CVE-2023-48902

Tramyardg Autoexpress version 1.3.0 is vulnerable to an authentication bypass in the uploadCarImages.php file. This flaw allows unauthenticated remote attackers to gain unauthorized access to administrative functionality. Practical consequences include the ability to escalate privileges , update ...

CVE-2024-30974

The car dealership application autoexpress v.1.3.0 contains a SQL Injection vulnerability (CWE-89). The flaw originates from the improper neutralization of special elements in the carId parameter, which allows an attacker to execute arbitrary SQL commands. This could potentially lead to unauthori...

CVE-2023-48903

The tramyardg autoexpress application, version 1.3.0 , contains a Stored Cross-Site Scripting (XSS) vulnerability. This flaw allows remote unauthenticated attackers to inject arbitrary web scripts or HTML by exploiting the imgType parameter (referenced in some documentation as imageType[]) via th...

CVE-2023-48901

A SQL injection vulnerability exists in tramyardg Autoexpress version 1.3.0 . The flaw is caused by the improper neutralization of special elements used in an SQL command within the getPhotosByCarId function call. Remote unauthenticated attackers can exploit this by providing malicious input via ...