Oretnom23 vulnerabilities

By year

Bars are flaws published each year; the red part is the share attackers have used.

Latest high and critical flaws

• CVE-2023-44752 An issue in Student Study Center Desk Management System v1.0 allows attackers to bypass authentication via a crafted GET request to /php-sscdms/admin/login.php.Critical 9.8 · Apr 22, 2025
• CVE-2024-31547 Computer Laboratory Management System v1.0 is vulnerable to SQL Injection via the "id" parameter of /admin/item/view_item.php.Critical 9.1 · Apr 19, 2024
• CVE-2024-25217 Online Medicine Ordering System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /omos/?p=products/view_product.Critical 9.8 · Feb 14, 2024
• CVE-2024-22628 Budget and Expense Tracker System v1.0 is vulnerable to SQL Injection via /expense_budget/admin/?page=reports/budget&date_start=2023-12-28&date_end=High 7.2 · Jan 16, 2024
• CVE-2023-30016 SQL Injection vulnerability in oretnom23 Judging Management System v1.0, allows remote attackers to execute arbitrary code and obtain sensitive information via Critical 9.8 · Jan 12, 2024
• CVE-2023-30015 SQL Injection vulnerability in oretnom23 Judging Management System v1.0, allows remote attackers to execute arbitrary code and obtain sensitive information via Critical 9.8 · Jan 12, 2024
• CVE-2023-30014 SQL Injection vulnerability in oretnom23 Judging Management System v1.0, allows remote attackers to execute arbitrary code and obtain sensitive information via Critical 9.8 · Jan 12, 2024
• CVE-2023-46956 SQL injection vulnerability in Packers and Movers Management System v.1.0 allows a remote attacker to execute arbitrary code via crafted payload to the /mpms/adHigh 7.2 · Nov 30, 2023
• CVE-2023-38965 Lost and Found Information System 1.0 allows account takeover via username and password to a /classes/Users.php?f=save URI.Critical 9.8 · Nov 3, 2023
• CVE-2023-44824 An issue in Expense Management System v.1.0 allows a local attacker to execute arbitrary code via a crafted file uploaded to the sign-up.php component.High 7.8 · Oct 17, 2023
• CVE-2023-43457 An issue in Service Provider Management System v.1.0 allows a remote attacker to gain privileges via the ID parameter in the /php-spms/admin/?page=user/ endpoinCritical 9.8 · Sep 25, 2023
• CVE-2023-33592 Lost and Found Information System v1.0 was discovered to contain a SQL injection vulnerability via the component /php-lfis/admin/?page=system_info/contact_inforCritical 9.8 · Jun 28, 2023
• CVE-2023-30122 An arbitrary file upload vulnerability in the component /admin/ajax.php?action=save_menu of Online Food Ordering System v2.0 allows attackers to execute arbitraCritical 9.8 · May 4, 2023
• CVE-2023-24655 Simple Customer Relationship Management System v1.0 was discovered to contain a SQL injection vulnerability via the name parameter under the Profile Update funcCritical 9.8 · Mar 22, 2023
• CVE-2023-24732 Simple Customer Relationship Management System v1.0 as discovered to contain a SQL injection vulnerability via the gender parameter in the user profile update fHigh 8.8 · Mar 15, 2023
• CVE-2023-24731 Simple Customer Relationship Management System v1.0 as discovered to contain a SQL injection vulnerability via the query parameter in the user profile update fuHigh 8.8 · Mar 15, 2023
• CVE-2023-24730 Simple Customer Relationship Management System v1.0 as discovered to contain a SQL injection vulnerability via the company parameter in the user profile update High 8.8 · Mar 15, 2023
• CVE-2023-24729 Simple Customer Relationship Management System v1.0 as discovered to contain a SQL injection vulnerability via the address parameter in the user profile update High 8.8 · Mar 15, 2023
• CVE-2023-24728 Simple Customer Relationship Management System v1.0 as discovered to contain a SQL injection vulnerability via the contact parameter in the user profile update High 8.8 · Mar 15, 2023
• CVE-2023-24656 Simple Customer Relationship Management System v1.0 was discovered to contain a SQL injection vulnerability via the subject parameter under the Create Ticket fuHigh 8.8 · Feb 27, 2023
• CVE-2023-24654 Simple Customer Relationship Management System v1.0 was discovered to contain a SQL injection vulnerability via the name parameter under the Request a Quote funHigh 8.8 · Feb 27, 2023
• CVE-2023-24653 Simple Customer Relationship Management System v1.0 was discovered to contain a SQL injection vulnerability via the oldpass parameter under the Change Password High 8.8 · Feb 27, 2023
• CVE-2023-24652 Simple Customer Relationship Management System v1.0 was discovered to contain a SQL injection vulnerability via the Description parameter under the Create tickeHigh 8.8 · Feb 27, 2023
• CVE-2023-24364 Simple Customer Relationship Management System v1.0 was discovered to contain a SQL injection vulnerability via the username parameter under the Admin Panel.High 8.8 · Feb 27, 2023
• CVE-2023-24647 Food Ordering System v2.0 was discovered to contain a SQL injection vulnerability via the email parameter.High 7.5 · Feb 13, 2023