Oretnom23 vulnerabilities
We track 99 vulnerabilities in Oretnom23 products across 31 products. 99 are rated high or critical, and none are known to be exploited. The most recent was published on October 27, 2026.
Latest Oretnom23 vulnerabilities
- 8.8 High severity
Simple Customer Relationship Management System: Improper Neutralization of Special Elements used in an SQL Command
Simple Customer Relationship Management System v1.0 was discovered to contain a SQL injection vulnerability via the subject parameter under the Create Ticket function.
- 8.8 High severity
Simple Customer Relationship Management System: Improper Neutralization of Special Elements used in an SQL Command
Simple Customer Relationship Management System v1.0 was discovered to contain a SQL injection vulnerability via the name parameter under the Request a Quote function.
- 8.8 High severity
Simple Customer Relationship Management System: Improper Neutralization of Special Elements used in an SQL Command
Simple Customer Relationship Management System v1.0 was discovered to contain a SQL injection vulnerability via the oldpass parameter under the Change Password function.
- 8.8 High severity
Simple Customer Relationship Management System: Improper Neutralization of Special Elements used in an SQL Command
Simple Customer Relationship Management System v1.0 was discovered to contain a SQL injection vulnerability via the Description parameter under the Create ticket function.
- 8.8 High severity
Simple Customer Relationship Management System: Improper Neutralization of Special Elements used in an SQL Command
Simple Customer Relationship Management System v1.0 was discovered to contain a SQL injection vulnerability via the username parameter under the Admin Panel.
- 8.8 High severity
Clinics Patient Management System: Improper Neutralization of Special Elements used in an SQL Command
A vulnerability was found in SourceCodester Clinics Patient Management System 1.0. It has been classified as critical. Affected is an unknown function of the file update_user.php. The manipulation of the argument user_id leads to sql injection. It is possible
- 9.8 Critical severity
Online Food Ordering System: Unrestricted Upload of File with Dangerous Type
An arbitrary file upload vulnerability in the component /fos/admin/ajax.php of Food Ordering System v2.0 allows attackers to execute arbitrary code via a crafted PHP file.
- 9.8 Critical severity
Human Resource Management System: Improper Neutralization of Special Elements used in an SQL Command
Human Resource Management System v1.0 was discovered to contain a SQL injection vulnerability via the password parameter at /hrm/controller/login.php.
- 7.2 High severity
Food Ordering Management System: Improper Neutralization of Special Elements used in an SQL Command
Food Ordering Management System v1.0 was discovered to contain a SQL injection vulnerability via the component /foms/all-orders.php?status=Cancelled%20by%20Customer.
- 9.8 Critical severity
Clinic's Patient Management System: Unrestricted Upload of File with Dangerous Type
Remote Code Execution in Clinic's Patient Management System v 1.0 allows Attacker to Upload arbitrary php webshell via profile picture upload functionality in users.php
- 9.8 Critical severity
Clinics Patient Management System: Improper Neutralization of Special Elements used in an SQL Command
A vulnerability was found in SourceCodester Clinics Patient Management System 1.0. It has been rated as critical. Affected by this issue is some unknown functionality of the file medicine_details.php. The manipulation of the argument medicine leads to sql inje
- 9.8 Critical severity
Clinics Patient Management System: Improper Neutralization of Special Elements used in an SQL Command
A vulnerability classified as critical was found in SourceCodester Clinics Patient Management System. Affected by this vulnerability is an unknown functionality of the file index.php of the component Login. The manipulation of the argument user_name leads to s
- 8.8 High severity
Fast Food Ordering System: Improper Neutralization of Special Elements used in an SQL Command
A vulnerability was found in oretnom23 Fast Food Ordering System. It has been rated as critical. Affected by this issue is some unknown functionality of the file ffos/admin/reports/index.php. The manipulation of the argument date leads to sql injection. The at
- 9.8 Critical severity
Clinics Patient Management System: Improper Neutralization of Special Elements used in an SQL Command
A vulnerability has been found in SourceCodester Clinics Patient Management System 2.0 and classified as critical. Affected by this vulnerability is an unknown functionality of the file /pms/index.php of the component Login Page. The manipulation of the argume
- 8.8 High severity
Clinics Patient Management System: Unrestricted Upload of File with Dangerous Type
A vulnerability, which was classified as critical, was found in SourceCodester Clinics Patient Management System 2.0. Affected is an unknown function of the file /pms/update_user.php?user_id=1. The manipulation of the argument profile_picture with the input <?
- 7.2 High severity
Online Food Ordering System: Unrestricted Upload of File with Dangerous Type
An arbitrary file upload vulnerability in the Select Image function of Online Food Ordering System v1.0 allows attackers to execute arbitrary code via a crafted PHP file.
- 9.8 Critical severity
Online Food Ordering System: Improper Neutralization of Special Elements used in an SQL Command
Online Food Ordering System v1.0 was discovered to contain a SQL injection vulnerability via the Search parameter at /online-food-order/food-search.php.
- 9.8 Critical severity
Banking System: Unrestricted Upload of File with Dangerous Type
A remote code execution (RCE) vulnerability in Online Banking System Protect v1.0 allows attackers to execute arbitrary code via a crafted PHP file uploaded through the Upload Image function.
- 9.8 Critical severity
Simple Subscription Website: Improper Neutralization of Special Elements used in an SQL Command
Simple Subscription Website v1.0 was discovered to contain a SQL injection vulnerability via the id parameter in the view_plan endpoint. This vulnerability allows attackers to dump the application's database via crafted HTTP requests.