Vehicle Parking Tracker System 1.0 Cross Site Scripting

Exploit Title: Vehicle Parking Tracker System 1.0 - 'Owner Name' Stored Cross-Site Scripting Date: 2021-01-30 Exploit Author: Anmol K Sachan Vendor Homepage: https://phpgurukul.com/ Software Link: https://phpgurukul.com/vehicle-parking-management-system-using-php-and-mysql/ Software: : Vehicle...

Design/Logic Flaw

PHPGurukul Daily Expense Tracker System 1.0 is vulnerable to stored XSS via the add-expense.php Item parameter...

CVE-2021-26303

The vulnerability CVE-2021-26303 affects PHPGurukul Daily Expense Tracker System 1.0, where a stored XSS is possible via the user-profile.php Full Name field . The root cause is unsanitized input being stored and later rendered, enabling an attacker to inject script into the profile display. The ...

CVE-2021-26304

PHPGurukul Daily Expense Tracker System 1.0 is vulnerable to a stored XSS flaw via the add-expense.php Item parameter (CVE-2021-26304). The vulnerability is confirmed across multiple sources in the connected documents; exploitation details beyond “stored XSS via the add-expense.php Item parameter...

Daily Expense Tracker System 1.0 Cross Site Scripting

Exploit Title: Daily Expense Tracker System Stored Cross-Site Scripting Vulnerability Date: 2021-01-26 Exploit Author: Priyanka Samak Vendor Homepage: https://phpgurukul.com/ Software Link: https://phpgurukul.com/daily-expense-tracker-using-php-and-mysql/ Software: : Daily Expense Tracker System...

Sourcecodetester Daily Tracker System SQL Injection (CVE-2020-24193)

An SQL injection vulnerability exists in Sourcecodetester Daily Tracker System. Successful exploitation of this vulnerability could allow a remote attacker to execute arbitrary SQL commands on the affected system...

CVE-2020-24194

A Cross-site scripting XSS vulnerability in 'user-profile.php' in SourceCodester Daily Tracker System v1.0 allows remote attackers to inject arbitrary web script or HTML via the 'fullname' parameter...

CVE-2020-24194

CVE-2020-24194 is an XSS vulnerability in SourceCodester Daily Tracker System v1.0, exploitable via the fullname parameter in user-profile.php to inject arbitrary web script/HTML. The provided connected documents confirm the issue but do not specify affected versions beyond v1.0, nor provide a re...

CVE-2020-24193

A SQL injection vulnerability in login in Sourcecodetester Daily Tracker System 1.0 allows unauthenticated user to execute authentication bypass with SQL injection via the email parameter...

CVE-2020-24193

The CVE-2020-24193 entry documents a SQL injection flaw in the login of Sourcecodetester Daily Tracker System 1.0 that allows an unauthenticated user to bypass authentication via the email parameter. Connected sources confirm a practical exploit path (e.g., exploit-db entry) demonstrating an auth...

Sql injection

PHPGurukul Daily Expense Tracker System 1.0 is vulnerable to SQL injection, as demonstrated by the email parameter in index.php or register.php. The SQL injection allows to dump the MySQL database and to bypass the login prompt...

Cross site scripting

PHPGurukul Daily Expense Tracker System 1.0 is vulnerable to stored XSS, as demonstrated by the ExpenseItem or ExpenseCost parameter in manage-expense.php...

CVE-2020-10107

CVE-2020-10107: PHPGurukul Daily Expense Tracker System 1.0 is vulnerable to stored XSS, evidenced by the ExpenseItem and ExpenseCost parameters within manage-expense.php. The Red Hat and NVD records corroborate a stored XSS issue affecting this application. No exploitation routes, affected versi...