100001001X

A flaw has been found in diem-project diem up to 5.1.3. The impacted element is the function dmOs::join of the file dmFrontPlugin/modules/dmCodeEditor/actions/actions.class.php of the component dmCodeEditor. Executing a manipulation can lead to path traversal. The attack can be launched remotely. The exploit has been published and may be used. The project was informed of the problem early through an issue report but has not responded yet.

A vulnerability has been found in subhajitkhan online-clinic-management-system up to e9ee77a8827a1446220fa07ee693dc4d9a29a578. This affects an unknown function of the file admindocview.php of the component Administrative Mutation Handler. The manipulation of the argument docid leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. This product uses a rolling release model to deliver continuous updates. As a result, specific version information for affected or updated releases is not available. The project was informed of the problem early through an issue report but has not responded yet.

A vulnerability has been found in AdithyaYelloju Restaurant-Management-System up to 7f0e7e84255e8fcfd488e83f8f91451bbbff6b9c. This vulnerability affects unknown code of the file User/login.php of the component Login Form. Such manipulation of the argument email/passwd leads to improper authentication. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. This product takes the approach of rolling releases to provide continious delivery. Therefore, version details for affected and updated releases are not available. The project was informed of the problem early through an issue report but has not responded yet.

**اسم البرنامج المصاب والإصدارات المتأثرة** AdithyaYelloju Restaurant-Management-System الإصدارات حتى 7f0e7e84255e8fcfd488e83f8f91451bbbff6b9c **Description** توجد مشكلة في مكون إعادة تعيين كلمة المرور ضمن الملف 'User/forgot3.php'. يمكن للمهاجمين عن بُعد تنفيذ حقن SQL (SQL injection)، وهي تقنية تُستخدم للتلاعب باستعلامات قاعدة البيانات، من خلال التلاعب بالوسائط `email` أو `password`. **Recommendations** كإجراء مؤقت، قم بتقييد الوصول إلى الملف 'User/forgot3.php' حتى يتم توفير إصلاح. في الوقت الحالي، لا توجد معلومات حول إصدار أحدث يحتوي على إصلاح لهذه الثغرة.

**اسم البرنامج المصاب والإصدارات المتأثرة** AdithyaYelloju Restaurant-Management-System (إصدارات متأثرة غير محددة) **الوصف** يوجد خلل في تجاوز الصلاحيات في مكون إدارة الطلبات (Order Management). يمكن للمهاجم عن بُعد التلاعب بالوسيط `ID` داخل الدالة `mysqli query()` لتجاوز ضوابط الأمان. **التوصيات** في الوقت الحالي، لا توجد معلومات حول إصدار أحدث يحتوي على إصلاح لهذه الثغرة.

**Name of the Vulnerable Software and Affected Versions** AdithyaYelloju Restaurant-Management-System versions up to 7f0e7e84255e8fcfd488e83f8f91451bbbff6b9c **Description** An issue exists in the Unauthenticated Action Script component within the `admin/delete1.php` file. A remote attacker can perform a SQL injection by manipulating the `ID` argument passed to the `mysqli query()` function. SQL injection is a technique where malicious SQL statements are inserted into entry fields for execution, potentially allowing unauthorized access to the database. **Recommendations** As a temporary mitigation, restrict access to the `admin/delete1.php` file or avoid using the `ID` argument in that file until a fix is released. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** AdithyaYelloju Restaurant-Management-System versions prior to 7f0e7e84255e8fcfd488e83f8f91451bbbff6b9c **Description** An issue exists in the Order Cancellation component where the `mysqli query()` function in the `User/cancel.php` file is susceptible to SQL injection. This occurs when the `ID` argument is manipulated, allowing a remote attacker to execute unauthorized database queries. **Recommendations** As a temporary workaround, restrict access to the `User/cancel.php` file or avoid using the `ID` parameter in the Order Cancellation component until a patch is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** AdithyaYelloju Restaurant-Management-System versions prior to 7f0e7e84255e8fcfd488e83f8f91451bbbff6b9c **Description** An issue exists in the Order Placement component within the `mysqli query()` function of the `User/ord.php` file. A remote attacker can perform SQL injection, which is a technique used to manipulate database queries, by manipulating the `id` or `name` arguments. **Recommendations** As a temporary workaround, restrict access to the `User/ord.php` file or avoid using the `id` and `name` parameters in the Order Placement component until a fix is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** AdithyaYelloju Restaurant-Management-System versions up to 7f0e7e84255e8fcfd488e83f8f91451bbbff6b9c **Description** An issue exists that allows remote exploitation via SQL injection, a technique where malicious SQL statements are inserted into entry fields for execution. The flaw is located in the `mysqli query()` function within the `admin/table booking.php` file and is triggered by manipulating the `Name` argument. **Recommendations** As a temporary workaround, restrict access to the `admin/table booking.php` file or avoid using the `Name` argument until a fix is released. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** AdithyaYelloju Restaurant-Management-System versions prior to 7f0e7e84255e8fcfd488e83f8f91451bbbff6b9c **Description** An authorization bypass exists in the Admin Area component within the `/admin/` file. A remote attacker can manipulate the `ID` argument to bypass authorization requirements. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.