CVSS: 9.8EPSS: 0%CPEs: 1EXPL: 0CVE-2024-33958 – SQL injection in Janobe E-Negosyo System
https://notcve.org/view.php?id=CVE-2024-33958
06 Aug 2024 — SQL injection vulnerability in E-Negosyo System affecting version 1.0. An attacker could exploit this vulnerability by sending a specially crafted query to the server and retrieve all the information stored in 'phonenumber' in '/passwordrecover.php' parameter. • https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-janobe-products • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') •
CVSS: 9.8EPSS: 0%CPEs: 1EXPL: 0CVE-2024-33957 – SQL injection in Janobe E-Negosyo System
https://notcve.org/view.php?id=CVE-2024-33957
06 Aug 2024 — SQL injection vulnerability in E-Negosyo System affecting version 1.0. An attacker could exploit this vulnerability by sending a specially crafted query to the server and retrieve all the information stored in 'id' in '/admin/orders/controller.php' parameter • https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-janobe-products • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') •
CVSS: 7.1EPSS: 0%CPEs: 1EXPL: 0CVE-2024-33978 – Cross-site Scripting in Janobe E-Negosyo System
https://notcve.org/view.php?id=CVE-2024-33978
06 Aug 2024 — Cross-Site Scripting (XSS) vulnerability in E-Negosyo System affecting version 1.0. An attacker could create a specially crafted URL and send it to a victim to obtain their session cookie details via 'category' parameter in '/index.php'. • https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-janobe-products • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 7.1EPSS: 0%CPEs: 1EXPL: 0CVE-2024-33977 – Cross-site Scripting in Janobe E-Negosyo System
https://notcve.org/view.php?id=CVE-2024-33977
06 Aug 2024 — Cross-Site Scripting (XSS) vulnerability in E-Negosyo System affecting version 1.0. An attacker could create a specially crafted URL and send it to a victim to obtain their session cookie details via 'view' parameter in /admin/orders/index.php'. • https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-janobe-products • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 7.1EPSS: 0%CPEs: 1EXPL: 0CVE-2024-33976 – Cross-site Scripting in Janobe E-Negosyo System
https://notcve.org/view.php?id=CVE-2024-33976
06 Aug 2024 — Cross-Site Scripting (XSS) vulnerability in E-Negosyo System affecting version 1.0. An attacker could exploit this vulnerability by sending a specially crafted JavaScript payload to an authenticated user and partially take over their browser session via 'id' parameter in '/admin/user/index.php'. Cross-Site Scripting (XSS) vulnerability in E-Negosyo System affecting version 1.0. An attacker could exploit this vulnerability by sending a specially crafted JavaScript payload to an authenticated user and partial... • https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-janobe-products • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 7.1EPSS: 0%CPEs: 1EXPL: 0CVE-2024-33975 – Cross-site Scripting in Janobe E-Negosyo System
https://notcve.org/view.php?id=CVE-2024-33975
06 Aug 2024 — Cross-Site Scripting (XSS) vulnerability in E-Negosyo System affecting version 1.0. An attacker could exploit this vulnerability by sending a specially crafted JavaScript payload to an authenticated user and partially take over their browser session via 'view' parameter in '/admin/products/index.php'. Cross-Site Scripting (XSS) vulnerability in E-Negosyo System affecting version 1.0. An attacker could exploit this vulnerability by sending a specially crafted JavaScript payload to an authenticated user and p... • https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-janobe-products • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 7.2EPSS: 3%CPEs: 1EXPL: 3CVE-2021-41675
https://notcve.org/view.php?id=CVE-2021-41675
29 Oct 2021 — A Remote Code Execution (RCE) vulnerabilty exists in Sourcecodester E-Negosyo System 1.0 in /admin/produts/controller.php via the doInsert function, which validates images with getImageSizei. . Se presenta una vulnerabilidad de Ejecución de Código Remota (RCE) en Sourcecodester E-Negosyo System versión 1.0, en el archivo /admin/produts/controller.php por medio de la función doInsert, que comprueba las imágenes con getImageSizei • https://github.com/janikwehrli1/0dayHunt/blob/main/E-Negosyo-Authenticated-RCE.py • CWE-434: Unrestricted Upload of File with Dangerous Type •
CVSS: 9.8EPSS: 0%CPEs: 1EXPL: 3CVE-2021-41674
https://notcve.org/view.php?id=CVE-2021-41674
29 Oct 2021 — An SQL Injection vulnerability exists in Sourcecodester E-Negosyo System 1.0 via the user_email parameter in /admin/login.php. Se presenta una vulnerabilidad de inyección SQL en Sourcecodester E-Negosyo System versión 1.0, por medio del parámetro user_email en el archivo /admin/login.php • https://github.com/janikwehrli1/0dayHunt/blob/main/E-Negosyo-System-SQLi.txt • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') •