CVE-2024-57487

The Code-Projects Online Car Rental System 1.0 is vulnerable to an authenticated remote code execution (RCE) flaw within its file upload feature. The root cause is a failure to validate file extensions or MIME types , specifically on the changeimage1.php endpoint. This allows an authenticated att...

CVE-2024-57488

Code-Projects Online Car Rental System 1.0 is vulnerable to Stored Cross-Site Scripting (XSS) . An authenticated attacker can inject malicious JavaScript payloads through the vehicalorcview parameter in the /admin/edit-vehicle.php endpoint. These payloads are persisted in the system and execute w...