CVE-2022-2666

CVE-2022-2666 affects SourceCodester Loan Management System, specifically the login.php code path. The vulnerability is a SQL injection triggered by manipulating the username parameter, allowing remote exploitation. The issue is described as critical, with exploitation disclosed publicly (VDB-205...

CVE-2023-6310

The CVE-2023-6310 entry covers SourceCodester Loan Management System 1.0, affecting the deleteBorrower.php function (delete_borrower) via manipulation of borrower_id causing SQL injection. The vulnerability is network-exploitable (remote) and was disclosed publicly. Connected documents corroborat...

CVE-2024-48415

The connected documents confirm CVE-2024-48415 affects itsourcecode Loan Management System v1.0, with a Cross Site Scripting (XSS) vulnerability exploitable via a crafted payload passed to the lastname, firstname, middlename, address, contact_no, email, and tax_id fields in the New Borrowers page...

CVE-2022-2766

CVE-2022-2766 affects the SourceCodester Loan Management System. Affected component: unknown functionality in the file /index.php ; vulnerability arises from manipulating the password parameter, causing a SQL injection . Exploitation can be remote and the exploit has been publicly disclosed (VDB-...

CVE-2022-2667

CVE-2022-2667 affects SourceCodester Loan Management System, specifically the delete_lplan.php flow. The vulnerability stems from improper handling/manipulation of the lplan_id parameter, enabling SQL injection. It is described as exploitable remotely and has been disclosed publicly. Several conn...

CVE-2022-37138

CVE-2022-37138 affects Loan Management System 1.0 and is caused by SQL Injection on the login page, enabling unauthorized users to log in as Administrator via the username field. Documented impact indicates high consequences (C: High, I: High, A: High) with CVSSv3.1/3.1 base score 9.8 (AV:N/AC:L/...

CVE-2023-27242

This CVE concerns SourceCodester Loan Management System v1.0 where a cross-site scripting (XSS) vulnerability exists in the Edit Loan Types module, exploitable via the Type parameter. The issue is caused by improper handling of user input that can be reflected/stored and executed in the client co...

CVE-2024-31678

CVE-2024-31678 affects Sourcecodester Loan Management System v1.0. The vulnerability is SQL Injection via the password parameter in login.php, with CVSS 3.1/3.1 vector: AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, base score 9.8 (CRITICAL). Public sources confirm the flaw but do not provide concrete expl...

CVE-2023-6312

Affects: SourceCodester Loan Management System v1.0, specifically the Users Page deleteUser.php delete_user function. Issue: SQL injection caused by improper handling of the user_id argument, enabling remote exploitation. Evidence across multiple sources confirms the vulnerability and public disc...

CVE-2022-37139

CVE-2022-37139 is reported against the Loan Management System version 1.0 and is described in connected sources as a persistent cross-site scripting (XSS) vulnerability. Public documents do not provide concrete fixes, patches, or affected build details beyond the generic vulnerability description...

CVE-2023-6311

CVE-2023-6311 affects SourceCodester Loan Management System 1.0, specifically the delete_ltype.php component (Loan Type Page). The vulnerability arises from insecure handling of the ltype_id parameter in delete_ltype, enabling SQL injection. Exploitation is described as remotely possible with con...