CVSS: 10.0EPSS: 0%CPEs: 1EXPL: 0CVE-2022-3121 – SourceCodester Online Employee Leave Management System addemployee.php cross-site request forgery
https://notcve.org/view.php?id=CVE-2022-3121
05 Sep 2022 — A vulnerability was found in SourceCodester Online Employee Leave Management System 1.0. It has been declared as problematic. Affected by this vulnerability is an unknown functionality of the file /admin/addemployee.php. The manipulation leads to cross-site request forgery. The attack can be launched remotely. • https://vuldb.com/?id.207853 • CWE-352: Cross-Site Request Forgery (CSRF) •
CVSS: 10.0EPSS: 0%CPEs: 1EXPL: 1CVE-2022-2724 – SourceCodester Employee Management System aprocess.php sql injection
https://notcve.org/view.php?id=CVE-2022-2724
09 Aug 2022 — A vulnerability was found in SourceCodester Employee Management System. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the file /process/aprocess.php. The manipulation of the argument mailuid leads to sql injection. The attack can be launched remotely. • https://bewhale.github.io/post/PHP%E4%BB%A3%E7%A0%81%E5%AE%A1%E8%AE%A1%E2%80%94Employee%20Management%20System%20aprocess.php%20SQL%20Injection • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') •
CVSS: 10.0EPSS: 0%CPEs: 1EXPL: 1CVE-2022-2723 – SourceCodester Employee Management System eprocess.php sql injection
https://notcve.org/view.php?id=CVE-2022-2723
09 Aug 2022 — A vulnerability was found in SourceCodester Employee Management System. It has been classified as critical. Affected is an unknown function of the file /process/eprocess.php. The manipulation of the argument mailuid/pwd leads to sql injection. It is possible to launch the attack remotely. • https://bewhale.github.io/post/PHP%E4%BB%A3%E7%A0%81%E5%AE%A1%E8%AE%A1%E2%80%94Employee%20Management%20System%20eprocess.php%20SQL%20Injection • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') •
CVSS: 10.0EPSS: 0%CPEs: 1EXPL: 1CVE-2022-2715 – SourceCodester Employee Management System eloginwel.php sql injection
https://notcve.org/view.php?id=CVE-2022-2715
09 Aug 2022 — A vulnerability has been found in SourceCodester Employee Management System and classified as critical. This vulnerability affects unknown code of the file eloginwel.php. The manipulation of the argument id leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. • https://github.com/vuls/vuls/blob/main/Employee%20Management%20System/Employee%20Management%20System%20eloginwel.php%20SQL%20Injection.pdf • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') •
CVSS: 6.5EPSS: 0%CPEs: 1EXPL: 1CVE-2022-30931
https://notcve.org/view.php?id=CVE-2022-30931
14 Jun 2022 — Employee Leaves Management System (ELMS) V 2.1 is vulnerable to Cross Site Request Forgery (CSRF) via /myprofile.php. Employee Leaves Management System (ELMS) Versión 2.1, es vulnerable a Cross Site Request Forgery (CSRF) por medio del archivo /myprofile.php • https://medium.com/%40niteshbiwal2011/my-first-cve-2022-30931-e70b9cbecbba • CWE-352: Cross-Site Request Forgery (CSRF) •
CVSS: 5.4EPSS: 0%CPEs: 1EXPL: 1CVE-2021-43712
https://notcve.org/view.php?id=CVE-2021-43712
09 May 2022 — Stored XSS in Add New Employee Form in Sourcecodester Employee Daily Task Management System 1.0 Allows Remote Attacker to Inject/Store Arbitrary Code via the Name Field. Una vulnerabilidad de tipo XSS almacenado en el Formulario de Adición de Nuevos Empleados en Sourcecodester Employee Daily Task Management System versión 1.0, permite a un atacante remoto inyectar/almacenar código arbitrario por medio del campo del nombre • http://employee.com • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •