQL injection to bypass authentication...