DiliLearngent/BugReport

GitHub

github.com

Releases0

Stars1

Vulnerability mining and Code audit

CVE History

CVE	Published	CVSS v3	CVSS v2
CVE-2024-40074 ↗	Apr 16, 2025Wednesday, 16 April 2025, 17:15	4.8 MEDIUM	—
Sourcecodester Online ID Generator System 1.0 was discovered to contain Stored Cross Site Scripting (XSS) via id_generator/classes/SystemSettings.php?f=update_settings, and the point of vulnerability is in the POST parameter 'short_name'.
CVE-2024-40073 ↗	Apr 16, 2025Wednesday, 16 April 2025, 17:15	9.8 CRITICAL	—
Sourcecodester Online ID Generator System 1.0 was discovered to contain a SQL injection vulnerability via the template parameter at id_generator/admin/?page=generate&template=4.
CVE-2024-40072 ↗	Apr 16, 2025Wednesday, 16 April 2025, 17:15	9.8 CRITICAL	—
Sourcecodester Online ID Generator System 1.0 was discovered to contain a SQL injection vulnerability via the id parameter at id_generator/admin/?page=generate/index&id=1.
CVE-2024-40071 ↗	Apr 16, 2025Wednesday, 16 April 2025, 17:15	9.8 CRITICAL	—
Sourcecodester Online ID Generator System 1.0 was discovered to contain an arbitrary file upload vulnerability via id_generator/classes/SystemSettings.php?f=update_settings. This vulnerability allows attackers to execute arbitrary code via a crafted PHP file.
CVE-2024-40070 ↗	Apr 16, 2025Wednesday, 16 April 2025, 17:15	5.1 MEDIUM	—
Sourcecodester Online ID Generator System 1.0 was discovered to contain an arbitrary file upload vulnerability via id_generator/classes/Users.php?f=save. This vulnerability allows attackers to execute arbitrary code via a crafted PHP file.
CVE-2024-40069 ↗	Apr 16, 2025Wednesday, 16 April 2025, 17:15	5.4 MEDIUM	—
Sourcecodester Online ID Generator System 1.0 was discovered to contain Stored Cross Site Scripting (XSS) via id_generator/classes/Users.php?f=save, and the point of vulnerability is in the POST parameter 'firstname' and 'lastname'.
CVE-2024-40068 ↗	Apr 16, 2025Wednesday, 16 April 2025, 17:15	5.9 MEDIUM	—
Sourcecodester Online ID Generator System 1.0 was discovered to contain a SQL injection vulnerability via the id parameter at id_generator/admin/?page=templates/manage_template&id=1.
CVE-2023-40874 ↗	Aug 24, 2023Thursday, 24 August 2023, 15:15	5.4 MEDIUM	—
DedeCMS up to and including 5.7.110 was discovered to contain multiple cross-site scripting (XSS) vulnerabilities at /dede/vote_add.php via the votename and voteitem1 parameters.
CVE-2023-40877 ↗	Aug 24, 2023Thursday, 24 August 2023, 15:15	5.4 MEDIUM	—
DedeCMS up to and including 5.7.110 was discovered to contain a cross-site scripting (XSS) vulnerability at /dede/freelist_edit.php via the title parameter.
CVE-2023-40876 ↗	Aug 24, 2023Thursday, 24 August 2023, 15:15	5.4 MEDIUM	—
DedeCMS up to and including 5.7.110 was discovered to contain a cross-site scripting (XSS) vulnerability at /dede/freelist_add.php via the title parameter.
CVE-2023-40875 ↗	Aug 24, 2023Thursday, 24 August 2023, 15:15	5.4 MEDIUM	—
DedeCMS up to and including 5.7.110 was discovered to contain multiple cross-site scripting (XSS) vulnerabilities at /dede/vote_edit.php via the votename and votenote parameters.
CVE-2023-31944 ↗	Aug 17, 2023Thursday, 17 August 2023, 20:15	7.2 HIGH	—
SQL injection vulnerability found in Online Travel Agency System v.1.0 allows a remote attacker to execute arbitrary code via the emp_id parameter at employee_edit.php.
CVE-2023-31946 ↗	Aug 17, 2023Thursday, 17 August 2023, 20:15	7.2 HIGH	—
File Upload vulnerability found in Online Travel Agency System v.1.0 allows a remote attacker to execute arbitrary code via a crafted PHP file to the artical.php.
CVE-2023-31945 ↗	Aug 17, 2023Thursday, 17 August 2023, 20:15	7.2 HIGH	—
SQL injection vulnerability found in Online Travel Agency System v.1.0 allows a remote attacker to execute arbitrary code via the id parameter at daily_expenditure_edit.php.
CVE-2023-31940 ↗	Aug 17, 2023Thursday, 17 August 2023, 20:15	7.2 HIGH	—
SQL injection vulnerability found in Online Travel Agency System v.1.0 allows a remote attacker to execute arbitrary code via the page_id parameter at article_edit.php.
CVE-2023-31943 ↗	Aug 17, 2023Thursday, 17 August 2023, 20:15	7.2 HIGH	—
SQL injection vulnerability found in Online Travel Agency System v.1.0 allows a remote attacker to execute arbitrary code via the ticket_id parameter at ticket_detail.php.
CVE-2023-31942 ↗	Aug 17, 2023Thursday, 17 August 2023, 20:15	4.8 MEDIUM	—
Cross Site Scripting vulnerability found in Online Travel Agency System v.1.0 allows a remote attacker to execute arbitrary code via the description parameter in insert.php.
CVE-2023-31941 ↗	Aug 17, 2023Thursday, 17 August 2023, 20:15	7.2 HIGH	—
File Upload vulnerability found in Online Travel Agency System v.1.0 allows a remote attacker to execute arbitrary code via a crafted PHP file to the employee_insert.php.
CVE-2023-31939 ↗	Aug 17, 2023Thursday, 17 August 2023, 20:15	7.2 HIGH	—
SQL injection vulnerability found in Online Travel Agency System v.1.0 allows a remote attacker to execute arbitrary code via the costomer_id parameter at customer_edit.php.
CVE-2023-31938 ↗	Aug 17, 2023Thursday, 17 August 2023, 20:15	7.2 HIGH	—
SQL injection vulnerability found in Online Travel Agency System v.1.0 allows a remote attacker to execute arbitrary code via the emp_id parameter at employee_detail.php.
CVE-2023-31932 ↗	Jul 28, 2023Friday, 28 July 2023, 14:15	7.2 HIGH	—
Sql injection vulnerability found in Rail Pass Management System v.1.0 allows a remote attacker to execute arbitrary code via the viewid parameter of the view-enquiry.php file.
CVE-2023-31937 ↗	Jul 28, 2023Friday, 28 July 2023, 14:15	7.2 HIGH	—
Sql injection vulnerability found in Rail Pass Management System v.1.0 allows a remote attacker to execute arbitrary code via the editid parameter of the edit-cateogry-detail.php file.
CVE-2023-31936 ↗	Jul 28, 2023Friday, 28 July 2023, 14:15	7.2 HIGH	—
Sql injection vulnerability found in Rail Pass Management System v.1.0 allows a remote attacker to execute arbitrary code via the viewid parameter of the view-pass-detail.php file.
CVE-2023-31935 ↗	Jul 28, 2023Friday, 28 July 2023, 14:15	4.8 MEDIUM	—
Cross Site Scripting vulnerability found in Rail Pass Management System v.1.0 allows a remote attacker to obtain sensitive information via the emial parameter of admin-profile.php.
CVE-2023-31934 ↗	Jul 28, 2023Friday, 28 July 2023, 14:15	4.8 MEDIUM	—
Cross Site Scripting vulnerability found in Rail Pass Management System v.1.0 allows a remote attacker to obtain sensitive information via the adminname parameter of admin-profile.php.
CVE-2023-31933 ↗	Jul 28, 2023Friday, 28 July 2023, 14:15	7.2 HIGH	—
Sql injection vulnerability found in Rail Pass Management System v.1.0 allows a remote attacker to execute arbitrary code via the editid parameter of the edit-pass-detail.php file.