Online Ordering System

CVE-2025-14251 Dec 08, 16:15 MEDIUM POC This Month

SQL injection in the admin login of Online Ordering System 1.0 allows remote, unauthenticated attackers to manipulate the Username parameter to execute unauthorized SQL commands, potentially leading to data extraction, modification, or authentication bypass. Exploit code is publicly available, but the low EPSS score (0.04%) and lack of CISA KEV listing indicate no active widespread exploitation at this time.

CVE-2025-14250 Dec 08, 16:15 MEDIUM POC This Month

SQL injection in Online Ordering System 1.0 allows remote attackers to extract or modify database contents via the Name parameter in /user_contact.php. Public exploit code is available, but no evidence of active exploitation exists. EPSS is very low (0.04%), indicating minimal real-world impact.

CVE-2025-14249 Dec 08, 15:15 MEDIUM POC This Month

SQL injection in Online Ordering System 1.0 allows remote attackers to inject arbitrary SQL via the product_id parameter of /user_school.php, enabling data extraction or manipulation. Exploit code is publicly available, though no active exploitation has been confirmed by CISA or threat intelligence feeds.

CVE-2025-8256 Jul 28, 05:16 LOW POC Monitor

Unrestricted file upload in code-projects Online Ordering System 1.0 allows authenticated remote attackers to upload arbitrary files via the image parameter in /admin/product.php, potentially enabling remote code execution. Despite a critical severity classification, the CVSS 4.0 score of 2.1 reflects low actual impact due to required authentication and limited scope. Publicly available exploit code exists; however, the 0.10% EPSS score (27th percentile) indicates minimal real-world exploitation likelihood, suggesting this is a low-priority vulnerability in practice.

CVE-2025-8248 Jul 28, 01:15 MEDIUM POC This Month

SQL injection in Online Ordering System 1.0 allows remote unauthenticated attackers to inject arbitrary SQL code via the firstname parameter in signup.php. The vulnerability is publicly known and exploit code is available. EPSS exploitation probability is low (0.07%), and no active exploitation in the wild has been reported.

CVE-2025-8236 Jul 27, 18:15 MEDIUM POC This Month

SQL injection in the admin edit_product.php page of the code-projects Online Ordering System 1.0 allows remote unauthenticated attackers to manipulate database queries. A publicly available exploit increases risk, though EPSS score is low (0.07%) and no active exploitation has been confirmed in CISA KEV. Attackers can extract or modify data with low impact on confidentiality, integrity, and availability.

CVE-2025-8235 Jul 27, 16:15 MEDIUM POC This Month

SQL injection in code-projects Online Ordering System 1.0 via the Name parameter in /admin/product.php allows remote unauthenticated attackers to execute arbitrary SQL commands. Publicly available exploit code exists, but the EPSS score of 0.07% and low impact CVSS 4.0 score indicate a low likelihood of widespread exploitation. No active exploitation has been reported in the wild (not listed in CISA KEV).

CVE-2025-8234 Jul 27, 15:15 MEDIUM POC This Month

SQL injection in Online Ordering System version 1.0 allows remote attackers to inject arbitrary SQL via the ID parameter of the /admin/delete_member.php endpoint. Public exploit code is available, but the EPSS exploitation probability is low (0.07%), and CISA KEV does not list this vulnerability.

CVE-2025-8233 Jul 27, 15:15 MEDIUM POC This Month

SQL injection in code-projects Online Ordering System 1.0 allows remote unauthenticated attackers to execute arbitrary SQL commands via the 'un' parameter in /admin/user.php. A publicly available exploit exists, but no active exploitation has been reported (CISA KEV is absent), and EPSS indicates a very low exploitation probability (0.07%).

CVE-2025-8232 Jul 27, 14:15 MEDIUM POC This Month

SQL injection in code-projects Online Ordering System 1.0 allows remote attackers to execute arbitrary SQL commands via the ID parameter in the admin user deletion script. Public exploit code is available, but EPSS indicates a low exploitation probability (0.07%) and no active exploitation is confirmed.

CVE-2025-7755 Jul 17, 21:15 LOW POC Monitor

Unrestricted file upload in code-projects Online Ordering System 1.0 allows authenticated remote attackers to upload arbitrary files via the image parameter in /admin/edit_product.php, enabling remote code execution. The vulnerability affects the admin product editing functionality and has publicly available exploit code; however, the low CVSS score (2.1) and minimal EPSS percentile (26%) indicate limited real-world exploitation despite authenticated access requirements.

CVE-2022-36581 Aug 31, 20:15 HIGH POC This Week

Online Ordering System v2.3.2 was discovered to contain a SQL injection vulnerability via the user_email parameter at /admin/login.php. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.

CVE-2022-36580 Aug 31, 20:15 HIGH POC This Week

An arbitrary file upload vulnerability in the component /admin/products/controller.php?action=add of Online Ordering System v2.3.2 allows attackers to execute arbitrary code via a crafted PHP file. Rated high severity (CVSS 7.2), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.

CVE-2022-31357 Jun 17, 14:15 CRITICAL POC Act Now

Online Ordering System v2.3.2 was discovered to contain a SQL injection vulnerability via /ordering/admin/inventory/index.php?view=edit&id=. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.

CVE-2022-31356 Jun 17, 14:15 CRITICAL POC Act Now

Online Ordering System v2.3.2 was discovered to contain a SQL injection vulnerability via /ordering/admin/store/index.php?view=edit&id=. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.

CVE-2022-31355 Jun 17, 14:15 CRITICAL POC Act Now

Online Ordering System v2.3.2 was discovered to contain a SQL injection vulnerability via /ordering/index.php?q=category&search=. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.

CVE-2022-31338 Jun 02, 14:15 CRITICAL POC Act Now

Online Ordering System 2.3.2 is vulnerable to SQL Injection via /ordering/admin/user/index.php?view=edit&id=. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.

CVE-2022-31337 Jun 02, 14:15 CRITICAL POC Act Now

Online Ordering System 2.3.2 is vulnerable to SQL Injection via /ordering/admin/category/index.php?view=edit&id=. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.

CVE-2022-31336 Jun 02, 14:15 CRITICAL POC Act Now

Online Ordering System 2.3.2 is vulnerable to SQL Injection via /ordering/admin/stockin/loaddata.php. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.

CVE-2022-31335 Jun 02, 14:15 CRITICAL POC Act Now

Online Ordering System 2.3.2 is vulnerable to SQL Injection via /ordering/admin/stockin/index.php?view=edit&id=. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.

CVE-2022-31329 Jun 02, 14:15 CRITICAL POC Act Now

Online Ordering System By janobe 2.3.2 is vulnerable to SQL Injection via /ordering/admin/orders/loaddata.php. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.

CVE-2022-31328 Jun 02, 14:15 CRITICAL POC Act Now

Online Ordering System By janobe 2.3.2 has SQL Injection via /ordering/admin/products/index.php?view=edit&id=. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.

CVE-2022-31327 Jun 02, 14:15 CRITICAL POC Act Now

Online Ordering System By janobe 2.3.2 is vulneranle to SQL Injection via /ordering/index.php?q=products&id=. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.

CVE-2022-30799 Jun 02, 14:15 HIGH POC This Week

Online Ordering System v1.0 by oretnom23 has SQL injection via store/orderpage.php. Rated high severity (CVSS 7.2), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.

CVE-2022-30798 Jun 02, 14:15 HIGH POC This Week

Online Ordering System v1.0 by oretnom23 is vulnerable to SQL Injection via admin/viewreport.php. Rated high severity (CVSS 7.2), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.

CVE-2022-30797 Jun 02, 14:15 CRITICAL POC Act Now

Online Ordering System 1.0 by oretnom23 is vulnerable to SQL Injection via admin/vieworders.php. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.

CVE-2022-30795 Jun 02, 14:15 HIGH POC This Week

Online Ordering System v1.0 by oretnom23 is vulnerable to SQL Injection via admin/editproductimage.php. Rated high severity (CVSS 7.2), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.

CVE-2022-30794 Jun 02, 14:15 HIGH This Week

Online Ordering System v1.0 by oretnom23 is vulnerable to SQL Injection via admin/editproductetails.php. Rated high severity (CVSS 7.2), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.

CVE-2021-25211 Jul 22, 20:15 CRITICAL POC Act Now

Arbitrary file upload vulnerability in SourceCodester Ordering System v 1.0 allows attackers to execute arbitrary code, via the file upload to ordering\admin\products\edit.php. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.

CVE-2021-28295 Mar 16, 20:15 HIGH POC THREAT This Week

Online Ordering System 1.0 is vulnerable to unauthenticated SQL injection through /onlineordering/GPST/admin/design.php, which may lead to database information disclosure. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.

CVE-2021-28294 Mar 16, 20:15 CRITICAL POC Act Now

Online Ordering System 1.0 is vulnerable to arbitrary file upload through /onlineordering/GPST/store/initiateorder.php, which may lead to remote code execution (RCE). Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.