Daily Expense Manager
Monthly
Unauthenticated remote access to an exposed SQL database backup file in code-projects Daily Expense Manager 1.0 allows any network attacker to retrieve sensitive application data. The file `/Daily-Expense-Manager/exp_ak.sql` - a raw database dump - is served directly from the web root without access control, disclosing potentially credentials, user records, and expense data. No public exploitation via CISA KEV, but a public exploit writeup is available on GitHub confirming the exposure path.
Reflected Cross-Site Scripting (XSS) vulnerability in Daily Expense Manager v1.0. This vulnerability allows an attacker to execute JavaScript code by sending a POST request through the password and confirm_password parameters in /register.php.
Reflected Cross-Site Scripting (XSS) vulnerability in Daily Expense Manager v1.0. This vulnerability allows an attacker to execute JavaScript code by sending a POST request through the username parameter in /login.php.
A security vulnerability in Daily Expense Manager (CVSS 7.5). High severity vulnerability requiring prompt remediation.
SQL injection vulnerability in Daily Expense Manager v1.0. This vulnerability allows an attacker to retrieve, create, update and delete databases through the pname, pprice and id parameters in /update.php.
Unauthenticated remote access to an exposed SQL database backup file in code-projects Daily Expense Manager 1.0 allows any network attacker to retrieve sensitive application data. The file `/Daily-Expense-Manager/exp_ak.sql` - a raw database dump - is served directly from the web root without access control, disclosing potentially credentials, user records, and expense data. No public exploitation via CISA KEV, but a public exploit writeup is available on GitHub confirming the exposure path.
Reflected Cross-Site Scripting (XSS) vulnerability in Daily Expense Manager v1.0. This vulnerability allows an attacker to execute JavaScript code by sending a POST request through the password and confirm_password parameters in /register.php.
Reflected Cross-Site Scripting (XSS) vulnerability in Daily Expense Manager v1.0. This vulnerability allows an attacker to execute JavaScript code by sending a POST request through the username parameter in /login.php.
A security vulnerability in Daily Expense Manager (CVSS 7.5). High severity vulnerability requiring prompt remediation.
SQL injection vulnerability in Daily Expense Manager v1.0. This vulnerability allows an attacker to retrieve, create, update and delete databases through the pname, pprice and id parameters in /update.php.