autoexpress vulnerabilities

2 known vulnerabilities in autoexpress from Tramyardg. 2 are rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.

Latest first

• 9.8 Critical severity

  autoexpress: Improper Privilege Management

  CVE-2023-48902Mar 21, 2024TramyardgEPSS 1.28%

  An issue was discovered in tramyardg autoexpress version 1.3.0, allows unauthenticated remote attackers to escalate privileges, update car data, delete vehicles, and upload car images via authentication bypass in uploadCarImages.php.

• 9.8 Critical severity

  autoexpress: Improper Neutralization of Special Elements used in an SQL Command

  CVE-2023-48901Mar 21, 2024TramyardgEPSS 1.03%

  A SQL injection vulnerability in tramyardg Autoexpress version 1.3.0, allows remote unauthenticated attackers to execute arbitrary SQL commands via the parameter "id" within the getPhotosByCarId function call in details.php.