Simple Company Website
Monthly
Unrestricted file upload in SourceCodester Simple Company Website 1.0 permits authenticated users with high privileges to upload arbitrary files via the 'img' parameter in /classes/Users.php, likely resulting in remote code execution if a malicious PHP script is placed in the webroot. A public exploit is available, but no active exploitation is reported.
Unrestricted file upload in Simple Company Website 1.0 allows authenticated administrators to upload arbitrary files via the settings update endpoint, leading to low-impact compromise. The vulnerability has
SQL injection in SourceCodester Simple Company Website 1.0 allows remote attackers to manipulate the login process via the Username parameter in /classes/Login.php. A publicly available proof-of-concept exploit exists, and EPSS indicates a 0.09% probability of exploitation, but no active exploitation campaigns are confirmed.
Unrestricted file upload in SourceCodester Simple Company Website 1.0 allows remote attackers to upload arbitrary files via the img parameter in /classes/Content.php?f=service, potentially leading to code execution. A publicly available exploit exists, though no active exploitation is confirmed. The CVSS vector indicates high privilege requirements, but the presence of an Authentication Bypass tag suggests this may be circumventable.
An SQL injection in Simple Company Website 1.0's admin testimonials management page allows authenticated administrators to execute arbitrary SQL commands. Remotely exploitable, this can lead to limited compromise of database confidentiality, integrity, and availability. Proof-of-concept code is publicly available, though current exploitation probability is low (EPSS 0.08%, no active
SQL injection in SourceCodester Simple Company Website
Authenticated SQL injection in SourceCodester Simple Company Website 1.0 allows remote administrators to execute arbitrary SQL commands via the ID parameter in the admin/services/manage.php endpoint, potentially leading to data manipulation or information disclosure. Exploit code is publicly available, but EPSS indicates very low exploitation probability and no active exploitation is confirmed.
Unrestricted file upload in SourceCodester Simple Company Website 1.0 permits authenticated users with high privileges to upload arbitrary files via the 'img' parameter in /classes/Users.php, likely resulting in remote code execution if a malicious PHP script is placed in the webroot. A public exploit is available, but no active exploitation is reported.
Unrestricted file upload in Simple Company Website 1.0 allows authenticated administrators to upload arbitrary files via the settings update endpoint, leading to low-impact compromise. The vulnerability has
SQL injection in SourceCodester Simple Company Website 1.0 allows remote attackers to manipulate the login process via the Username parameter in /classes/Login.php. A publicly available proof-of-concept exploit exists, and EPSS indicates a 0.09% probability of exploitation, but no active exploitation campaigns are confirmed.
Unrestricted file upload in SourceCodester Simple Company Website 1.0 allows remote attackers to upload arbitrary files via the img parameter in /classes/Content.php?f=service, potentially leading to code execution. A publicly available exploit exists, though no active exploitation is confirmed. The CVSS vector indicates high privilege requirements, but the presence of an Authentication Bypass tag suggests this may be circumventable.
An SQL injection in Simple Company Website 1.0's admin testimonials management page allows authenticated administrators to execute arbitrary SQL commands. Remotely exploitable, this can lead to limited compromise of database confidentiality, integrity, and availability. Proof-of-concept code is publicly available, though current exploitation probability is low (EPSS 0.08%, no active
SQL injection in SourceCodester Simple Company Website
Authenticated SQL injection in SourceCodester Simple Company Website 1.0 allows remote administrators to execute arbitrary SQL commands via the ID parameter in the admin/services/manage.php endpoint, potentially leading to data manipulation or information disclosure. Exploit code is publicly available, but EPSS indicates very low exploitation probability and no active exploitation is confirmed.