CVSS: 5.4EPSS: 0%CPEs: 1EXPL: 2CVE-2023-1569 – SourceCodester E-Commerce System cross site scripting
https://notcve.org/view.php?id=CVE-2023-1569
A vulnerability classified as problematic was found in SourceCodester E-Commerce System 1.0. Affected by this vulnerability is an unknown functionality of the file admin/user/controller.php?action=edit. The manipulation of the argument U_NAME with the input <script>alert('1')</script> leads to cross site scripting. The attack can be launched remotely. • https://vuldb.com/?ctiid.223561 https://vuldb.com/?id.223561 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 9.8EPSS: 0%CPEs: 1EXPL: 0CVE-2023-1557 – SourceCodester E-Commerce System Username access control
https://notcve.org/view.php?id=CVE-2023-1557
A vulnerability was found in SourceCodester E-Commerce System 1.0. It has been rated as critical. Affected by this issue is some unknown functionality of the file /ecommerce/admin/user/controller.php?action=edit of the component Username Handler. The manipulation of the argument USERID leads to improper access controls. • https://vuldb.com/?ctiid.223550 https://vuldb.com/?id.223550 • CWE-284: Improper Access Control •
CVSS: 6.1EPSS: 0%CPEs: 1EXPL: 0CVE-2023-1507 – SourceCodester E-Commerce System Category Name controller.php cross site scripting
https://notcve.org/view.php?id=CVE-2023-1507
A vulnerability has been found in SourceCodester E-Commerce System 1.0 and classified as problematic. Affected by this vulnerability is an unknown functionality of the file /ecommerce/admin/category/controller.php of the component Category Name Handler. The manipulation of the argument CATEGORY leads to cross site scripting. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. • https://vuldb.com/?ctiid.223411 https://vuldb.com/?id.223411 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 8.1EPSS: 0%CPEs: 1EXPL: 0CVE-2023-1506 – SourceCodester E-Commerce System login.php sql injection
https://notcve.org/view.php?id=CVE-2023-1506
A vulnerability, which was classified as critical, was found in SourceCodester E-Commerce System 1.0. Affected is an unknown function of the file login.php. The manipulation of the argument U_USERNAME leads to sql injection. It is possible to launch the attack remotely. The complexity of an attack is rather high. • https://vuldb.com/?ctiid.223410 https://vuldb.com/?id.223410 • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') •
CVSS: 8.1EPSS: 0%CPEs: 1EXPL: 2CVE-2023-1505 – SourceCodester E-Commerce System setDiscount.php sql injection
https://notcve.org/view.php?id=CVE-2023-1505
A vulnerability, which was classified as critical, has been found in SourceCodester E-Commerce System 1.0. This issue affects some unknown processing of the file /ecommerce/admin/settings/setDiscount.php. The manipulation of the argument id with the input 201737 AND (SELECT 8973 FROM (SELECT(SLEEP(5)))OoAD) leads to sql injection. The attack may be initiated remotely. The complexity of an attack is rather high. • https://vuldb.com/?ctiid.223409 https://vuldb.com/?id.223409 • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') •