Currency Exchange System
Monthly
Unsanitized ID parameter in /editotheraccount.php of code-projects Currency Exchange System 1.0 leads to SQL injection, allowing remote unauthenticated attackers to read, modify, or disrupt database contents with low confidentiality, integrity, and availability impact. Public exploit code is available; no active exploitation reported in CISA KEV. EPSS indicates a 0.04% probability of exploitation.
SQL injection in the Currency Exchange System 1.0 application allows unauthenticated remote attackers to manipulate SQL queries via the ID parameter in /edttrns.php. This can lead to unauthorized access to database contents or modification of exchange records. A publicly available proof-of-concept exploit exists, though no active exploitation has been confirmed.
SQL injection in code-projects Currency Exchange System 1.0 allows remote unauthenticated attackers to manipulate database queries by supplying a crafted `ID` parameter to `/viewserial.php`, potentially reading, modifying, or deleting backend database content. The affected product is a hobbyist PHP demo application distributed via code-projects.org; a proof-of-concept exploit has been publicly disclosed on GitHub. No patch has been released and the application appears to be a static demo artifact rather than an actively maintained codebase, making remediation unlikely outside of decommissioning.
SQL injection in Currency Exchange System 1.0 via the ID parameter in /edit.php allows remote attackers to manipulate database queries without authentication. Public exploit code exists, but EPSS probability is very low (0.04%) and no active exploitation is confirmed, indicating limited real-world targeting.
Unsanitized ID parameter in /editotheraccount.php of code-projects Currency Exchange System 1.0 leads to SQL injection, allowing remote unauthenticated attackers to read, modify, or disrupt database contents with low confidentiality, integrity, and availability impact. Public exploit code is available; no active exploitation reported in CISA KEV. EPSS indicates a 0.04% probability of exploitation.
SQL injection in the Currency Exchange System 1.0 application allows unauthenticated remote attackers to manipulate SQL queries via the ID parameter in /edttrns.php. This can lead to unauthorized access to database contents or modification of exchange records. A publicly available proof-of-concept exploit exists, though no active exploitation has been confirmed.
SQL injection in code-projects Currency Exchange System 1.0 allows remote unauthenticated attackers to manipulate database queries by supplying a crafted `ID` parameter to `/viewserial.php`, potentially reading, modifying, or deleting backend database content. The affected product is a hobbyist PHP demo application distributed via code-projects.org; a proof-of-concept exploit has been publicly disclosed on GitHub. No patch has been released and the application appears to be a static demo artifact rather than an actively maintained codebase, making remediation unlikely outside of decommissioning.
SQL injection in Currency Exchange System 1.0 via the ID parameter in /edit.php allows remote attackers to manipulate database queries without authentication. Public exploit code exists, but EPSS probability is very low (0.04%) and no active exploitation is confirmed, indicating limited real-world targeting.