Stock Management System
Monthly
Cross-site scripting in SourceCodester Stock Management System 1.0 allows remote unauthenticated attackers to inject arbitrary JavaScript via the clientName and clientContact parameters of /php_action/getOrderReport.php. A publicly available proof-of-concept exploit exists (CVSS 4.0 E:P), lowering the skill threshold for exploitation. No CISA KEV listing is present, but the unauthenticated, network-accessible vector with a public PoC makes this a credible risk for any exposed deployment.
Cross-site scripting in SourceCodester Stock Management System 1.0 allows remote attackers to inject malicious script via the clientName and clientContact parameters of /php_action/printOrder.php. When a legitimate user views a manipulated order print page, the unsanitized input is rendered in their browser, enabling session hijacking, credential theft, or malicious redirects. A public exploit has been disclosed via GitHub (referenced in VulDB entry 394299); no active exploitation is confirmed in CISA KEV.
SQL injection in SourceCodester Stock Management System 1.0 exposes the `/classes/Master.php?f=delete_supplier` endpoint to database manipulation by authenticated high-privileged users. The `id` parameter is passed unsanitized to the backend SQL query, enabling an attacker to read, modify, or delete database records. A publicly available exploit exists on GitHub, though exploitation is bounded by the high-privilege authentication requirement and the CVSS 4.0 base score of 2.0 reflects limited real-world blast radius. No active exploitation (CISA KEV) has been confirmed.
Missing authentication for the /api/employees endpoint in haxxorsid Stock Management System lets remote attackers retrieve employee data without credentials, affecting rolling releases up to commit fbbbf213e9c93b87183a3891f77e3cc7095f22b0. Publicly available exploit code exists, but there is no confirmed active exploitation (not in CISA KEV) and EPSS is 0.77% (54th percentile), so risk is constrained by the limited confidentiality-only impact and the need for a reachable deployment. The vendor did not respond and the product is unsupported, so no vendor-released patch is identified.
A vulnerability was found in SourceCodester Stock Management System 1.0 and classified as critical.php. Rated medium severity (CVSS 6.9), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
A vulnerability, which was classified as critical, has been found in SourceCodester/oretnom23 Stock Management System 1.0. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
A vulnerability classified as critical has been found in SourceCodester/oretnom23 Stock Management System 1.0. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
A vulnerability was found in SourceCodester/oretnom23 Stock Management System 1.0. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
A vulnerability has been found in SourceCodester/oretnom23 Stock Management System 1.0 and classified as critical. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
A vulnerability was found in SourceCodester/oretnom23 Stock Management System 1.0 and classified as critical.php?f=login. Rated medium severity (CVSS 6.9), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
A vulnerability has been found in SourceCodester/oretnom23 Stock Management System 1.0 and classified as problematic. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
A vulnerability, which was classified as critical, was found in SourceCodester/oretnom23 Stock Management System 1.0. Rated medium severity (CVSS 5.1), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
A vulnerability has been found in SourceCodester Stock Management System 1.0 and classified as critical. Rated medium severity (CVSS 6.9), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
Sourcecodester Stock Management System v1.0 is vulnerable to SQL Injection via editCategories.php. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
A vulnerability was found in SourceCodester Stock Management System 1.0. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
A vulnerability was found in CodeAstro Stock Management System 1.0 and classified as problematic.php of the component Add Category Handler. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
A vulnerability was found in rickxy Stock Management System and classified as problematic.php?action=add. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
A vulnerability was found in rickxy Stock Management System. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
A vulnerability was found in rickxy Stock Management System and classified as critical. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
A persistent cross-site scripting vulnerability in Sourcecodester Stock Management System v1.0 allows remote attackers to inject arbitrary web script or HTML via the 'Brand Name.'. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
A SQL injection vulnerability in the login component in Stock Management System v1.0 allows remote attacker to execute arbitrary SQL commands via the username parameter. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
A Cross-Site Request Forgery (CSRF) vulnerability in changeUsername.php in SourceCodester Stock Management System v1.0 allows remote attackers to deny future logins by changing an authenticated. Rated high severity (CVSS 7.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
A Reflected Cross-Site Scripting (XSS) vulnerability in the index.php login-portal webpage of SourceCodester Stock Management System v1.0 allows remote attackers to harvest login credentials and. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
Cross-site scripting in SourceCodester Stock Management System 1.0 allows remote unauthenticated attackers to inject arbitrary JavaScript via the clientName and clientContact parameters of /php_action/getOrderReport.php. A publicly available proof-of-concept exploit exists (CVSS 4.0 E:P), lowering the skill threshold for exploitation. No CISA KEV listing is present, but the unauthenticated, network-accessible vector with a public PoC makes this a credible risk for any exposed deployment.
Cross-site scripting in SourceCodester Stock Management System 1.0 allows remote attackers to inject malicious script via the clientName and clientContact parameters of /php_action/printOrder.php. When a legitimate user views a manipulated order print page, the unsanitized input is rendered in their browser, enabling session hijacking, credential theft, or malicious redirects. A public exploit has been disclosed via GitHub (referenced in VulDB entry 394299); no active exploitation is confirmed in CISA KEV.
SQL injection in SourceCodester Stock Management System 1.0 exposes the `/classes/Master.php?f=delete_supplier` endpoint to database manipulation by authenticated high-privileged users. The `id` parameter is passed unsanitized to the backend SQL query, enabling an attacker to read, modify, or delete database records. A publicly available exploit exists on GitHub, though exploitation is bounded by the high-privilege authentication requirement and the CVSS 4.0 base score of 2.0 reflects limited real-world blast radius. No active exploitation (CISA KEV) has been confirmed.
Missing authentication for the /api/employees endpoint in haxxorsid Stock Management System lets remote attackers retrieve employee data without credentials, affecting rolling releases up to commit fbbbf213e9c93b87183a3891f77e3cc7095f22b0. Publicly available exploit code exists, but there is no confirmed active exploitation (not in CISA KEV) and EPSS is 0.77% (54th percentile), so risk is constrained by the limited confidentiality-only impact and the need for a reachable deployment. The vendor did not respond and the product is unsupported, so no vendor-released patch is identified.
A vulnerability was found in SourceCodester Stock Management System 1.0 and classified as critical.php. Rated medium severity (CVSS 6.9), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
A vulnerability, which was classified as critical, has been found in SourceCodester/oretnom23 Stock Management System 1.0. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
A vulnerability classified as critical has been found in SourceCodester/oretnom23 Stock Management System 1.0. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
A vulnerability was found in SourceCodester/oretnom23 Stock Management System 1.0. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
A vulnerability has been found in SourceCodester/oretnom23 Stock Management System 1.0 and classified as critical. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
A vulnerability was found in SourceCodester/oretnom23 Stock Management System 1.0 and classified as critical.php?f=login. Rated medium severity (CVSS 6.9), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
A vulnerability has been found in SourceCodester/oretnom23 Stock Management System 1.0 and classified as problematic. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
A vulnerability, which was classified as critical, was found in SourceCodester/oretnom23 Stock Management System 1.0. Rated medium severity (CVSS 5.1), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
A vulnerability has been found in SourceCodester Stock Management System 1.0 and classified as critical. Rated medium severity (CVSS 6.9), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
Sourcecodester Stock Management System v1.0 is vulnerable to SQL Injection via editCategories.php. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
A vulnerability was found in SourceCodester Stock Management System 1.0. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
A vulnerability was found in CodeAstro Stock Management System 1.0 and classified as problematic.php of the component Add Category Handler. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
A vulnerability was found in rickxy Stock Management System and classified as problematic.php?action=add. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
A vulnerability was found in rickxy Stock Management System. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
A vulnerability was found in rickxy Stock Management System and classified as critical. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
A persistent cross-site scripting vulnerability in Sourcecodester Stock Management System v1.0 allows remote attackers to inject arbitrary web script or HTML via the 'Brand Name.'. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
A SQL injection vulnerability in the login component in Stock Management System v1.0 allows remote attacker to execute arbitrary SQL commands via the username parameter. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
A Cross-Site Request Forgery (CSRF) vulnerability in changeUsername.php in SourceCodester Stock Management System v1.0 allows remote attackers to deny future logins by changing an authenticated. Rated high severity (CVSS 7.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
A Reflected Cross-Site Scripting (XSS) vulnerability in the index.php login-portal webpage of SourceCodester Stock Management System v1.0 allows remote attackers to harvest login credentials and. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.