CVE-2023-1987

SourceCodester Online Computer and Laptop Store update_order_status sql injection

A vulnerability has been found in SourceCodester Online Computer and Laptop Store 1.0 and classified as critical. Affected by this vulnerability is the function update_order_status of the file /classes/Master.php?f=update_order_status. The manipulation of the argument id leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-225535.

CVSS 3.1 · 6.3 Medium EPSS < 1% KEV · Not listed

Vendors

Oretnom23

Products

Online Computer And Laptop Store

CVE-2023-1985

SourceCodester Online Computer and Laptop Store save_brand sql injection

A vulnerability, which was classified as critical, has been found in SourceCodester Online Computer and Laptop Store 1.0. This issue affects the function save_brand of the file /classes/Master.php?f=save_brand. The manipulation of the argument name leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-225533 was assigned to this vulnerability.

CVSS 3.1 · 6.3 Medium EPSS < 1% KEV · Not listed

Vendors

Oretnom23

Products

Online Computer And Laptop Store

CVE-2023-1984

SourceCodester Complaint Management System POST Parameter check_availability.php sql injection

A vulnerability classified as critical was found in SourceCodester Complaint Management System 1.0. This vulnerability affects unknown code of the file /users/check_availability.php of the component POST Parameter Handler. The manipulation of the argument email leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-225532.

CVSS 3.1 · 6.3 Medium EPSS < 1% KEV · Not listed

Vendors

Complaint Management System Project

Products

Complaint Management System

CVE-2023-1983

SourceCodester Sales Tracker Management System GET Parameter manage_product.php sql injection

A vulnerability was found in SourceCodester Sales Tracker Management System 1.0. It has been rated as critical. Affected by this issue is some unknown functionality of the file /admin/products/manage_product.php of the component GET Parameter Handler. The manipulation of the argument id leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. VDB-225530 is the identifier assigned to this vulnerability.

CVSS 3.1 · 6.3 Medium EPSS < 1% KEV · Not listed

Vendors

Sales Tracker Management System Project

Products

Sales Tracker Management System

CVE-2023-1982

Front Editor <= 4.0.4 - Admin+ Stored XSS

The Front Editor WordPress plugin through 4.0.4 does not sanitize and escape some of its form settings, which could allow high-privilege users to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)

CVSS 3.1 · 4.8 Medium EPSS < 1% KEV · Not listed

Vendors

Aleksanaharonyan

Products

Front Editor

CVE-2023-1977

Booking Manager < 2.0.29 - Subscriber+ SSRF

The Booking Manager WordPress plugin before 2.0.29 does not validate URLs input in it's admin panel or in shortcodes for showing events from a remote .ics file, allowing an attacker with privileges as low as Subscriber to perform SSRF attacks on the sites internal network.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed

Vendors

Oplugins

Products

Booking Manager

CVE-2023-1971

yuan1994 tpAdmin Upload.php remote server-side request forgery

** UNSUPPORTED WHEN ASSIGNED ** A vulnerability, which was classified as critical, was found in yuan1994 tpAdmin 1.3.12. Affected is the function remote of the file application\admin\controller\Upload.php. The manipulation of the argument url leads to server-side request forgery. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-225408. NOTE: This vulnerability only affects products that are no longer supported by the maintainer.

CVSS 3.1 · 6.3 Medium EPSS < 1% KEV · Not listed

Vendors

Tpadmin Project

Products

Tpadmin

CVE-2023-1969

SourceCodester Online Eyewear Shop GET Parameter manage_stock.php sql injection

A vulnerability classified as critical was found in SourceCodester Online Eyewear Shop 1.0. This vulnerability affects unknown code of the file /admin/inventory/manage_stock.php of the component GET Parameter Handler. The manipulation of the argument id leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. VDB-225406 is the identifier assigned to this vulnerability.

CVSS 3.1 · 6.3 Medium EPSS < 1% KEV · Not listed

Vendors

Oretnom23

Products

Online Eyewear Shop

CVE-2023-1963

PHPGurukul Bank Locker Management System Search index.php sql injection

A vulnerability was found in PHPGurukul Bank Locker Management System 1.0. It has been rated as critical. This issue affects some unknown processing of the file index.php of the component Search. The manipulation of the argument searchinput leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-225359.

CVSS 3.1 · 6.3 Medium EPSS < 1% KEV · Not listed

Vendors

Phpgurukul

Products

Bank Locker Management System

CVE-2023-1961

SourceCodester Online Computer and Laptop Store cross site scripting

A vulnerability was found in SourceCodester Online Computer and Laptop Store 1.0. It has been classified as problematic. Affected is an unknown function of the file /admin/?page=system_info. The manipulation of the argument System Name leads to cross site scripting. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-225348.

CVSS 3.1 · 2.4 Low EPSS < 1% KEV · Not listed

Vendors

Oretnom23

Products

Online Computer And Laptop Store

CVE-2023-1960

SourceCodester Online Computer and Laptop Store sql injection

A vulnerability was found in SourceCodester Online Computer and Laptop Store 1.0 and classified as critical. This issue affects some unknown processing of the file /classes/Master.php?f=delete_category. The manipulation of the argument id leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-225347.

CVSS 3.1 · 6.3 Medium EPSS < 1% KEV · Not listed

Vendors

Oretnom23

Products

Online Computer And Laptop Store

CVE-2023-1958

SourceCodester Online Computer and Laptop Store sql injection

A vulnerability, which was classified as critical, was found in SourceCodester Online Computer and Laptop Store 1.0. This affects an unknown part of the file /classes/Master.php?f=delete_sub_category. The manipulation of the argument id leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-225345 was assigned to this vulnerability.

CVSS 3.1 · 6.3 Medium EPSS < 1% KEV · Not listed

Vendors

Oretnom23

Products

Online Computer And Laptop Store

CVE-2023-1957

SourceCodester Online Computer and Laptop Store Subcategory sql injection

A vulnerability, which was classified as critical, has been found in SourceCodester Online Computer and Laptop Store 1.0. Affected by this issue is some unknown functionality of the file /classes/Master.php?f=save_sub_category of the component Subcategory Handler. The manipulation of the argument sub_category leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-225344.

CVSS 3.1 · 6.3 Medium EPSS < 1% KEV · Not listed

Vendors

Oretnom23

Products

Online Computer And Laptop Store

CVE-2023-1956

SourceCodester Online Computer and Laptop Store Image path traversal

A vulnerability classified as critical was found in SourceCodester Online Computer and Laptop Store 1.0. Affected by this vulnerability is an unknown functionality of the file /classes/Master.php?f=delete_img of the component Image Handler. The manipulation of the argument path leads to path traversal. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-225343.

CVSS 3.1 · 5.4 Medium EPSS 1.1% KEV · Not listed

Vendors

Oretnom23

Products

Online Computer And Laptop Store

CVE-2023-1955

SourceCodester Online Computer and Laptop Store User Registration login.php sql injection

A vulnerability classified as critical has been found in SourceCodester Online Computer and Laptop Store 1.0. Affected is an unknown function of the file login.php of the component User Registration. The manipulation of the argument email leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. VDB-225342 is the identifier assigned to this vulnerability.

CVSS 3.1 · 7.3 High EPSS < 1% KEV · Not listed

Vendors

Oretnom23

Products

Online Computer And Laptop Store

CVE-2023-1954

SourceCodester Online Computer and Laptop Store manage.php save_inventory sql injection

A vulnerability was found in SourceCodester Online Computer and Laptop Store 1.0. It has been rated as critical. This issue affects the function save_inventory of the file /admin/product/manage.php. The manipulation of the argument id leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-225341 was assigned to this vulnerability.

CVSS 3.1 · 6.3 Medium EPSS < 1% KEV · Not listed

Vendors

Oretnom23

Products

Online Computer And Laptop Store

CVE-2023-1953

SourceCodester Online Computer and Laptop Store index.php sql injection

A vulnerability was found in SourceCodester Online Computer and Laptop Store 1.0. It has been declared as critical. This vulnerability affects unknown code of the file /admin/sales/index.php. The manipulation of the argument date_start/date_end leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-225340.

CVSS 3.1 · 6.3 Medium EPSS < 1% KEV · Not listed

Vendors

Oretnom23

Products

Online Computer And Laptop Store

CVE-2023-1951

SourceCodester Online Computer and Laptop Store brand.php delete_brand sql injection

A vulnerability was found in SourceCodester Online Computer and Laptop Store 1.0 and classified as critical. Affected by this issue is the function delete_brand of the file /admin/maintenance/brand.php. The manipulation of the argument id leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. VDB-225338 is the identifier assigned to this vulnerability.

CVSS 3.1 · 6.3 Medium EPSS < 1% KEV · Not listed

Vendors

Oretnom23

Products

Online Computer And Laptop Store

CVE-2023-1950

PHPGurukul BP Monitoring Management System Password Recovery password-recovery.php sql injection

A vulnerability has been found in PHPGurukul BP Monitoring Management System 1.0 and classified as critical. Affected by this vulnerability is an unknown functionality of the file password-recovery.php of the component Password Recovery. The manipulation of the argument emailid/contactno leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-225337 was assigned to this vulnerability.

CVSS 3.1 · 6.3 Medium EPSS < 1% KEV · Not listed

Vendors

Phpgurukul

Products

Bp Monitoring Management System

CVE-2023-1949

PHPGurukul BP Monitoring Management System Change Password change-password.php sql injection

A vulnerability, which was classified as critical, was found in PHPGurukul BP Monitoring Management System 1.0. Affected is an unknown function of the file change-password.php of the component Change Password Handler. The manipulation of the argument password leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-225336.

CVSS 3.1 · 6.3 Medium EPSS < 1% KEV · Not listed

Vendors

Phpgurukul

Products

Bp Monitoring Management System