CVE-2022-32310

CVE-2022-32310 affects Ingredient Stock Management System v1.0. The issue is an access-control flaw in the Users.php endpoint that lets an unauthenticated attacker obtain or take over user accounts via a crafted POST request. Impact per sources indicates account takeover with no required user int...

CVE-2022-36687

The CVE-2022-36687 entry concerns Ingredients Stock Management System v1.0 with an arbitrary file deletion vulnerability in the component /classes/Master.php?f=delete_img. The root cause is lack of validation for the delete file path, enabling arbitrary file deletion. Documented impacts include h...

CVE-2022-36690

CVE-2022-36690 affects Ingredients Stock Management System v1.0 with a SQL injection in the id parameter of /admin/?page=user/manage_user&id= (input validation missing in that endpoint). The vulnerability is documented across multiple sources (CNVD/CNNVD/NVD) and Red Hat PRION/CVE records, descri...

CVE-2022-32311

CVE-2022-32311 affects Ingredient Stock Management System v1.0, with a SQL injection vulnerability in the id parameter of /isms/admin/stocks/view_stock.php. Root cause: lack of input validation allowing SQL commands to be injected. Impact: potential data disclosure/integrity/availability compromi...

CVE-2022-36689

CVE-2022-36689 affects Ingredients Stock Management System v1.0. The vulnerability is a SQL injection in the month parameter of the endpoint /admin/?page=reports/waste&month=. Root cause: lack of input validation in the month parameter, enabling attackers to execute arbitrary SQL commands. Docume...

CVE-2022-36688

CVE-2022-36688 affects Ingredients Stock Management System v1.0. The vulnerability is a SQL injection in the month parameter of /admin/?page=reports/stockout&month=, caused by insufficient input validation. Base CVSS v3.1 is 8.8 (HIGH) with impacts on confidentiality, integrity, and availability....

CVE-2022-36686

Ingredients Stock Management System v1.0 contains a SQL injection via the month parameter at /admin/?page=reports/stockin&month=, caused by insufficient validation of external input in the month parameter. This vulnerability is documented as CVE-2022-36686 with a CVSS v3.1 base score of 8.8 (HIGH...