Kimai's API invoice endpoint missing customer-level access control (IDOR)

Summary GET /api/invoices/id only checks the role-based viewinvoice permission but does not verify the requesting user has access to the invoice's customer. Any user with ROLETEAMLEAD which grants viewinvoice can read all invoices in the system, including those belonging to customers assigned to...

CVE-2025-7591

A vulnerability, which was classified as critical, was found in PHPGurukul Dairy Farm Shop Management System 1.3. Affected is an unknown function of the file view-invoice.php. The manipulation of the argument invid leads to sql injection. It is possible to launch the attack remotely. The exploit...

PHPGurukul Dairy Farm Shop Management System – Multiple Product Security Vulnerabilities

PHPGurukul Dairy Farm Shop Management System is a PHP and MySQL based dairy farm management system from PHPGurukul. A security vulnerability exists in version 1.3 of the PHPGurukul Dairy Farm Shop Management System, which originates from a SQL injection due to the incorrect manipulation of the...

PT-2024-29442

Name of the Vulnerable Software and Affected Versions CampCodes Supplier Management System version 1.0 Description The issue concerns SQL injection. It can be exploited via the "Supply Management System/admin/view invoice items.php?id=" API endpoint, specifically through the id variable...

PT-2022-19945

Name of the Vulnerable Software and Affected Versions Simple Client Management System version 1.0 Description The issue concerns SQL Injection via the /cms/admin/?page=invoice/view invoice&id= endpoint. This allows for potential manipulation of database queries. Recommendations For Simple Client...