Vehicle Management
Monthly
SQL injection in code-projects Vehicle Management 1.0 exposes the `/filter.php` endpoint to remote, unauthenticated database manipulation via the unsanitized `from` parameter. The CVSS 4.0 vector (AV:N/AC:L/PR:N/UI:N) confirms no authentication or user interaction is required, and a public proof-of-concept exploit is disclosed on GitHub. Despite the trivial exploitation conditions, EPSS at 0.07% (20th percentile) and absence from the CISA KEV catalog indicate no observed widespread exploitation at time of analysis.
SQL injection in code-projects Vehicle Management 1.0 allows unauthenticated remote attackers to manipulate the `vehicle` parameter in `/filter1.php` to execute arbitrary SQL against the backend database. A public exploit was disclosed on GitHub, and the CVSS 4.0 E:P supplemental metric confirms publicly available exploit code, though EPSS remains low at 0.07% (20th percentile), reflecting the obscure deployment footprint of this educational PHP project. No CISA KEV listing is present, indicating no confirmed widespread active exploitation at time of analysis.
SQL injection in code-projects Vehicle Management 1.0 allows unauthenticated remote attackers to manipulate backend database queries via the unsanitized `from` parameter in /filter2.php. A publicly available proof-of-concept exploit is documented on GitHub, making exploitation trivial against any network-exposed instance. No active exploitation is confirmed in CISA KEV, and the EPSS score of 0.07% (20th percentile) reflects the product's niche deployment footprint rather than low severity - the underlying flaw class is serious but real-world exposure is narrow.
SQL injection in code-projects Vehicle Management 1.0 exposes the `/updatebal.php` endpoint to remote, unauthenticated database manipulation via the unsanitized `company` parameter. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) confirms no authentication or user interaction is required, and a public proof-of-concept is available on GitHub. Despite the reporter's 'critical' classification, the CVSS 4.0 score of 5.5 with limited CIA impact ratings and an EPSS of 0.07% (20th percentile) indicate low observed exploitation activity; real-world risk is further constrained by the product's narrow deployment footprint as a PHP demo/student project.
SQL injection in code-projects Vehicle Management 1.0 allows remote unauthenticated attackers to manipulate the `vehicle` parameter in /addvehicle.php to execute arbitrary SQL against the backend database. The flaw is network-accessible with no authentication required (PR:N, AV:N per CVSS 4.0 vector) and a public proof-of-concept has been disclosed on GitHub. Despite the public exploit and no-auth attack path, EPSS sits at just 0.07% (20th percentile) and this product is absent from CISA KEV, consistent with the application's extremely limited real-world deployment footprint.
SQL injection in code-projects Vehicle Management 1.0 exposes the `/addcompany.php` endpoint to unauthenticated remote attackers who can manipulate the `company` parameter to execute arbitrary SQL queries against the backend database. The vulnerability (CWE-74) is trivially exploitable with no authentication or user interaction required per the CVSS 4.0 vector (PR:N/UI:N/AV:N), and a proof-of-concept has been publicly disclosed on GitHub. While not listed in CISA KEV and carrying a low EPSS score of 0.07%, the public POC elevates opportunistic exploitation risk for any internet-exposed instances.
SQL injection in code-projects Vehicle Management 1.0 exposes the `/print.php` endpoint to remote unauthenticated database manipulation via the unsanitized `sno` parameter. Any attacker with network access to the application can craft malicious HTTP requests to read or modify backend database contents without authentication, as confirmed by the CVSS 4.0 PR:N metric. A public proof-of-concept exploit is available on GitHub, though the EPSS score of 0.07% (20th percentile) indicates limited automated exploitation activity at this time; no CISA KEV listing is present.
SQL injection in code-projects Vehicle Management 1.0 allows remote unauthenticated attackers to manipulate the `sno` parameter in `/edit1.php`, enabling unauthorized reading, modification, or deletion of backend database contents. A public proof-of-concept is disclosed on GitHub (zgqsdx/cve/issues/1), materially lowering the exploitation barrier despite an EPSS score of 0.07% (20th percentile) that reflects the application's negligible real-world deployment footprint. This vulnerability is not listed in the CISA KEV catalog; no public exploit identified at time of analysis as actively exploited in the wild, though publicly available exploit code exists.
SQL injection in code-projects Vehicle Management 1.0 exposes unauthenticated remote attackers to arbitrary database query manipulation via the `company` parameter in /filter3.php. A public POC has been disclosed on GitHub, enabling database enumeration, credential or record exfiltration, and data modification with no authentication required. Despite the ease of exploitation, an EPSS score of 0.07% (20th percentile) and the absence of a CISA KEV listing reflect the product's negligible real-world deployment footprint - consistent with a tutorial/demo application rather than enterprise software.
A vulnerability, which was classified as critical, was found in code-projects Vehicle Management 1.0. Rated medium severity (CVSS 6.9), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
Code-Projects Vehicle Management 1.0 is vulnerable to Cross Site Scripting (XSS) in Add Accounts via Invoice No, To, and Mammul. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
SQL injection in code-projects Vehicle Management 1.0 exposes the `/filter.php` endpoint to remote, unauthenticated database manipulation via the unsanitized `from` parameter. The CVSS 4.0 vector (AV:N/AC:L/PR:N/UI:N) confirms no authentication or user interaction is required, and a public proof-of-concept exploit is disclosed on GitHub. Despite the trivial exploitation conditions, EPSS at 0.07% (20th percentile) and absence from the CISA KEV catalog indicate no observed widespread exploitation at time of analysis.
SQL injection in code-projects Vehicle Management 1.0 allows unauthenticated remote attackers to manipulate the `vehicle` parameter in `/filter1.php` to execute arbitrary SQL against the backend database. A public exploit was disclosed on GitHub, and the CVSS 4.0 E:P supplemental metric confirms publicly available exploit code, though EPSS remains low at 0.07% (20th percentile), reflecting the obscure deployment footprint of this educational PHP project. No CISA KEV listing is present, indicating no confirmed widespread active exploitation at time of analysis.
SQL injection in code-projects Vehicle Management 1.0 allows unauthenticated remote attackers to manipulate backend database queries via the unsanitized `from` parameter in /filter2.php. A publicly available proof-of-concept exploit is documented on GitHub, making exploitation trivial against any network-exposed instance. No active exploitation is confirmed in CISA KEV, and the EPSS score of 0.07% (20th percentile) reflects the product's niche deployment footprint rather than low severity - the underlying flaw class is serious but real-world exposure is narrow.
SQL injection in code-projects Vehicle Management 1.0 exposes the `/updatebal.php` endpoint to remote, unauthenticated database manipulation via the unsanitized `company` parameter. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) confirms no authentication or user interaction is required, and a public proof-of-concept is available on GitHub. Despite the reporter's 'critical' classification, the CVSS 4.0 score of 5.5 with limited CIA impact ratings and an EPSS of 0.07% (20th percentile) indicate low observed exploitation activity; real-world risk is further constrained by the product's narrow deployment footprint as a PHP demo/student project.
SQL injection in code-projects Vehicle Management 1.0 allows remote unauthenticated attackers to manipulate the `vehicle` parameter in /addvehicle.php to execute arbitrary SQL against the backend database. The flaw is network-accessible with no authentication required (PR:N, AV:N per CVSS 4.0 vector) and a public proof-of-concept has been disclosed on GitHub. Despite the public exploit and no-auth attack path, EPSS sits at just 0.07% (20th percentile) and this product is absent from CISA KEV, consistent with the application's extremely limited real-world deployment footprint.
SQL injection in code-projects Vehicle Management 1.0 exposes the `/addcompany.php` endpoint to unauthenticated remote attackers who can manipulate the `company` parameter to execute arbitrary SQL queries against the backend database. The vulnerability (CWE-74) is trivially exploitable with no authentication or user interaction required per the CVSS 4.0 vector (PR:N/UI:N/AV:N), and a proof-of-concept has been publicly disclosed on GitHub. While not listed in CISA KEV and carrying a low EPSS score of 0.07%, the public POC elevates opportunistic exploitation risk for any internet-exposed instances.
SQL injection in code-projects Vehicle Management 1.0 exposes the `/print.php` endpoint to remote unauthenticated database manipulation via the unsanitized `sno` parameter. Any attacker with network access to the application can craft malicious HTTP requests to read or modify backend database contents without authentication, as confirmed by the CVSS 4.0 PR:N metric. A public proof-of-concept exploit is available on GitHub, though the EPSS score of 0.07% (20th percentile) indicates limited automated exploitation activity at this time; no CISA KEV listing is present.
SQL injection in code-projects Vehicle Management 1.0 allows remote unauthenticated attackers to manipulate the `sno` parameter in `/edit1.php`, enabling unauthorized reading, modification, or deletion of backend database contents. A public proof-of-concept is disclosed on GitHub (zgqsdx/cve/issues/1), materially lowering the exploitation barrier despite an EPSS score of 0.07% (20th percentile) that reflects the application's negligible real-world deployment footprint. This vulnerability is not listed in the CISA KEV catalog; no public exploit identified at time of analysis as actively exploited in the wild, though publicly available exploit code exists.
SQL injection in code-projects Vehicle Management 1.0 exposes unauthenticated remote attackers to arbitrary database query manipulation via the `company` parameter in /filter3.php. A public POC has been disclosed on GitHub, enabling database enumeration, credential or record exfiltration, and data modification with no authentication required. Despite the ease of exploitation, an EPSS score of 0.07% (20th percentile) and the absence of a CISA KEV listing reflect the product's negligible real-world deployment footprint - consistent with a tutorial/demo application rather than enterprise software.
A vulnerability, which was classified as critical, was found in code-projects Vehicle Management 1.0. Rated medium severity (CVSS 6.9), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
Code-Projects Vehicle Management 1.0 is vulnerable to Cross Site Scripting (XSS) in Add Accounts via Invoice No, To, and Mammul. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.