Queue Management System
Monthly
Reflected cross-site scripting in SourceCodester Queue Management System 1.0 allows unauthenticated remote attackers to inject arbitrary JavaScript via the unvalidated `Name` parameter of `/api/add_customer.php`. The flaw (CWE-79) stems from PHP output rendered without encoding, enabling script execution in a victim's browser when a crafted URL is visited. No public KEV listing exists, but a proof-of-concept exploit is publicly available on GitHub.
Queue Management System 4.0.0 contains a stored cross-site scripting vulnerability that allows authenticated administrators to inject malicious scripts through user creation fields. Rated medium severity (CVSS 5.1), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
Reflected cross-site scripting in SourceCodester Queue Management System 1.0 allows unauthenticated remote attackers to inject arbitrary JavaScript via the unvalidated `Name` parameter of `/api/add_customer.php`. The flaw (CWE-79) stems from PHP output rendered without encoding, enabling script execution in a victim's browser when a crafted URL is visited. No public KEV listing exists, but a proof-of-concept exploit is publicly available on GitHub.
Queue Management System 4.0.0 contains a stored cross-site scripting vulnerability that allows authenticated administrators to inject malicious scripts through user creation fields. Rated medium severity (CVSS 5.1), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.