CVE-2023-29623

CVE-2023-29623 : Purchase Order Management v1.0 contains a reflected XSS vulnerability exploitable via the password parameter in /purchase_order/classes/login.php. The Nuclei template corroborates this finding and describes the impact as malicious scripts executing in a victim’s browser, potentia...

CVE-2023-29621

CVE-2023-29621 concerns Purchase Order Management v1.0, where an arbitrary file upload vulnerability may allow attackers to execute arbitrary code on the server via crafted uploads. The provided connected documents confirm the affected software and the underlying issue, but do not specify any ven...

CVE-2023-29622

CVE-2023-29622 affects Purchase Order Management v1.0 via a SQL injection in /purchase_order/admin/login.php using the password parameter. Affected software/component: Purchase Order Management v1.0. Root cause: insufficient input sanitization leading to arbitrary SQL execution. Impact per source...