Online Shopping System
Monthly
SQL injection in code-projects Online Shopping System 1.0 allows authenticated administrators to manipulate database queries via the `mobile` parameter in admin/adduser.php. The vulnerable call passes unsanitized user input directly to mysqli_query(), enabling an admin-level attacker to read, modify, or delete database contents. A public proof-of-concept exploit has been published on GitHub; no vendor patch has been identified.
Unauthenticated SQL injection in code-projects Online Shopping System 1.0 exposes the backend database through the Search Functionality's `keyword` parameter in `/action.php`. The GitHub-linked proof-of-concept specifically documents a time-based blind injection technique, allowing remote attackers without credentials to enumerate database contents, extract data, and potentially modify records. No public KEV listing exists, but exploit code is publicly available, lowering the bar for opportunistic exploitation.
Reflected cross-site scripting in code-projects Online Shopping System 1.0 allows remote attackers to inject arbitrary JavaScript into victim browsers by manipulating the email argument in offersmail.php. The vulnerability requires no authentication (PR:N per CVSS 4.0 vector) but does require a victim to interact with a crafted link or page (UI:P). Publicly available exploit code exists on GitHub, though no active exploitation has been confirmed by CISA KEV.
SQL injection in code-projects Online Shopping System 1.0 allows remote low-privileged attackers to manipulate the `total_count` parameter in `/checkout_process.php` to execute arbitrary SQL commands against the backend database. The CVSS 4.0 score is 5.3 (Medium) with partial confidentiality, integrity, and availability impact; no subsequent-system scope change is indicated. A public proof-of-concept exploit is available on GitHub, substantially lowering the bar for opportunistic exploitation - though the product's niche footprint limits broad real-world blast radius.
Cross-site scripting in code-projects Online Shopping System 1.0 allows remote low-privileged attackers to inject arbitrary JavaScript into victim browsers via the unsanitized `amount_1` parameter in `/checkout.php`, enabling session hijacking, credential theft, or UI manipulation against users who interact with the crafted response. The affected product is a PHP-based e-commerce application distributed by code-projects.org, with the vulnerability tracked exclusively through VulDB. A public proof-of-concept exploit has been released on GitHub, elevating the practical risk beyond the moderate CVSS 4.0 score of 5.1 suggests in isolation.
online-shopping-system-php 1.0 has SQL injection in review_action.php via the proId parameter. PoC available.
SQL injection in projectworlds Online Shopping System 1.0 exposes database contents to unauthenticated remote attackers via the `keywords` parameter in `/login_submit.php`. The attack requires no credentials, no user interaction, and carries low access complexity, making it trivially scriptable against any exposed instance. Publicly available exploit code exists per a GitHub proof-of-concept, though the EPSS score of 0.03% (9th percentile) reflects the product's limited real-world deployment footprint; no confirmed active exploitation (CISA KEV) has been observed at time of analysis.
A vulnerability was identified in Projectworlds Online Shopping System 1.0. Rated medium severity (CVSS 6.9), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
A vulnerability was found in Campcodes Online Shopping System 1.0. Rated medium severity (CVSS 6.9), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
A vulnerability has been found in Campcodes Online Shopping System 1.0. Rated medium severity (CVSS 6.9), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
A vulnerability classified as problematic was found in Campcodes Online Shopping System 1.0. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
A vulnerability has been found in Surya2Developer Online Shopping System 1.0 and classified as critical. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
In ProjectWorlds Online Shopping System PHP 1.0, a CSRF vulnerability in cart_remove.php allows a remote attacker to remove any product in the customer's cart. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
Projectsworlds Online Shopping System PHP 1.0 is vulnerable to SQL injection via the id parameter in cart_remove.php. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
SQL injection in code-projects Online Shopping System 1.0 allows authenticated administrators to manipulate database queries via the `mobile` parameter in admin/adduser.php. The vulnerable call passes unsanitized user input directly to mysqli_query(), enabling an admin-level attacker to read, modify, or delete database contents. A public proof-of-concept exploit has been published on GitHub; no vendor patch has been identified.
Unauthenticated SQL injection in code-projects Online Shopping System 1.0 exposes the backend database through the Search Functionality's `keyword` parameter in `/action.php`. The GitHub-linked proof-of-concept specifically documents a time-based blind injection technique, allowing remote attackers without credentials to enumerate database contents, extract data, and potentially modify records. No public KEV listing exists, but exploit code is publicly available, lowering the bar for opportunistic exploitation.
Reflected cross-site scripting in code-projects Online Shopping System 1.0 allows remote attackers to inject arbitrary JavaScript into victim browsers by manipulating the email argument in offersmail.php. The vulnerability requires no authentication (PR:N per CVSS 4.0 vector) but does require a victim to interact with a crafted link or page (UI:P). Publicly available exploit code exists on GitHub, though no active exploitation has been confirmed by CISA KEV.
SQL injection in code-projects Online Shopping System 1.0 allows remote low-privileged attackers to manipulate the `total_count` parameter in `/checkout_process.php` to execute arbitrary SQL commands against the backend database. The CVSS 4.0 score is 5.3 (Medium) with partial confidentiality, integrity, and availability impact; no subsequent-system scope change is indicated. A public proof-of-concept exploit is available on GitHub, substantially lowering the bar for opportunistic exploitation - though the product's niche footprint limits broad real-world blast radius.
Cross-site scripting in code-projects Online Shopping System 1.0 allows remote low-privileged attackers to inject arbitrary JavaScript into victim browsers via the unsanitized `amount_1` parameter in `/checkout.php`, enabling session hijacking, credential theft, or UI manipulation against users who interact with the crafted response. The affected product is a PHP-based e-commerce application distributed by code-projects.org, with the vulnerability tracked exclusively through VulDB. A public proof-of-concept exploit has been released on GitHub, elevating the practical risk beyond the moderate CVSS 4.0 score of 5.1 suggests in isolation.
online-shopping-system-php 1.0 has SQL injection in review_action.php via the proId parameter. PoC available.
SQL injection in projectworlds Online Shopping System 1.0 exposes database contents to unauthenticated remote attackers via the `keywords` parameter in `/login_submit.php`. The attack requires no credentials, no user interaction, and carries low access complexity, making it trivially scriptable against any exposed instance. Publicly available exploit code exists per a GitHub proof-of-concept, though the EPSS score of 0.03% (9th percentile) reflects the product's limited real-world deployment footprint; no confirmed active exploitation (CISA KEV) has been observed at time of analysis.
A vulnerability was identified in Projectworlds Online Shopping System 1.0. Rated medium severity (CVSS 6.9), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
A vulnerability was found in Campcodes Online Shopping System 1.0. Rated medium severity (CVSS 6.9), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
A vulnerability has been found in Campcodes Online Shopping System 1.0. Rated medium severity (CVSS 6.9), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
A vulnerability classified as problematic was found in Campcodes Online Shopping System 1.0. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
A vulnerability has been found in Surya2Developer Online Shopping System 1.0 and classified as critical. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
In ProjectWorlds Online Shopping System PHP 1.0, a CSRF vulnerability in cart_remove.php allows a remote attacker to remove any product in the customer's cart. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
Projectsworlds Online Shopping System PHP 1.0 is vulnerable to SQL injection via the id parameter in cart_remove.php. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.