Oretnom23 vulnerabilities
Published CVEs affecting Oretnom23 products: 63 record(s), with severity, exploitation and fixes.
Pharmacy Point Of Sale System 9Online Food Ordering System 7Loan Management System 5Train Station Ticketing System 4Resort Reservation System 4Simple Online Men's Salon Management System 4Simple Responsive Tourism Website 4Online Shop Project 3Simple Logistic Hub Parcel's Management System 2Online Student Result System 2Employee Task Management System 2Online Magazine Management System 2Survey Application System 2Cab Management System 2Computer And Mobile Repair Shop Management System 2Alumni Management System 2Medical Certificate Generator App 1Zoo Management System 1Hospitals Patient Records Management System 1Simple Online Book Store System 1Computer Laboratory Management System 1Customer Support System 1Banking System 1
CVE-2026-9564
Low · 2.4
CWE-79 May 26, 2026
SourceCodester/oretnom23 Hospitals Patient Records Management System view_patient cross site scripting
A vulnerability was found in SourceCodester/oretnom23 Hospitals Patient Records Management System 1.0. The impacted element is an unknown function of the file /admin/?page=patients/view_patient. Performing a manipulation of the argument Remarks results in cross site scripting. Remote exploitation of the attack is possible. The exploit has been made public and could be used.
CVE-2026-36947
Low · 2.7
CWE-89 Apr 13, 2026
SQL Injection in Oretnom23 Computer And Mobile Repair Shop Management System
Sourcecodester Computer and Mobile Repair Shop Management System v1.0 is vulnerable to SQL Injection in the file /rsms/admin/services/view_service.php.
CVE-2026-36946
Low · 2.7
CWE-89 Apr 13, 2026
SQL Injection in Oretnom23 Computer And Mobile Repair Shop Management System
Sourcecodester Computer and Mobile Repair Shop Management System v1.0 is vulnerable to SQL injection in the file /rsms/admin/inquiries/view_details.php.
CVE-2026-36923
Low · 2.7
CWE-89 Apr 13, 2026
SQL Injection in Oretnom23 Cab Management System
Sourcecodester Cab Management System 1.0 is vulnerable to SQL Injection in the file /cms/admin/bookings/view_booking.php.
CVE-2026-36922
Low · 2.7
CWE-89 Apr 13, 2026
SQL Injection in Oretnom23 Cab Management System
Sourcecodester Cab Management System v1.0 is vulnerable to SQL injection in the file /cms/admin/categories/view_category.php.
CVE-2026-30523
Medium · 6.5
CWE-20 Apr 1, 2026
Improper Input Validation in Oretnom23 Loan Management System
A Business Logic vulnerability exists in SourceCodester Loan Management System v1.0 due to the lack of proper input validation. The application allows administrators to define "Loan Plans" which determine the duration of a loan (in months). However, the backend fails to validate that the duration must be a positive integer. An attacker can submit a negative value for the months parameter. The system accepts this invalid data and creates a loan plan with a negative duration.
CVE-2026-30522
Medium · 6.5
CWE-602 Apr 1, 2026
A Business Logic vulnerability exists in SourceCodester Loan Management System v1.0 due…
A Business Logic vulnerability exists in SourceCodester Loan Management System v1.0 due to improper server-side validation. The application allows administrators to create "Loan Plans" with specific penalty rates for overdue payments. While the frontend interface prevents users from entering negative numbers in the "Monthly Overdue Penalty" field, this constraint is not enforced on the backend. An authenticated attacker can bypass the client-side restriction by manipulating the HTTP POST request to submit a negative value for the penalty_rate.
CVE-2026-30521
Medium · 6.5
CWE-602 Mar 31, 2026
A Business Logic vulnerability exists in SourceCodester Loan Management System v1.0 due…
A Business Logic vulnerability exists in SourceCodester Loan Management System v1.0 due to improper server-side validation. The application allows administrators to create "Loan Plans" with specific interest rates. While the frontend interface prevents users from entering negative numbers, this constraint is not enforced on the backend. An authenticated attacker can bypass the client-side restriction by manipulating the HTTP POST request to submit a negative value for the interest_percentage. This results in the creation of loan plans with negative interest rates.
CVE-2026-30520
Medium · 5.4
CWE-89 Mar 31, 2026
SQL Injection in Oretnom23 Loan Management System
A Blind SQL Injection vulnerability exists in SourceCodester Loan Management System v1.0. The vulnerability is located in the ajax.php file (specifically the save_loan action). The application fails to properly sanitize user input supplied to the "borrower_id" parameter in a POST request, allowing an authenticated attacker to inject malicious SQL commands.
CVE-2026-30534
High · 8.3
CWE-89 Mar 27, 2026
SQL Injection in Oretnom23 Online Food Ordering System
A SQL Injection vulnerability exists in SourceCodester Online Food Ordering System v1.0 in admin/manage_category.php via the "id" parameter.
CVE-2026-30533
Critical · 9.8
CWE-89 Mar 27, 2026
SQL Injection in Oretnom23 Online Food Ordering System
A SQL Injection vulnerability exists in SourceCodester Online Food Ordering System v1.0 in the admin/manage_product.php file via the "id" parameter.
CVE-2026-30532
Critical · 9.8
CWE-89 Mar 27, 2026
SQL Injection in Oretnom23 Online Food Ordering System
A SQL Injection vulnerability exists in SourceCodester Online Food Ordering System v1.0 in the admin/view_product.php file via the "id" parameter.
CVE-2026-30531
High · 8.8
CWE-89 Mar 27, 2026
SQL Injection in Oretnom23 Online Food Ordering System
A SQL Injection vulnerability exists in SourceCodester Online Food Ordering System v1.0 in the Actions.php file (specifically the save_category action). The application fails to properly sanitize user input supplied to the "name" parameter. This allows an authenticated attacker to inject malicious SQL commands.
CVE-2026-30530
Critical · 9.8
CWE-89 Mar 27, 2026
SQL Injection in Oretnom23 Online Food Ordering System
A SQL Injection vulnerability exists in SourceCodester Online Food Ordering System v1.0 in the Actions.php file (specifically the save_customer action). The application fails to properly sanitize user input supplied to the "username" parameter. This allows an attacker to inject malicious SQL commands.
CVE-2026-30529
High · 8.8
CWE-89 Mar 27, 2026
SQL Injection in Oretnom23 Online Food Ordering System
A SQL Injection vulnerability exists in SourceCodester Online Food Ordering System v1.0 in the Actions.php file (specifically the save_user action). The application fails to properly sanitize user input supplied to the "username" parameter. This allows an authenticated attacker to inject malicious SQL commands.
CVE-2026-30527
Medium · 5.4
CWE-79 Mar 27, 2026
Cross-site Scripting (XSS) in Oretnom23 Online Food Ordering System
A Stored Cross-Site Scripting (XSS) vulnerability exists in SourceCodester Online Food Ordering System v1.0 in the Category management module within the admin panel. The application fails to properly sanitize user input supplied to the "Category Name" field when creating or updating a category. When an administrator or user visits the Category list page (or any page where this category is rendered), the injected JavaScript executes immediately in their browser.
CVE-2026-3819
Medium · 5.4
CWE-79 Mar 9, 2026
SourceCodester Resort Reservation System Reservation Management page cross site scripting
A vulnerability has been found in SourceCodester Resort Reservation System 1.0. The affected element is an unknown function of the file /?page=manage_reservation of the component Reservation Management Module. Such manipulation of the argument ID leads to cross site scripting. The attack may be launched remotely. The exploit has been disclosed to the public and may be used.
CVE-2026-3806
High · 8.8
CWE-89 Mar 9, 2026
SourceCodester/janobe Resort Reservation System room_rates.php sql injection
A weakness has been identified in SourceCodester/janobe Resort Reservation System 1.0. This issue affects some unknown processing of the file /room_rates.php. This manipulation of the argument q causes sql injection. The attack can be initiated remotely. The exploit has been made available to the public and could be used for attacks.
CVE-2026-3800
High · 8.8
CWE-434 Mar 9, 2026
SourceCodester/janobe Resort Reservation System controller.php doInsert unrestricted upload
A vulnerability has been found in SourceCodester/janobe Resort Reservation System 1.0. Affected is the function doInsert of the file /controller.php?action=add. Such manipulation of the argument image leads to unrestricted upload. The attack can be executed remotely. The exploit has been disclosed to the public and may be used.
CVE-2026-3771
High · 8.8
CWE-89 Mar 8, 2026
SourceCodester/janobe Resort Reservation System accomodation.php sql injection
A vulnerability has been found in SourceCodester/janobe Resort Reservation System 1.0. This vulnerability affects unknown code of the file /accomodation.php. Such manipulation of the argument q leads to sql injection. The attack may be performed from remote. The exploit has been disclosed to the public and may be used.
CVE-2026-3770
High · 8.8
CWE-352 Mar 8, 2026
SourceCodester Computer Laboratory Management System cross-site request forgery
A flaw has been found in SourceCodester Computer Laboratory Management System 1.0. This affects an unknown part. This manipulation causes cross-site request forgery. The attack is possible to be carried out remotely. The exploit has been published and may be used.
CVE-2026-3752
High · 7.2
CWE-74 Mar 8, 2026
SourceCodester Employee Task Management System GET Parameter daily-task-report.php sql injection
A flaw has been found in SourceCodester Employee Task Management System up to 1.0. The affected element is an unknown function of the file /daily-task-report.php of the component GET Parameter Handler. This manipulation of the argument Date causes sql injection. It is possible to initiate the attack remotely. The exploit has been published and may be used.
CVE-2026-3751
High · 7.2
CWE-74 Mar 8, 2026
SourceCodester Employee Task Management System GET Parameter daily-attendance-report.php sql injection
A vulnerability was detected in SourceCodester Employee Task Management System 1.0. Impacted is an unknown function of the file /daily-attendance-report.php of the component GET Parameter Handler. The manipulation of the argument Date results in sql injection. The attack may be performed from remote. The exploit is now public and may be used.
CVE-2026-3746
Critical · 9.8
CWE-74 Mar 8, 2026
SourceCodester Simple Responsive Tourism Website Login Login.php sql injection
A vulnerability was determined in SourceCodester Simple Responsive Tourism Website 1.0. Affected by this vulnerability is an unknown functionality of the file /tourism/classes/Login.php?f=login of the component Login. This manipulation of the argument Username causes sql injection. The attack may be initiated remotely. The exploit has been publicly disclosed and may be utilized.
CVE-2026-3702
Medium · 6.1
CWE-79 Mar 8, 2026
SourceCodester Loan Management System index.php cross site scripting
A vulnerability was detected in SourceCodester Loan Management System 1.0. Affected by this issue is some unknown functionality of the file /index.php. Performing a manipulation of the argument page results in cross site scripting. The attack is possible to be carried out remotely. The exploit is now public and may be used.