Oretnom23 vulnerabilities
We track 99 vulnerabilities in Oretnom23 products across 31 products. 99 are rated high or critical, and none are known to be exploited. The most recent was published on October 27, 2026.
Latest Oretnom23 vulnerabilities
- 9.8 Critical severity
Clinics Patient Management System: Improper Neutralization of Special Elements used in an SQL Command
A vulnerability, which was classified as critical, has been found in SourceCodester Clinics Patient Management System 1.0. Affected by this issue is some unknown functionality of the file /new_prescription.php. The manipulation of the argument patient leads to
- 9.8 Critical severity
Clinics Patient Management System: Improper Neutralization of Special Elements used in an SQL Command
A vulnerability, which was classified as critical, has been found in SourceCodester Clinics Patient Management System 1.0. Affected by this issue is the function patient_name of the file patients.php. The manipulation leads to sql injection. The attack may be
- 7.5 High severity
Clinics Patient Management System: Improper Neutralization of Special Elements used in an SQL Command
A vulnerability was found in SourceCodester Clinics Patient Management System 1.0. It has been rated as critical. This issue affects some unknown processing of the file /ajax/get_patient_history.php. The manipulation of the argument patient_id leads to sql inj
- 9.8 Critical severity
Simple Online Mens Salon Management System: Improper Neutralization of Special Elements used in an SQL Command
A vulnerability, which was classified as critical, has been found in SourceCodester Simple Online Mens Salon Management System 1.0. Affected by this issue is some unknown functionality of the file view_service.php. The manipulation of the argument id leads to
- 9.4 Critical severity
visitor_management_system: Improper Neutralization of Special Elements used in an SQL Command
SQL injection vulnerability in /php-sqlite-vms/?page=manage_visitor&id=1 in SourceCodester Visitor Management System 1.0 allow attackers to execute arbitrary SQL commands via the id parameters.
- 8.8 High severity
Laundry Management System: Improper Neutralization of Special Elements used in an SQL Command
A vulnerability was found in SourceCodester Laundry Management System 1.0. It has been declared as critical. Affected by this vulnerability is the function laporan_filter of the file /application/controller/Pengeluaran.php. The manipulation of the argument dar
- 9.8 Critical severity
Laundry Management System: Improper Neutralization of Special Elements used in an SQL Command
A vulnerability was found in SourceCodester Laundry Management System 1.0. It has been classified as critical. Affected is the function laporan_filter of the file /application/controller/Transaki.php. The manipulation of the argument dari/sampai leads to sql i
- 9.8 Critical severity
Laundry Management System: Improper Neutralization of Special Elements used in an SQL Command
A vulnerability was found in SourceCodester Laundry Management System 1.0 and classified as critical. This issue affects the function laporan_filter of the file /application/controller/Pelanggan.php. The manipulation of the argument jeniskelamin leads to sql i
- 9.8 Critical severity
Laundry Management System: Improper Neutralization of Special Elements used in an SQL Command
A vulnerability was found in SourceCodester Laundry Management System 1.0. It has been declared as critical. This vulnerability affects unknown code of the file /karyawan/laporan_filter. The manipulation of the argument data_karyawan leads to sql injection. Th
- 9.8 Critical severity
House Rental Management System: External Control of File Name or Path
A vulnerability was found in Campcodes House Rental Management System 1.0. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the file index.php. The manipulation of the argument page leads to file inclusion. The at
- 7.2 High severity
Online Mobile Management Store: Improper Neutralization of Special Elements used in an SQL Command
A vulnerability was found in SourceCodester Online Mobile Management Store 1.0. It has been rated as critical. This issue affects some unknown processing of the file /admin/maintenance/manage_category.php of the component HTTP GET Request Handler. The manipula
- 9.8 Critical severity
Online Mobile Management Store: Improper Neutralization of Special Elements used in an SQL Command
A vulnerability has been found in SourceCodester Online Mobile Management Store 1.0 and classified as critical. This vulnerability affects unknown code of the file view_product.php. The manipulation of the argument id leads to sql injection. The attack can be
- 9.8 Critical severity
Online Mobile Management Store: Improper Neutralization of Special Elements used in an SQL Command
A vulnerability, which was classified as critical, was found in SourceCodester Online Mobile Management Store 1.0. This affects an unknown part of the file /admin/orders/view_order.php. The manipulation of the argument id leads to sql injection. It is possible
- 9.8 Critical severity
Online Mobile Management Store: Improper Neutralization of Special Elements used in an SQL Command
A vulnerability, which was classified as critical, has been found in SourceCodester Online Mobile Management Store 1.0. Affected by this issue is some unknown functionality of the file /admin/product/manage_product.php. The manipulation of the argument id lead
- 8.8 High severity
Online Mobile Management Store: Unrestricted Upload of File with Dangerous Type
A vulnerability classified as critical has been found in SourceCodester Online Mobile Management Store 1.0. This affects an unknown part of the file /classes/Users.php. The manipulation of the argument img leads to unrestricted upload. It is possible to initia
- 9.8 Critical severity
Online Mobile Management Store: Improper Neutralization of Special Elements used in an SQL Command
A vulnerability was found in SourceCodester Online Mobile Management Store 1.0. It has been rated as critical. Affected by this issue is some unknown functionality of the file /admin/login.php. The manipulation of the argument username leads to sql injection.
- 9.8 Critical severity
simple_atudent_attendance_system: Improper Control of Generation of Code
SQL Injection vulnerability in the Simple Student Attendance System v.1.0 allows a remote attacker to execute arbitrary code via a crafted payload to the id parameter in the student_form.php and the class_form.php pages.
- 9.8 Critical severity
Judging Management System: Improper Neutralization of Special Elements used in an SQL Command
SQL Injection vulnerability in oretnom23 Judging Management System v1.0, allows remote attackers to execute arbitrary code and obtain sensitive information via sub_event_id parameter in sub_event_details_edit.php.
- 9.8 Critical severity
Judging Management System: Improper Neutralization of Special Elements used in an SQL Command
SQL Injection vulnerability in oretnom23 Judging Management System v1.0, allows remote attackers to execute arbitrary code and obtain sensitive information via txtsearch parameter in review_search.php.
- 9.8 Critical severity
Judging Management System: Improper Neutralization of Special Elements used in an SQL Command
SQL Injection vulnerability in oretnom23 Judging Management System v1.0, allows remote attackers to execute arbitrary code and obtain sensitive information via sub_event_id parameter in sub_event_stat_update.php.
- 8.8 High severity
Customer Support System: Improper Neutralization of Special Elements used in an SQL Command
Sourcecodester Customer Support System 1.0 has multiple SQL injection vulnerabilities in /customer_support/ajax.php?action=save_ticket via department_id, customer_id, and subject.
- 9.8 Critical severity
Medicine Tracking System: Improper Limitation of a Pathname to a Restricted Directory
A vulnerability was found in SourceCodester Medicine Tracking System 1.0. It has been rated as critical. This issue affects some unknown processing. The manipulation of the argument page leads to path traversal: '../filedir'. The attack may be initiated remote
- 9.8 Critical severity
Medicine Tracking System: Improper Neutralization of Special Elements used in an SQL Command
A vulnerability, which was classified as critical, has been found in SourceCodester Medicine Tracking System 1.0. This issue affects some unknown processing of the file /classes/Master.php? f=save_medicine. The manipulation of the argument id/name/description
- 7.2 High severity
Packers And Movers Management System: Improper Neutralization of Special Elements used in an SQL Command
SQL injection vulnerability in Packers and Movers Management System v.1.0 allows a remote attacker to execute arbitrary code via crafted payload to the /mpms/admin/?page=user/manage_user&id file.
- 7.8 High severity
Expense Management System: Unrestricted Upload of File with Dangerous Type
An issue in Expense Management System v.1.0 allows a local attacker to execute arbitrary code via a crafted file uploaded to the sign-up.php component.
- 9.8 Critical severity
Packers And Movers Management System: Improper Neutralization of Special Elements used in an SQL Command
Sourcecodester Packers and Movers Management System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /inquiries/view_inquiry.php.
- 9.8 Critical severity
Service Provider Management System: Improper Privilege Management
An issue in Service Provider Management System v.1.0 allows a remote attacker to gain privileges via the ID parameter in the /php-spms/admin/?page=user/ endpoint.
- 9.8 Critical severity
Simple Online Mens Salon Management System: Improper Neutralization of Special Elements used in an SQL Command
A vulnerability was found in SourceCodester Simple Online Mens Salon Management System 1.0. It has been classified as critical. Affected is an unknown function of the file /admin/?page=user/manage_user&id=3. The manipulation of the argument id leads to sql inj
- 9.8 Critical severity
Online Computer And Laptop Store: Incorrect Authorization
Sourcecodester Online Computer and Laptop Store 1.0 is vulnerable to Incorrect Access Control, which allows remote attackers to elevate privileges to the administrator's role.
- 9.8 Critical severity
Lost And Found Information System: Improper Neutralization of Special Elements used in an SQL Command
Lost and Found Information System v1.0 was discovered to contain a SQL injection vulnerability via the component /php-lfis/admin/?page=system_info/contact_information.
- 9.8 Critical severity
Online Computer And Laptop Store: Unrestricted Upload of File with Dangerous Type
Sourcecodester Online Computer and Laptop Store 1.0 allows unrestricted file upload and can lead to remote code execution. The vulnerability path is /classes/Users.php?f=save.
- 8.8 High severity
Billing Management System: Improper Neutralization of Special Elements used in an SQL Command
A vulnerability classified as critical was found in SourceCodester Billing Management System 1.0. This vulnerability affects unknown code of the file editproduct.php of the component GET Parameter Handler. The manipulation of the argument id leads to sql injec
- 9.8 Critical severity
Billing Management System: Improper Neutralization of Special Elements used in an SQL Command
A vulnerability has been found in SourceCodester Billing Management System 1.0 and classified as critical. Affected by this vulnerability is an unknown functionality of the file ajax_service.php of the component POST Parameter Handler. The manipulation of the
- 9.8 Critical severity
Online Food Ordering System: Unrestricted Upload of File with Dangerous Type
An arbitrary file upload vulnerability in the component /admin/ajax.php?action=save_menu of Online Food Ordering System v2.0 allows attackers to execute arbitrary code via uploading a crafted PHP file.
- 9.8 Critical severity
Simple Customer Relationship Management System: Improper Neutralization of Special Elements used in an SQL Command
Simple Customer Relationship Management System v1.0 was discovered to contain a SQL injection vulnerability via the name parameter under the Profile Update function.
- 8.8 High severity
Simple Customer Relationship Management System: Improper Neutralization of Special Elements used in an SQL Command
Simple Customer Relationship Management System v1.0 as discovered to contain a SQL injection vulnerability via the gender parameter in the user profile update function.
- 8.8 High severity
Simple Customer Relationship Management System: Improper Neutralization of Special Elements used in an SQL Command
Simple Customer Relationship Management System v1.0 as discovered to contain a SQL injection vulnerability via the query parameter in the user profile update function.
- 8.8 High severity
Simple Customer Relationship Management System: Improper Neutralization of Special Elements used in an SQL Command
Simple Customer Relationship Management System v1.0 as discovered to contain a SQL injection vulnerability via the company parameter in the user profile update function.
- 8.8 High severity
Simple Customer Relationship Management System: Improper Neutralization of Special Elements used in an SQL Command
Simple Customer Relationship Management System v1.0 as discovered to contain a SQL injection vulnerability via the address parameter in the user profile update function.
- 8.8 High severity
Simple Customer Relationship Management System: Improper Neutralization of Special Elements used in an SQL Command
Simple Customer Relationship Management System v1.0 as discovered to contain a SQL injection vulnerability via the contact parameter in the user profile update function.