CVE-2023-4437

CVE-2023-4437 affects SourceCodester Inventory Management System 1.0. The vulnerable component is the file app/ajax/search_sell_paymen_report.php, where manipulating the argument customer leads to an SQL injection. Exploitation is possible remotely, and public exploits have been disclosed (VDB-23...

CVE-2023-4555

SourceCodester Inventory Management System 1.0 is affected by CVE-2023-4555 via an unsafely handled parameter in suppliar_data.php (name/company), enabling cross-site scripting. The vulnerability can be triggered remotely and has been publicly disclosed. Red Hat and CVE records corroborate the is...

CVE-2023-24232

CVE-2023-24232 corresponds to a stored XSS in Inventory Management System v1, specifically in the /php-inventory-management-system/product.php component. The vulnerability allows an attacker to inject crafted payloads via the Product Name parameter to execute arbitrary web scripts/HTML. Reported ...

CVE-2023-4438

CVE-2023-4438 affects SourceCodester Inventory Management System 1.0. a SQL injection in file app/ajax/search_sales_report.php via the customer parameter. Remote attacker can exploit; exploit has been disclosed publicly. Impact is described as critical in the sources. No patch/version details are...

CVE-2023-4558

CVE-2023-4558 affects SourceCodester Inventory Management System 1.0, where an SQL injection is possible via staff_data.php and the argument columns[0][data]. The vulnerability arises from manipulating that parameter, enabling remote exploitation. Multiple sources (NVD, Red Hat, CVE records) conf...

CVE-2023-4183

The CVE-2023-4183 entry concerns SourceCodester Inventory Management System 1.0, where the file edit_update.php in the Password Handler allows an attacker to manipulate the user_id parameter to bypass access controls. This remote, network-based flaw can impact confidentiality, integrity, and avai...

CVE-2023-4449

SourceCodester Free and Open Source Inventory Management System 1.0 contains a SQL injection vulnerability in the /index.php?page=member endpoint. The issue arises from manipulating the columns[0][data] parameter, enabling remote exploitation. Descriptions in multiple sources identify this as a c...

CVE-2023-4182

SourceCodester Inventory Management System 1.0 has a SQL injection vulnerability in edit_sell.php via the up_pid parameter. The issue is described as critical and allows remote exploitation, with no public patch version specified in the provided documents. Some sources advise avoiding the up_pid ...

CVE-2023-4184

CVE-2023-4184 affects SourceCodester Inventory Management System 1.0; the sell_return.php file’s pid parameter is unsafely handled, enabling SQL injection via remote exploitation. Multiple connected sources confirm the vulnerability’s root cause and potential impact. There is no publicly document...

CVE-2023-24231

CVE-2023-24231 : A stored cross-site scripting (XSS) vulnerability exists in the Inventory Management System v1, specifically in the component at /php-inventory-management-system/categories.php. The issue arises when a crafted payload is injected into the Categories Name parameter, allowing an at...

CVE-2023-24234

CVE-2023-24234 affects Inventory Management System v1, specifically the php-inventory-management-system/brand.php component. The vulnerability is a stored XSS that allows an attacker to inject arbitrary web scripts or HTML via the Brand Name parameter. Reported impact is execution of scripts with...

CVE-2023-4436

CVE-2023-4436 affects SourceCodester Inventory Management System 1.0. The vulnerability arises from unsafe handling in the file app/action/edit_update.php where manipulating the user_id parameter leads to SQL injection. It is a network-accessible issue with no required user interaction. Impact pe...

CVE-2023-4557

CVE-2023-4557 affects SourceCodester Inventory Management System 1.0. The vulnerability is in an unknown function of the file app/ajax/search_purchase_paymen_report.php; manipulating the customer parameter leads to an SQL injection. The issue permits remote exploitation and has been publicly disc...

CVE-2023-24233

CVE-2023-24233 describes a stored XSS in the Inventory Management System v1, specifically in the component /php-inventory-management-system/orders.php?o=add. The vulnerability is triggered via the Client Name parameter, enabling an attacker to inject arbitrary web scripts or HTML. Documented impa...

CVE-2023-36337

The PHP Inventory Management System version 1 is vulnerable to a reflected cross-site scripting (XSS) vulnerability in the /index.php/cuzh4 component. This flaw allows an attacker to execute arbitrary web scripts or HTML by providing a crafted payload. At this time, no information is available re...

CVE-2023-36338

The Inventory Management System 1 software contains a SQL injection vulnerability caused by the insufficient sanitization of user-supplied data before it is used in a SQL query. This flaw allows an attacker to manipulate database queries through crafted input. The affected versions are not specif...