CVE Vulnerability Catalog

FMS developed by Otsuka Information Technology has a Reflected Cross-site Scripting vulnerability, allowing unauthenticated remote attackers to execute arbitrary JavaScript in the user's browser through phishing attacks.

SQL injection vulnerability in /schedule_edit1.php of itsourcecode Student Information System 1.0. Manipulation of the schedule_id argument allows remote SQL injection. The exploit is publicly available.

SQL injection vulnerability in /mail.php of code-projects Library System 1.0. Manipulation of the ID argument leads to SQL injection. Attack can be performed remotely, exploit is public.

SQL injection vulnerability in /return.php of code-projects Library System 1.0. Manipulation of the ID argument results in SQL injection. Attack can be launched remotely, exploit is public.

A vulnerability was detected in code-projects Blog Site 1.0. The affected element is an unknown function of the file /admin.php. Performing manipulation results in improper authorization. It is possible to initiate the attack remotely. The exploit is now public and may be used. Multiple endpoints are affected.

A security vulnerability has been detected in code-projects Blog Site 1.0. Impacted is the function category_exists of the file /resources/functions/blog.php of the component Category Handler. Such manipulation of the argument name/field leads to sql injection. The attack may be performed from remote. The exploit has been disclosed publicly and may be used. Multiple endpoints are affected.

A weakness was identified in code-projects Online Bidding System 1.0 in the categoryadd function of /administrator/addcategory.php. Manipulation of the catimage argument leads to unrestricted file upload. The attack can be carried out remotely and the exploit is publicly available.

A security flaw has been discovered in projectworlds can pass malicious payloads up to 1.0. This vulnerability affects unknown code of the file /add_book.php. The manipulation of the argument image results in unrestricted upload. The attack can be executed remotely. The exploit has been released to the public and may be exploited.

The WP Shortcodes Plugin — Shortcodes Ultimate for WordPress in versions up to and including 7.4.5 is vulnerable to Server-Side Request Forgery via the su_shortcode_csv_table function. An authenticated attacker with Administrator-level access or higher can make web requests to arbitrary locations from the web application, which can be used to query and modify information from internal services. If the 'Unsafe features' option is enabled, this issue becomes exploitable by Contributor+ attackers.

A vulnerability in Simple Food Ordering System 1.0 affects the /listorder.php file. Manipulation of the ID argument leads to SQL injection. The attack can be launched remotely, and the exploit has been publicly disclosed.

A vulnerability in COVID Tracking System 1.0 affects the /admin/?page=state file. Manipulation of the ID argument leads to SQL injection. The attack can be initiated remotely, and the exploit has been made public.

A vulnerability in COVID Tracking System 1.0 affects the /admin/?page=city file. Manipulation of the ID argument leads to SQL injection. The attack can be launched remotely, and the exploit has been disclosed.

A vulnerability in COVID Tracking System 1.0 affects the /admin/?page=people file. Manipulation of the ID argument leads to SQL injection. The attack can be initiated remotely, and the exploit has been published.

A vulnerability was detected in itsourcecode COVID Tracking System 1.0 affecting an unknown function of the file /admin/?page=establishment. Manipulation of the ID argument results in SQL injection.

A weakness was identified in SourceCodester Inventory Management System 1.0 in an unknown function of /model/user/resetPassword.php, leading to weak password recovery. The attack can be performed remotely and a public exploit is available.

A security flaw has been discovered in SourceCodester Pre-School Management System 1.0. The function removefile in app/controllers/FilehelperController.php is affected. Manipulation of the argument filepath results in denial of service. The attack can be carried out remotely and the exploit has been released.

A vulnerability was detected in ashraf-kabir travel-agency up to commit 1f25aa03544bc5fb7a9e846f8a7879cecdb0cad3 in the file /results.php of the Search component. Manipulation of the user_query argument leads to SQL injection. The attack can be launched remotely, and the exploit is now public and may be used. The product does not use versioning, so affected and unaffected releases are unavailable.

A security vulnerability was detected in ashraf-kabir travel-agency up to commit 1f25aa0 in /admin_area/index.php. Manipulating the edit_pack argument leads to SQL injection, and the attack can be initiated remotely. The exploit has been publicly disclosed and the vendor did not respond.

A weakness was identified in ashraf-kabir travel-agency up to commit 1f25aa0 in /customer_register.php allowing unrestricted upload. The attack can be launched remotely and the exploit is publicly available. The vendor did not respond.

The Booking Calendar Contact Form plugin for WordPress is vulnerable to Missing Authorization in all versions up to, and including, 1.2.60. This is due to missing authorization checks and payment verification in the `dex_bccf_check_IPN_verification` function.