CVSS: 9.8EPSS: 0%CPEs: 1EXPL: 2CVE-2023-38965 – Lost And Found Information System 1.0 Insecure Direct Object Reference
https://notcve.org/view.php?id=CVE-2023-38965
Lost and Found Information System 1.0 allows account takeover via username and password to a /classes/Users.php?f=save URI. Lost and Found Information System 1.0 permite la toma de control de cuentas mediante nombre de usuario y contraseña en un /classes/Users.php?f=save URI. Lost and Found Information System version 1.0 suffers from an insecure direct object reference vulnerability that allows for account takeover. • http://packetstormsecurity.com/files/175077/Lost-And-Found-Information-System-1.0-Insecure-Direct-Object-Reference.html https://github.com/Or4ngm4n/vulnreability-code-review-php/blob/main/Lost%20and%20Found%20Information%20System%20v1.0.txt • CWE-639: Authorization Bypass Through User-Controlled Key •
CVSS: 9.8EPSS: 0%CPEs: 1EXPL: 0CVE-2023-5018 – SourceCodester Lost and Found Information System POST Parameter sql injection
https://notcve.org/view.php?id=CVE-2023-5018
A vulnerability classified as critical has been found in SourceCodester Lost and Found Information System 1.0. This affects an unknown part of the file /classes/Master.php?f=save_category of the component POST Parameter Handler. The manipulation of the argument id leads to sql injection. It is possible to initiate the attack remotely. • https://vuldb.com/?ctiid.239859 https://vuldb.com/?id.239859 • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') •
CVSS: 6.1EPSS: 0%CPEs: 1EXPL: 1CVE-2023-36159
https://notcve.org/view.php?id=CVE-2023-36159
Cross Site Scripting (XSS) vulnerability in sourcecodester Lost and Found Information System 1.0 allows remote attackers to run arbitrary code via the First Name, Middle Name and Last Name fields on the Create User page. • https://github.com/unknown00759/CVE-2023-36159 http://lost.com https://cyberredteam.tech/posts/cve-2023-36159 https://www.sourcecodester.com/php/16525/lost-and-found-information-system-using-php-and-mysql-db-source-code-free-download.html • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 9.8EPSS: 0%CPEs: 1EXPL: 0CVE-2023-3850 – SourceCodester Lost and Found Information System HTTP POST Request sql injection
https://notcve.org/view.php?id=CVE-2023-3850
A vulnerability has been found in SourceCodester Lost and Found Information System 1.0 and classified as critical. Affected by this vulnerability is an unknown functionality of the file /classes/Master.php?f=delete_category of the component HTTP POST Request Handler. The manipulation of the argument id leads to sql injection. The attack can be launched remotely. • https://vuldb.com/?ctiid.235201 https://vuldb.com/?id.235201 • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') •
CVSS: 9.8EPSS: 0%CPEs: 1EXPL: 0CVE-2023-3680 – SourceCodester Lost and Found Information System HTTP POST Request sql injection
https://notcve.org/view.php?id=CVE-2023-3680
A vulnerability classified as critical has been found in SourceCodester Lost and Found Information System 1.0. This affects an unknown part of the file /classes/Master.php?f=save_item of the component HTTP POST Request Handler. The manipulation of the argument id leads to sql injection. It is possible to initiate the attack remotely. • https://vuldb.com/?ctiid.234225 https://vuldb.com/?id.234225 • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') •