CVE-2023-48823

GaatiTrack Courier Management System v1.0 is affected by a Blind SQL injection in ajax.php during login, exploitable via the email parameter by an unauthenticated attacker. The issue arises from improper handling of the email input in the login flow, enabling arbitrary SQL execution and potential...

CVE-2023-48206

GaatiTrack Courier Management System v1.0 contains a Cross Site Scripting (XSS) flaw exploitable via the page parameter in login.php and header.php. Public sources consistently describe reflected XSS that could allow an attacker to inject arbitrary scripts, with network access (AV:N) and user int...

CVE-2023-46974

The CVE concerns Best Courier Management System v1.000, where a Cross‑Site Scripting flaw in the page URL parameter allows remote code execution due to inadequate input filtering/escaping. Descriptions across CNVD/NVD/CVE references consistently identify the vulnerable component as the web input ...