CVE-2024-57487

CVE-2024-57487 affects Code-Projects Online Car Rental System 1.0. The file upload feature does not validate file extensions or MIME types, allowing an attacker to upload a PHP shell and execute commands on the server. The issue is exploitable via the authenticated pathway described in published ...

CVE-2024-57488

CVE-2024-57488 concerns Code-Projects Online Car Rental System 1.0, with a Cross-Site Scripting (XSS) vulnerability exploitable via the vehicalorcview parameter in /admin/edit-vehicle.php. The CVSS v3.1 base score is 6.5 (Medium), with network attack vector, low attack complexity, no privileges r...