CVE-2022-26295

CVE-2022-26295 is a stored XSS vulnerability in Online Project Time Management System v1.0, exploitable via /ptms/?page=user by injecting payload into the user name field. The core issue is lack of input validation/filtering and unsafe output handling for user-supplied data. Multiple connected so...

CVE-2022-26293

CVE-2022-26293 affects Online Project Time Management System v1.0. The vulnerability is a SQL injection in the id parameter of the save_employee function in /ptms/classes/Users.php, allowing an attacker to manipulate SQL queries. Multiple connected sources confirm the issue and outline the vulner...

CVE-2022-26627

The CVE-2022-26627 entry concerns Online Project Time Management System v1.0, where an arbitrary file write vulnerability exists that enables an attacker to execute arbitrary code through a crafted HTML file. The connected Red Hat entry reiterates the same description, confirming that the flaw is...

CVE-2021-46451

Sourcecodester Online Project Time Management System 1.0 is affected by an SQL injection via the pid parameter in the load_file function. Root cause: lack of validation of externally entered SQL statements in the database-based application. Impact: arbitrary SQL execution with high confidentialit...