Online Farm System
Monthly
SQL injection in Online Farm System 1.0 allows remote attackers to manipulate database queries through the Username parameter of the /addProduct.php endpoint. Exploit code is publicly available, although the immediate impact is limited to low confidentiality, integrity, and availability effects according to the CVSS assessment. At the time of analysis no active exploitation has been confirmed by CISA KEV, and EPSS indicates a low probability of widespread exploitation.
A vulnerability was found in code-projects Online Farm System 1.0. Rated medium severity (CVSS 6.9), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
SQL injection in Online Farm System 1.0 (/categoryvalue.php) exposes remote unauthenticated attackers a direct path to read, modify, or delete underlying database contents by manipulating the Value parameter. The affected product is a PHP web application identified under CPE cpe:2.3:a:anisha:online_farm_system:1.0. A public proof-of-concept exploit exists on GitHub, though EPSS at 0.07% (20th percentile) and absence from CISA KEV indicate negligible observed exploitation, consistent with the product's extremely limited real-world deployment footprint.
SQL injection in code-projects Online Farm System 1.0 allows unauthenticated remote attackers to manipulate backend database queries by supplying crafted input to the Username parameter of the /register.php registration endpoint. The vulnerability is confirmed as critical by the reporter and a public proof-of-concept exploit is documented in a GitHub issue. No active exploitation has been confirmed by CISA KEV, and the EPSS score of 0.07% (20th percentile) reflects the product's niche footprint despite the low technical barrier to exploitation.
SQL injection in Online Farm System 1.0 exposes the unauthenticated password-reset endpoint `/forgot_pass.php` to remote attackers who can manipulate the `email` parameter to inject arbitrary SQL commands against the backend database. A public exploit PoC was disclosed on GitHub (https://github.com/wllovemy/cve/issues/10) at time of reporting, lowering the technical barrier for exploitation. Despite the straightforward, unauthenticated attack surface, EPSS is very low at 0.07% (20th percentile), consistent with the product's minimal real-world deployment footprint and niche audience; no CISA KEV listing exists.
SQL injection in Online Farm System 1.0 allows remote attackers to manipulate database queries through the Username parameter of the /addProduct.php endpoint. Exploit code is publicly available, although the immediate impact is limited to low confidentiality, integrity, and availability effects according to the CVSS assessment. At the time of analysis no active exploitation has been confirmed by CISA KEV, and EPSS indicates a low probability of widespread exploitation.
A vulnerability was found in code-projects Online Farm System 1.0. Rated medium severity (CVSS 6.9), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
SQL injection in Online Farm System 1.0 (/categoryvalue.php) exposes remote unauthenticated attackers a direct path to read, modify, or delete underlying database contents by manipulating the Value parameter. The affected product is a PHP web application identified under CPE cpe:2.3:a:anisha:online_farm_system:1.0. A public proof-of-concept exploit exists on GitHub, though EPSS at 0.07% (20th percentile) and absence from CISA KEV indicate negligible observed exploitation, consistent with the product's extremely limited real-world deployment footprint.
SQL injection in code-projects Online Farm System 1.0 allows unauthenticated remote attackers to manipulate backend database queries by supplying crafted input to the Username parameter of the /register.php registration endpoint. The vulnerability is confirmed as critical by the reporter and a public proof-of-concept exploit is documented in a GitHub issue. No active exploitation has been confirmed by CISA KEV, and the EPSS score of 0.07% (20th percentile) reflects the product's niche footprint despite the low technical barrier to exploitation.
SQL injection in Online Farm System 1.0 exposes the unauthenticated password-reset endpoint `/forgot_pass.php` to remote attackers who can manipulate the `email` parameter to inject arbitrary SQL commands against the backend database. A public exploit PoC was disclosed on GitHub (https://github.com/wllovemy/cve/issues/10) at time of reporting, lowering the technical barrier for exploitation. Despite the straightforward, unauthenticated attack surface, EPSS is very low at 0.07% (20th percentile), consistent with the product's minimal real-world deployment footprint and niche audience; no CISA KEV listing exists.