CVE-2023-31940

CVE-2023-31940 affects Online Travel Agency System v1.0, with a SQL injection vulnerability in article_edit.php via the page_id parameter. The issue enables a remote attacker to execute arbitrary SQL commands, potentially compromising data confidentiality, integrity, and availability. Several lin...

CVE-2023-31941

CVE-2023-31941 concerns a file upload vulnerability in Online Travel Agency System v1.0. The Red Hat, NVD, and related entries converge on a remote code execution risk via uploading a crafted PHP file to employee_insert.php, enabling an attacker to execute arbitrary code. The common root cause is...

CVE-2023-31938

The CVE-2023-31938 entry concerns Online Travel Agency System v1.0 with a SQL injection in the emp_id parameter of employee_detail.php. The underlying issue allows a remote attacker to execute arbitrary code, as indicated by the description and CVSS/impact data (C, I, A = HIGH; base score 7.2). P...

CVE-2023-31939

CVE-2023-31939 affects Online Travel Agency System v1.0. The root cause is a SQL injection in the costomer_id parameter of the the customer_edit.php endpoint, allowing a remote attacker to execute arbitrary code. Public details consistently describe a high-severity impact with potential for data ...

CVE-2023-31942

CVE-2023-31942 describes a Cross Site Scripting (XSS) vulnerability affecting Online Travel Agency System v1.0. An attacker can inject a payload via the description parameter in insert.php to execute arbitrary web scripts/HTML in a victim’s browser. The connected sources consistently cite this ve...

CVE-2023-31944

CVE-2023-31944 is a SQL injection vulnerability in Online Travel Agency System v1.0 that allows a remote attacker to cause arbitrary code execution via the emp_id parameter in employee_edit.php. Sources consistently describe the vulnerability as located in the Online Travel Agency System (version...

CVE-2023-31943

CVE-2023-31943 describes a SQL injection vulnerability in Online Travel Agency System v1.0. The issue stems from unsafe handling of the ticket_id parameter in ticket_detail.php, allowing a remote attacker to potentially execute arbitrary SQL commands. NVD metrics indicate high impact (CVSS v3.1: ...

CVE-2023-31945

CVE-2023-31945 describes a SQL injection vulnerability in the Online Travel Agency System v1.0. The flaw allows a remote attacker to manipulate the id parameter in daily_expenditure_edit.php to execute arbitrary code. Reports across multiple sources confirm the same description, with no public re...

CVE-2023-31946

The CVE-2023-31946 issue concerns the Online Travel Agency System (v1.0) with a file-upload vulnerability in artical.php that allows remote code execution via a crafted PHP file. Multiple connected sources (Red Hat, CNVD, NVD, CVE lists) corroborate that the vulnerability stems from insufficient ...