CVE-2022-2291

SourceCodester Hotel Management System Search search cross site scripting

A vulnerability was found in SourceCodester Hotel Management System 2.0. It has been rated as problematic. This issue affects some unknown processing of the file /ci_hms/search of the component Search. The manipulation of the argument search with the input "><script>alert("XSS")</script> leads to cross site scripting. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed

Vendors

Hotel Management System Project

Products

Hotel Management System

CVE-2023-36494

F5OS-A vulnerability

Audit logs on F5OS-A may contain undisclosed sensitive information.  Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

CVSS 3.1 · 4.4 Medium EPSS < 1% KEV · Not listed

Vendors

F5

Products

F5os-a

CVE-2022-2292

SourceCodester Hotel Management System Room Edit Page 1 cross site scripting

A vulnerability classified as problematic has been found in SourceCodester Hotel Management System 2.0. Affected is an unknown function of the file /ci_hms/massage_room/edit/1 of the component Room Edit Page. The manipulation of the argument massageroomDetails with the input "><script>alert("XSS")</script> leads to cross site scripting. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.

CVSS 3.1 · 3.5 Low EPSS < 1% KEV · Not listed

Vendors

Hotel Management System Project

Products

Hotel Management System

CVE-2022-2293

SourceCodester Simple Sales Management System create cross site scripting

A vulnerability classified as problematic was found in SourceCodester Simple Sales Management System 1.0. Affected by this vulnerability is an unknown functionality of the file /ci_ssms/index.php/orders/create. The manipulation of the argument customer_name with the input <script>alert("XSS")</script> leads to cross site scripting. The attack can be launched remotely. The exploit has been disclosed to the public and may be used.

CVSS 3.1 · 3.5 Low EPSS < 1% KEV · Not listed

Vendors

Simple Sales Management System Project

Products

Simple Sales Management System

CVE-2022-2297

SourceCodester Clinics Patient Management System unrestricted upload

A vulnerability, which was classified as critical, was found in SourceCodester Clinics Patient Management System 2.0. Affected is an unknown function of the file /pms/update_user.php?user_id=1. The manipulation of the argument profile_picture with the input <?php phpinfo();?> leads to unrestricted upload. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.

CVSS 3.1 · 6.3 Medium EPSS 3.4% KEV · Not listed

Vendors

Oretnom23

Products

Clinic\'s Patient Management System

CVE-2022-2363

SourceCodester Simple Parking Management System cross site scripting

A vulnerability, which was classified as problematic, has been found in SourceCodester Simple Parking Management System 1.0. Affected by this issue is some unknown functionality of the file /ci_spms/admin/search/searching/. The manipulation of the argument search with the input "><script>alert("XSS")</script> leads to cross site scripting. The attack may be launched remotely. The exploit has been disclosed to the public and may be used.

CVSS 3.1 · 3.5 Low EPSS < 1% KEV · Not listed

Vendors

Simple Parking Management System Project

Products

Simple Parking Management System

CVE-2022-2364

SourceCodester Simple Parking Management System category cross site scripting

A vulnerability, which was classified as problematic, was found in SourceCodester Simple Parking Management System 1.0. This affects an unknown part of the file /ci_spms/admin/category. The manipulation of the argument vehicle_type with the input "><script>alert("XSS")</script> leads to cross site scripting. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.

CVSS 3.1 · 3.5 Low EPSS < 1% KEV · Not listed

Vendors

Simple Parking Management System Project

Products

Simple Parking Management System

CVE-2017-20129

LogoStore search.php sql injection

A vulnerability was found in LogoStore. It has been classified as critical. Affected is an unknown function of the file /LogoStore/search.php. The manipulation of the argument query with the input test' UNION ALL SELECT CONCAT(CONCAT('qqkkq','VnPVWVaYxljWqGpLLbEIyPIHBjjjjASQTnaqfKaV'),'qvvpq'),NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL-- oCrh&search= leads to sql injection. It is possible to launch the attack remotely.

CVSS 3.1 · 6.3 Medium EPSS < 1% KEV · Not listed

Vendors

Logostore Project

Products

Logostore

CVE-2022-2396

SourceCodester Simple e-Learning System claire_blake cross site scripting

A vulnerability classified as problematic was found in SourceCodester Simple e-Learning System 1.0. Affected by this vulnerability is an unknown functionality of the file /vcs/claire_blake. The manipulation of the argument Bio with the input "><script>alert(document.cookie)</script> leads to cross site scripting. The attack can be launched remotely. The exploit has been disclosed to the public and may be used.

CVSS 3.1 · 3.5 Low EPSS < 1% KEV · Not listed

Vendors

Simple E-learning System Project

Products

Simple E-learning System

CVE-2022-2418

URVE Web Manager img_upload.php unrestricted upload

A vulnerability was found in URVE Web Manager. It has been classified as critical. This affects an unknown part of the file kreator.html5/img_upload.php. The manipulation leads to unrestricted upload. Access to the local network is required for this attack. The exploit has been disclosed to the public and may be used.

CVSS 3.1 · 8 High EPSS 1.1% KEV · Not listed

Vendors

Eveo

Products

Urve Web Manager

CVE-2022-2419

URVE Web Manager upload.php unrestricted upload

A vulnerability was found in URVE Web Manager. It has been declared as critical. This vulnerability affects unknown code of the file _internal/collector/upload.php. The manipulation leads to unrestricted upload. Access to the local network is required for this attack to succeed. The exploit has been disclosed to the public and may be used.

CVSS 3.1 · 8 High EPSS 12.8% KEV · Not listed

Vendors

Eveo

Products

Urve Web Manager

CVE-2022-2420

URVE Web Manager uploader.php unrestricted upload

A vulnerability was found in URVE Web Manager. It has been rated as critical. This issue affects some unknown processing of the file _internal/uploader.php. The manipulation leads to unrestricted upload. The attack needs to be approached within the local network. The exploit has been disclosed to the public and may be used.

CVSS 3.1 · 8 High EPSS 1.1% KEV · Not listed

Vendors

Eveo

Products

Urve Web Manager

CVE-2017-20130

Itech Real Estate Script search_property.php sql injection

A vulnerability was found in Itech Real Estate Script 3.12. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the file /real-estate-script/search_property.php. The manipulation of the argument property_for leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used.

CVSS 3.1 · 6.3 Medium EPSS 1.1% KEV · Not listed

Vendors

Itechscripts

Products

Real Estate Script

CVE-2017-20131

Itech News Portal information.php sql injection

A vulnerability was found in Itech News Portal 6.28. It has been classified as critical. Affected is an unknown function of the file /news-portal-script/information.php. The manipulation of the argument inf leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.

CVSS 3.1 · 6.3 Medium EPSS 1.1% KEV · Not listed

Vendors

Itechscripts

Products

News Portal Script

CVE-2017-20132

Itech Multi Vendor Script product-list.php sql injection

A vulnerability was found in Itech Multi Vendor Script 6.49 and classified as critical. This issue affects some unknown processing of the file /multi-vendor-shopping-script/product-list.php. The manipulation of the argument pl leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used.

CVSS 3.1 · 6.3 Medium EPSS < 1% KEV · Not listed

Vendors

Itechscripts

Products

Multi Vendor Script

CVE-2017-20134

Itech Freelancer Script category.php sql injection

A vulnerability, which was classified as critical, has been found in Itech Freelancer Script 5.13. Affected by this issue is some unknown functionality of the file /category.php. The manipulation of the argument sk leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used.

CVSS 3.1 · 6.3 Medium EPSS < 1% KEV · Not listed

Vendors

Itechscripts

Products

Freelancer Script

CVE-2017-20135

Itech Dating Script see_more_details.php sql injection

A vulnerability classified as critical was found in Itech Dating Script 3.26. Affected by this vulnerability is an unknown functionality of the file /see_more_details.php. The manipulation of the argument id leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used.

CVSS 3.1 · 6.3 Medium EPSS < 1% KEV · Not listed

Vendors

Itechscripts

Products

Dating Script

CVE-2017-20136

Itech Classifieds Script subpage.php sql injection

A vulnerability classified as critical has been found in Itech Classifieds Script 7.27. Affected is an unknown function of the file /subpage.php. The manipulation of the argument scat with the input =51' AND 4941=4941 AND 'hoCP'='hoCP leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.

CVSS 3.1 · 6.3 Medium EPSS < 1% KEV · Not listed

Vendors

Itechscripts

Products

Classifieds Script

CVE-2017-20137

Itech B2B Script catcompany.php sql injection

A vulnerability was found in Itech B2B Script 4.28. It has been rated as critical. This issue affects some unknown processing of the file /catcompany.php. The manipulation of the argument token with the input 704667c6a1e7ce56d3d6fa748ab6d9af3fd7' AND 6539=6539 AND 'Fakj'='Fakj leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used.

CVSS 3.1 · 6.3 Medium EPSS < 1% KEV · Not listed

Vendors

Itechscripts

Products

B2b Script

CVE-2017-20138

Itech Auction Script mcategory.php Blind sql injection

A vulnerability was found in Itech Auction Script 6.49. It has been classified as critical. This affects an unknown part of the file /mcategory.php. The manipulation of the argument mcid with the input 4' AND 1734=1734 AND 'Ggks'='Ggks leads to sql injection (Blind). It is possible to initiate the attack remotely.

CVSS 3.1 · 6.3 Medium EPSS < 1% KEV · Not listed

Vendors

Itechscripts

Products

Auction Script