CVSS: 6.1EPSS: 0%CPEs: 1EXPL: 0CVE-2023-37150
https://notcve.org/view.php?id=CVE-2023-37150
Sourcecodester Online Pizza Ordering System v1.0 has a Cross-site scripting (XSS) vulnerability in "/admin/index.php?page=categories" Category item. • https://github.com/Trinity-SYT-SECURITY/XSS_vuln_issue/blob/main/Online%20Pizza%20Ordering%20System%20v1.0.md https://www.chtsecurity.com/news/57fd2fe6-11d9-421d-9087-88b4d5090452 https://www.chtsecurity.com/news/c27389f3-a70b-4a71-952a-49f273d1db90 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 9.8EPSS: 0%CPEs: 1EXPL: 1CVE-2023-30092
https://notcve.org/view.php?id=CVE-2023-30092
SourceCodester Online Pizza Ordering System v1.0 is vulnerable to SQL Injection via the QTY parameter. • https://github.com/nawed20002/CVE-2023-30092 https://www.sourcecodester.com/php/16166/online-pizza-ordering-system-php-free-source-code.html • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') •
CVSS: 9.8EPSS: 1%CPEs: 1EXPL: 2CVE-2023-2246 – SourceCodester Online Pizza Ordering System unrestricted upload
https://notcve.org/view.php?id=CVE-2023-2246
A vulnerability has been found in SourceCodester Online Pizza Ordering System 1.0 and classified as critical. This vulnerability affects unknown code of the file admin/ajax.php?action=save_settings. The manipulation of the argument img leads to unrestricted upload. The attack can be initiated remotely. • https://www.exploit-db.com/exploits/51431 https://docs.google.com/document/d/1Bzt1UOXHJYyNFvTUsMO4zfbiDd_cKxuEygjAww2GcZQ/edit https://vuldb.com/?ctiid.227236 https://vuldb.com/?id.227236 • CWE-434: Unrestricted Upload of File with Dangerous Type •
CVSS: 9.8EPSS: 0%CPEs: 1EXPL: 0CVE-2023-1460 – SourceCodester Online Pizza Ordering System Password Change improper authentication
https://notcve.org/view.php?id=CVE-2023-1460
A vulnerability was found in SourceCodester Online Pizza Ordering System 1.0. It has been classified as critical. This affects an unknown part of the file admin/ajax.php?action=save_user of the component Password Change Handler. The manipulation leads to improper authentication. • https://vuldb.com/?ctiid.223305 https://vuldb.com/?id.223305 • CWE-287: Improper Authentication •
CVSS: 8.1EPSS: 0%CPEs: 1EXPL: 0CVE-2023-1455 – SourceCodester Online Pizza Ordering System Login Page sql injection
https://notcve.org/view.php?id=CVE-2023-1455
A vulnerability classified as critical was found in SourceCodester Online Pizza Ordering System 1.0. This vulnerability affects unknown code of the file admin/ajax.php?action=login2 of the component Login Page. The manipulation of the argument email with the input abc%40qq.com' AND (SELECT 9110 FROM (SELECT(SLEEP(5)))XSlc) AND 'jFNl'='jFNl leads to sql injection. The attack can be initiated remotely. • https://vuldb.com/?ctiid.223300 https://vuldb.com/?id.223300 • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') •