CVSS: 7.1EPSS: 0%CPEs: 3EXPL: 0CVE-2024-33981 – Cross-site Scripting in Janobe products
https://notcve.org/view.php?id=CVE-2024-33981
06 Aug 2024 — Cross-Site Scripting (XSS) vulnerability in PayPal, Credit Card and Debit Card Payment affecting version 1.0. An attacker could create a specially crafted URL and send it to a victim to obtain details of their session cookie via the 'start' parameter in '/admin/mod_reports/index.php'. Cross-Site Scripting (XSS) vulnerability in PayPal, Credit Card and Debit Card Payment affecting version 1.0. An attacker could create a specially crafted URL and send it to a victim to obtain details of their session cookie v... • https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-janobe-products • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 7.1EPSS: 0%CPEs: 3EXPL: 0CVE-2024-33980 – Cross-site Scripting in Janobe products
https://notcve.org/view.php?id=CVE-2024-33980
06 Aug 2024 — Cross-Site Scripting (XSS) vulnerability in PayPal, Credit Card and Debit Card Payment affecting version 1.0. An attacker could create a specially crafted URL and send it to a victim to obtain details of their session cookie via the 'start' parameter in '/admin/mod_reports/printreport.php'. Cross-Site Scripting (XSS) vulnerability in PayPal, Credit Card and Debit Card Payment affecting version 1.0. An attacker could create a specially crafted URL and send it to a victim to obtain details of their session co... • https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-janobe-products • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 7.1EPSS: 0%CPEs: 3EXPL: 0CVE-2024-33979 – Cross-site Scripting in Janobe products
https://notcve.org/view.php?id=CVE-2024-33979
06 Aug 2024 — Cross-Site Scripting (XSS) vulnerability in PayPal, Credit Card and Debit Card Payment affecting version 1.0. An attacker could create a specially crafted URL and send it to a victim to obtain details of their session cookie via the 'q', 'arrival', 'departure' and 'accomodation' parameters in '/index.php'. Cross-Site Scripting (XSS) vulnerability in PayPal, Credit Card and Debit Card Payment affecting version 1.0. An attacker could create a specially crafted URL and send it to a victim to obtain details of ... • https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-janobe-products • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 9.8EPSS: 0%CPEs: 1EXPL: 0CVE-2024-33958 – SQL injection in Janobe E-Negosyo System
https://notcve.org/view.php?id=CVE-2024-33958
06 Aug 2024 — SQL injection vulnerability in E-Negosyo System affecting version 1.0. An attacker could exploit this vulnerability by sending a specially crafted query to the server and retrieve all the information stored in 'phonenumber' in '/passwordrecover.php' parameter. • https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-janobe-products • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') •
CVSS: 9.8EPSS: 0%CPEs: 1EXPL: 0CVE-2024-33957 – SQL injection in Janobe E-Negosyo System
https://notcve.org/view.php?id=CVE-2024-33957
06 Aug 2024 — SQL injection vulnerability in E-Negosyo System affecting version 1.0. An attacker could exploit this vulnerability by sending a specially crafted query to the server and retrieve all the information stored in 'id' in '/admin/orders/controller.php' parameter • https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-janobe-products • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') •
CVSS: 7.1EPSS: 0%CPEs: 1EXPL: 0CVE-2024-33978 – Cross-site Scripting in Janobe E-Negosyo System
https://notcve.org/view.php?id=CVE-2024-33978
06 Aug 2024 — Cross-Site Scripting (XSS) vulnerability in E-Negosyo System affecting version 1.0. An attacker could create a specially crafted URL and send it to a victim to obtain their session cookie details via 'category' parameter in '/index.php'. • https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-janobe-products • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 7.1EPSS: 0%CPEs: 1EXPL: 0CVE-2024-33977 – Cross-site Scripting in Janobe E-Negosyo System
https://notcve.org/view.php?id=CVE-2024-33977
06 Aug 2024 — Cross-Site Scripting (XSS) vulnerability in E-Negosyo System affecting version 1.0. An attacker could create a specially crafted URL and send it to a victim to obtain their session cookie details via 'view' parameter in /admin/orders/index.php'. • https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-janobe-products • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 7.1EPSS: 0%CPEs: 1EXPL: 0CVE-2024-33976 – Cross-site Scripting in Janobe E-Negosyo System
https://notcve.org/view.php?id=CVE-2024-33976
06 Aug 2024 — Cross-Site Scripting (XSS) vulnerability in E-Negosyo System affecting version 1.0. An attacker could exploit this vulnerability by sending a specially crafted JavaScript payload to an authenticated user and partially take over their browser session via 'id' parameter in '/admin/user/index.php'. Cross-Site Scripting (XSS) vulnerability in E-Negosyo System affecting version 1.0. An attacker could exploit this vulnerability by sending a specially crafted JavaScript payload to an authenticated user and partial... • https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-janobe-products • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 7.1EPSS: 0%CPEs: 1EXPL: 0CVE-2024-33975 – Cross-site Scripting in Janobe E-Negosyo System
https://notcve.org/view.php?id=CVE-2024-33975
06 Aug 2024 — Cross-Site Scripting (XSS) vulnerability in E-Negosyo System affecting version 1.0. An attacker could exploit this vulnerability by sending a specially crafted JavaScript payload to an authenticated user and partially take over their browser session via 'view' parameter in '/admin/products/index.php'. Cross-Site Scripting (XSS) vulnerability in E-Negosyo System affecting version 1.0. An attacker could exploit this vulnerability by sending a specially crafted JavaScript payload to an authenticated user and p... • https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-janobe-products • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 9.8EPSS: 0%CPEs: 1EXPL: 0CVE-2024-0182 – SourceCodester Engineers Online Portal Admin Login sql injection
https://notcve.org/view.php?id=CVE-2024-0182
01 Jan 2024 — A vulnerability was found in SourceCodester Engineers Online Portal 1.0 and classified as critical. Affected by this issue is some unknown functionality of the file /admin/ of the component Admin Login. The manipulation of the argument username/password leads to sql injection. The attack may be launched remotely. The identifier of this vulnerability is VDB-249440. • https://vuldb.com/?ctiid.249440 • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') •