Oretnom23 vulnerabilities
We track 99 vulnerabilities in Oretnom23 products across 31 products. 99 are rated high or critical, and none are known to be exploited. The most recent was published on October 27, 2026.
Latest Oretnom23 vulnerabilities
- 7.3 High severity
php-travel-agency-system: Improper Neutralization of Special Elements in Output Used by a Downstream Component
A weakness has been identified in oretnom23 php-travel-agency-system. The affected element is an unknown function of the file contact_insert.php of the component Contact Form Handler. This manipulation of the argument name/company/email/topic/phone/comments ca
- 7.3 High severity
php-travel-agency-system: Improper Neutralization of Special Elements in Output Used by a Downstream Component
A security flaw has been discovered in oretnom23 php-travel-agency-system 4e28b8f84d72420373dd15c3ae32900beb7e0635. Impacted is an unknown function of the file traceapplication.php. The manipulation of the argument Search results in sql injection. It is possib
- 7.3 High severity
php-travel-agency-system: Improper Neutralization of Special Elements in Output Used by a Downstream Component
A vulnerability was identified in oretnom23 php-travel-agency-system. This issue affects some unknown processing of the file admin/customer_detail.php of the component Admin Record Pages. The manipulation of the argument costomer_id/ticket_id/emp_id/salary_id/
- 7.3 High severity
php-travel-agency-system: Improper Neutralization of Special Elements in Output Used by a Downstream Component
A vulnerability was determined in oretnom23 php-travel-agency-system. This vulnerability affects unknown code of the file admin/customer_search.php of the component Admin Search Pages. Executing a manipulation of the argument customer_name/voucher_no/emp_name
- 7.3 High severity
php-travel-agency-system: Improper Access Control
A vulnerability was found in oretnom23 php-travel-agency-system. This affects an unknown part of the file admin/employee_insert.php. Performing a manipulation of the argument employee photo results in unrestricted upload. The attack is possible to be carried o
- 7.3 High severity
php-travel-agency-system: Improper Neutralization of Special Elements in Output Used by a Downstream Component
A vulnerability was found in oretnom23 php-travel-agency-system. This vulnerability affects unknown code of the file admin/insert.php of the component Insertion Handler. The manipulation of the argument costomer_id/payment_type/amount/description/user/uploadim
- 7.3 High severity
php-travel-agency-system: Improper Neutralization of Special Elements in Output Used by a Downstream Component
A weakness has been identified in oretnom23 php-travel-agency-system. This issue affects some unknown processing of the file admin/update.php. This manipulation of the argument action/full_name/visa_no/hiden/title/description/page_id/user causes sql injection.
- 7.3 High severity
php-travel-agency-system: Improper Neutralization of Special Elements in Output Used by a Downstream Component
A vulnerability was identified in oretnom23 php-travel-agency-system. This affects an unknown part of the file admin/delete.php. The manipulation of the argument costomer_id/ticket_id/payment_id/id/document_id/salary_id/emp_id/user_id leads to sql injection. T
- 7.3 High severity
php-travel-agency-system: Improper Authentication
A vulnerability was determined in oretnom23 php-travel-agency-system. Affected by this issue is some unknown functionality of the file admin/session.php of the component Session Handler. Executing a manipulation of the argument user_id can lead to missing auth
- 7.3 High severity
file-management-system-php: Improper Access Control
A flaw has been found in oretnom23 file-management-system-php up to 2e3c1ebe60f121e8df4fb3f544f0e9591d9a01e4. This affects the function save_files of the file admin_class.php. Executing a manipulation of the argument Upload can lead to unrestricted upload. It
- 7.3 High severity
file-management-system-php: Improper Neutralization of Special Elements in Output Used by a Downstream Component
A vulnerability was detected in oretnom23 file-management-system-php up to 2e3c1ebe60f121e8df4fb3f544f0e9591d9a01e4. Affected by this issue is some unknown functionality of the file files.php of the component File Management. Performing a manipulation of the a
- 7.3 High severity
file-management-system-php: Improper Neutralization of Special Elements in Output Used by a Downstream Component
A security vulnerability has been detected in oretnom23 file-management-system-php up to 2e3c1ebe60f121e8df4fb3f544f0e9591d9a01e4. Affected by this vulnerability is the function readfile of the file download.php of the component File Download. Such manipulatio
- 7.3 High severity
file-management-system-php: Improper Neutralization of Special Elements in Output Used by a Downstream Component
A weakness has been identified in oretnom23 file-management-system-php up to 2e3c1ebe60f121e8df4fb3f544f0e9591d9a01e4. Affected is the function save_folder/delete_folder/delete_file/file_rename/save_files of the file admin_class.php of the component Folder Man
- 7.3 High severity
file-management-system-php: Improper Neutralization of Special Elements in Output Used by a Downstream Component
A security flaw has been discovered in oretnom23 file-management-system-php up to 2e3c1ebe60f121e8df4fb3f544f0e9591d9a01e4. This impacts the function save_user of the file admin_class.php of the component User Account Management. The manipulation of the argume
- 7.3 High severity
file-management-system-php: Improper Neutralization of Special Elements in Output Used by a Downstream Component
A vulnerability was identified in oretnom23 file-management-system-php up to 2e3c1ebe60f121e8df4fb3f544f0e9591d9a01e4. This affects the function Login of the file admin_class.php. The manipulation of the argument username/password leads to sql injection. Remot
- 8.8 High severity
Online Food Ordering System: Improper Neutralization of Special Elements used in an SQL Command
A SQL Injection vulnerability exists in SourceCodester Online Food Ordering System v1.0 in the Actions.php file (specifically the save_category action). The application fails to properly sanitize user input supplied to the "name" parameter. This allows an auth
- 9.8 Critical severity
Online Food Ordering System: Improper Neutralization of Special Elements used in an SQL Command
A SQL Injection vulnerability exists in SourceCodester Online Food Ordering System v1.0 in the Actions.php file (specifically the save_customer action). The application fails to properly sanitize user input supplied to the "username" parameter. This allows an
- 8.8 High severity
Online Food Ordering System: Improper Neutralization of Special Elements used in an SQL Command
A SQL Injection vulnerability exists in SourceCodester Online Food Ordering System v1.0 in the Actions.php file (specifically the save_user action). The application fails to properly sanitize user input supplied to the "username" parameter. This allows an auth
- 9.4 Critical severity
Customer Support System: Missing Authentication for Critical Functionality
SourceCodester Customer Support System 1.0 contains an incorrect access control vulnerability in ajax.php. The AJAX dispatcher does not enforce authentication or authorization before invoking administrative methods in admin_class.php based on the action parame
- 7.5 High severity
Simple Online Book Store System: Exposure of Sensitive Information to an Unauthorized Actor
Information Disclosure in web-accessible backup file in SourceCodester Simple Online Book Store System allows a remote unauthenticated attacker to disclose full database contents (including schema and credential hashes) via an unauthenticated HTTP GET request
- 8.8 High severity
Stock Management System: Improper Neutralization of Special Elements used in an SQL Command
A vulnerability, which was classified as critical, has been found in SourceCodester/oretnom23 Stock Management System 1.0. Affected by this issue is some unknown functionality of the file /admin/?page=back_order/view_bo. The manipulation of the argument ID lea
- 8.8 High severity
Stock Management System: Improper Neutralization of Special Elements used in an SQL Command
A vulnerability classified as critical has been found in SourceCodester/oretnom23 Stock Management System 1.0. Affected is an unknown function of the file /admin/?page=sales/view_sale. The manipulation of the argument ID leads to sql injection. It is possible
- 8.8 High severity
Stock Management System: Improper Neutralization of Special Elements used in an SQL Command
A vulnerability was found in SourceCodester/oretnom23 Stock Management System 1.0. It has been rated as critical. This issue affects some unknown processing of the file /admin/?page=return/view_return. The manipulation of the argument ID leads to sql injection
- 8.8 High severity
Stock Management System: Improper Neutralization of Special Elements used in an SQL Command
A vulnerability has been found in SourceCodester/oretnom23 Stock Management System 1.0 and classified as critical. This vulnerability affects unknown code of the file /sms/admin/?page=receiving/view_receiving&id=1. The manipulation of the argument ID leads to
- 9.8 Critical severity
Stock Management System: Improper Neutralization of Special Elements used in an SQL Command
A vulnerability was found in SourceCodester/oretnom23 Stock Management System 1.0 and classified as critical. This issue affects some unknown processing of the file /classes/Login.php?f=login. The manipulation of the argument Username leads to sql injection. T
- 8.8 High severity
Stock Management System: Cross-Site Request Forgery
A vulnerability has been found in SourceCodester/oretnom23 Stock Management System 1.0 and classified as problematic. This vulnerability affects unknown code of the file /classes/Users.php?f=save. The manipulation leads to cross-site request forgery. The attac
- 7.2 High severity
Stock Management System: Improper Neutralization of Special Elements used in an SQL Command
A vulnerability, which was classified as critical, was found in SourceCodester/oretnom23 Stock Management System 1.0. This affects an unknown part of the file /admin/?page=purchase_order/view_po of the component Purchase Order Details Page. The manipulation of
- 8.8 High severity
Computer Laboratory Management System: Improper Neutralization of Special Elements used in an SQL Command
A SQL injection vulnerability in manage_damage.php in Sourcecodester Computer Laboratory Management System v1.0 allows an authenticated attacker to execute arbitrary SQL commands via the "id" parameter
- 9.8 Critical severity
Student Study Center Desk Management System: Improper Authentication
An issue in Student Study Center Desk Management System v1.0 allows attackers to bypass authentication via a crafted GET request to /php-sscdms/admin/login.php.
- 9.8 Critical severity
Online Id Generator System: Improper Neutralization of Special Elements used in an SQL Command
Sourcecodester Online ID Generator System 1.0 was discovered to contain a SQL injection vulnerability via the template parameter at id_generator/admin/?page=generate&template=4.
- 9.8 Critical severity
Online Id Generator System: Improper Neutralization of Special Elements used in an SQL Command
Sourcecodester Online ID Generator System 1.0 was discovered to contain a SQL injection vulnerability via the id parameter at id_generator/admin/?page=generate/index&id=1.
- 9.8 Critical severity
Online Id Generator System: Unrestricted Upload of File with Dangerous Type
Sourcecodester Online ID Generator System 1.0 was discovered to contain an arbitrary file upload vulnerability via id_generator/classes/SystemSettings.php?f=update_settings. This vulnerability allows attackers to execute arbitrary code via a crafted PHP file.
- 9.8 Critical severity
Apartment Visitor Management System: Improper Neutralization of Special Elements used in an SQL Command
A vulnerability, which was classified as critical, was found in oretnom23/SourceCodester Apartment Visitor Management System 1.0. Affected is an unknown function of the file /remove-apartment.php. The manipulation of the argument ID leads to sql injection. It
- 9.8 Critical severity
Clinics Patient Management System: Improper Neutralization of Special Elements used in an SQL Command
A vulnerability was found in SourceCodesters Clinics Patient Management System 2.0. It has been rated as critical. This issue affects some unknown processing of the file /print_diseases.php. The manipulation of the argument disease/from/to leads to sql injecti
- 8.8 High severity
Clinics Patient Management System: Improper Neutralization of Special Elements used in an SQL Command
A vulnerability has been found in SourceCodester Clinics Patient Management System 1.0 and classified as critical. This vulnerability affects unknown code of the file /pms/ajax/get_packings.php. The manipulation of the argument medicine_id leads to sql injecti
- 7.5 High severity
Clinics Patient Management System: Improper Neutralization of Special Elements used in an SQL Command
A vulnerability classified as critical was found in SourceCodester Clinics Patient Management System 1.0. This vulnerability affects unknown code of the file /pms/ajax/check_user_name.php. The manipulation of the argument user_name leads to sql injection. The
- 7.5 High severity
Clinics Patient Management System: Improper Neutralization of Special Elements used in an SQL Command
A vulnerability was found in SourceCodester Clinics Patient Management System 1.0. It has been rated as critical. This issue affects some unknown processing of the file /ajax/check_medicine_name.php. The manipulation of the argument user_name leads to sql inje
- 7.5 High severity
Clinics Patient Management System: Direct Request
A vulnerability was found in SourceCodester Clinics Patient Management System 1.0. It has been declared as problematic. This vulnerability affects unknown code of the file /user_images/. The manipulation leads to direct request. The attack can be initiated rem
- 7.5 High severity
Clinics Patient Management System: Improper Neutralization of Special Elements used in an SQL Command
A vulnerability was found in SourceCodester Clinics Patient Management System 1.0 and classified as critical. Affected by this issue is some unknown functionality of the file /update_medicine.php. The manipulation of the argument hidden_id leads to sql injecti
- 7.5 High severity
Clinics Patient Management System: Improper Neutralization of Special Elements used in an SQL Command
A vulnerability has been found in SourceCodester Clinics Patient Management System 1.0 and classified as critical. Affected by this vulnerability is an unknown functionality of the file /medicines.php. The manipulation of the argument medicine_name leads to sq