Clivedelacruz
Monthly
SQL injection in itsourcecode Employee Management System 1.0 allows authenticated remote attackers to execute arbitrary SQL queries via the Username parameter in /admin/index.php, resulting in limited confidentiality and integrity impact. Despite a critical classification in the initial report, the CVSS 4.0 vector assigns a severity of 2.1 with low scope impact and requires authenticated access (PR:L), significantly reducing real-world risk. Public exploit code is available, but the extremely low EPSS score (0.06%, 19th percentile) suggests minimal practical exploitation despite disclosure.
SQL injection in itsourcecode Employee Management System 1.0 allows authenticated admins to manipulate database queries via the currentpassword parameter in /admin/changepassword.php. Despite classification as critical, the high privilege requirement (PR:H) and low EPSS score (0.06%) indicate limited real-world risk, though public exploit code exists.
SQL injection in itsourcecode Employee Management System 1.0 allows authenticated attackers with low privileges to inject SQL via the AdminName parameter in /admin/adminprofile.php. Public proof-of-concept exploit exists, but EPSS indicates low real-world exploitation probability (0.06%).
SQL injection in itsourcecode Employee Management System up to 1.0 allows authenticated administrators to execute arbitrary SQL queries via the coursepg parameter in /admin/editempeducation.php. A public proof-of-concept exploit exists, but CVSS v4.0 base score is 2.1 (low impact) and EPSS is 0.06%, indicating limited real-world risk. No evidence of active exploitation (not in CISA KEV) and no vendor patch is available.
SQL injection in itsourcecode Employee Management System 1.0 allows remote attackers to manipulate SQL queries via the FirstName parameter in /admin/editempprofile.php. Exploit code is publicly available, though no active exploitation has been confirmed (EPSS 0.06%). The vulnerability requires admin authentication and can lead to unauthorized data access or modification.
SQL injection in itsourcecode Employee Record Management System 1.0 allows remote authenticated attackers to manipulate the emp1name parameter in /editprofile.php, potentially leading to data breach or modification. A public exploit exists, but no active exploitation has been confirmed (EPSS 0.06%).
SQL injection in itsourcecode Employee Management System 1.0 allows authenticated remote attackers to execute arbitrary SQL queries via the Username parameter in /admin/index.php, resulting in limited confidentiality and integrity impact. Despite a critical classification in the initial report, the CVSS 4.0 vector assigns a severity of 2.1 with low scope impact and requires authenticated access (PR:L), significantly reducing real-world risk. Public exploit code is available, but the extremely low EPSS score (0.06%, 19th percentile) suggests minimal practical exploitation despite disclosure.
SQL injection in itsourcecode Employee Management System 1.0 allows authenticated admins to manipulate database queries via the currentpassword parameter in /admin/changepassword.php. Despite classification as critical, the high privilege requirement (PR:H) and low EPSS score (0.06%) indicate limited real-world risk, though public exploit code exists.
SQL injection in itsourcecode Employee Management System 1.0 allows authenticated attackers with low privileges to inject SQL via the AdminName parameter in /admin/adminprofile.php. Public proof-of-concept exploit exists, but EPSS indicates low real-world exploitation probability (0.06%).
SQL injection in itsourcecode Employee Management System up to 1.0 allows authenticated administrators to execute arbitrary SQL queries via the coursepg parameter in /admin/editempeducation.php. A public proof-of-concept exploit exists, but CVSS v4.0 base score is 2.1 (low impact) and EPSS is 0.06%, indicating limited real-world risk. No evidence of active exploitation (not in CISA KEV) and no vendor patch is available.
SQL injection in itsourcecode Employee Management System 1.0 allows remote attackers to manipulate SQL queries via the FirstName parameter in /admin/editempprofile.php. Exploit code is publicly available, though no active exploitation has been confirmed (EPSS 0.06%). The vulnerability requires admin authentication and can lead to unauthorized data access or modification.
SQL injection in itsourcecode Employee Record Management System 1.0 allows remote authenticated attackers to manipulate the emp1name parameter in /editprofile.php, potentially leading to data breach or modification. A public exploit exists, but no active exploitation has been confirmed (EPSS 0.06%).