Online Travel Agency System 代码问题漏洞

Online Travel Agency System is an online travel agency system by Qaseem Hilal, an individual developer. A security vulnerability exists in Online Travel Agency System version 1.0, which originates from a file upload vulnerability in the file employeeinsert.php. The vulnerability can be exploited ...

Online Travel Agency System SQL注入漏洞

Online Travel Agency System is an online travel agency system by Qaseem Hilal, an individual developer. A security vulnerability exists in Online Travel Agency System version 1.0, which stems from a SQL injection vulnerability that can be exploited by an attacker to execute arbitrary code via the...

PT-2023-23538 · Unknown · Online Travel Agency System

Name of the Vulnerable Software and Affected Versions: Online Travel Agency System version 1.0 Description: A SQL injection issue allows a remote attacker to execute arbitrary code via the page id parameter at the "article edit.php" endpoint. This enables the attacker to potentially access and...

CVE-2023-37684

Online Nurse Hiring System v1.0 was discovered to contain a cross-site scripting XSS vulnerability in the Search Report Details of the Admin portal...

Campcodes Beauty Salon Management System 跨站脚本漏洞

Campcodes Beauty Salon Management System is a beauty salon management system from Campcodes, Inc. A cross-site scripting vulnerability exists in Campcodes Beauty Salon Management System version 1.0, which stems from unknown processing in /admin/search-appointment.php that results in cross-site...

PT-2023-22218 · Bosch · Bosch Building Integration System

Name of the Vulnerable Software and Affected Versions: Bosch Building Integration System BIS version 5.0 Description: The issue is related to improper information in the cybersecurity guidebook of the Bosch Building Integration System, which may lead to incorrect configuration. This incorrect...

Students Online Internship Timesheet System SQL注入漏洞

Students Online Internship Timesheet System is an online internship timesheet system for students. Students Online Internship Timesheet System version 1.0 suffers from a sql injection vulnerability, which can be exploited by attackers to perform SQL injection and steal data...

PT-2023-19410 · Unknown · Sourcecodester Ac Repair/Services System

Name of the Vulnerable Software and Affected Versions: SourceCodester AC Repair and Services System version 1.0 Description: A critical issue has been found in the system, affecting an unknown function of the file /admin/user/manage user.php. The manipulation of the id argument leads to sql...

AC Repair and Services System SQL注入漏洞

AC Repair and Services System is an air conditioning repair and services system by Carlo Montero Personal Developer. A SQL injection vulnerability exists in AC Repair and Services System version 1.0, which stems from a misuse of the parameter id resulting in sql injection...

Answer vulnerable to Insertion of Sensitive Information Into Sent Data

answerdev/answer is an open-source knowledge-based community software. Answer prior to 1.0.8 does not strip EXIF geolocation data from user-uploaded logos. As a result, anyone can get sensitive information like a user's device ID, geolocation, system information, system version, etc...

PT-2023-17155 · Sourcecodester · Sourcecodester Automatic Question Paper Generator System

Name of the Vulnerable Software and Affected Versions: SourceCodester Automatic Question Paper Generator System version 1.0 Description: A critical issue has been found in the GET Parameter Handler component, specifically in the file users/classes/view class.php. The manipulation of the id argume...

PT-2023-17137 · Otcms · Otcms

Name of the Vulnerable Software and Affected Versions: OTCMS version 6.72 Description: A vulnerability was found in the function AutoRun of the file apiRun.php. The manipulation of the argument mode leads to cross-site scripting. The attack can be launched remotely. Recommendations: For OTCMS...

PT-2023-17039 · Unknown · Sourcecodester Alphaware Simple E-Commerce System

Name of the Vulnerable Software and Affected Versions: SourceCodester Alphaware Simple E-Commerce System version 1.0 Description: A critical issue has been found in the SourceCodester Alphaware Simple E-Commerce System, affecting an unknown part of the file admin/admin index.php. The manipulation...

PT-2023-16919 · Sourcecodester · Sourcecodester Computer Parts Sales/Inventory System

Name of the Vulnerable Software and Affected Versions: SourceCodester Computer Parts Sales and Inventory System version 1.0 Description: A critical vulnerability has been found in the system, affecting an unknown part of the file cust transac.php. The manipulation of the phonenumber argument lead...

EXIF Geolocation Data Not Stripped From brand logo

When the user uploads his logo, the uploaded image’s EXIF Geo-location Data does not get stripped. As a result, anyone can get sensitive information like user's Device ID, Geo Location, System Information, System version, ETC. Step to reproduce: 1. Upload logo with EXIF DATA, or download from her...

PT-2023-16874 · Unknown · Sourcecodester File Tracker Manager System

Name of the Vulnerable Software and Affected Versions: SourceCodester File Tracker Manager System version 1.0 Description: A problematic issue was found in the SourceCodester File Tracker Manager System, affecting an unknown part of the file normal/borrow1.php. The manipulation of the id argument...

CVE-2023-24653

Simple Customer Relationship Management System v1.0 was discovered to contain a SQL injection vulnerability via the oldpass parameter under the Change Password function...

Online Graduate Tracer System SQL注入漏洞

Online Graduate Tracer System is an online graduate tracer system by the individual developer Carlo Montero. SourceCodester Online Graduate Tracer System version 1.0 suffers from a SQL injection vulnerability that stems from incorrect manipulation of the parameter id resulting in sql injection...

CVE-2021-3855 Command Injection in Liman Central Management System

Improper Neutralization of Special Elements used in a Command 'Command Injection' vulnerability in Liman Central Management System Liman MYS HTTP/Controllers, CronMail, Jobs modules allows Command Injection. This issue affects Liman Central Management System: from 1.7.0 before 1.8.3-462...

CVE-2023-22804

LS ELECTRIC XBC-DN32U with operating system version 01.80 is missing authentication to create users on the PLC. This could allow an attacker to create and use an account with elevated privileges and take control of the device...