Burak Sevben

Name of the Vulnerable Software and Affected Versions: SourceCodester Event Registration System version 1.0 Description: A critical issue was found in the SourceCodester Event Registration System, affecting an unknown part of the file portal.php. The manipulation of the `username` and `password` arguments leads to SQL injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. Recommendations: For SourceCodester Event Registration System version 1.0, consider disabling the `portal.php` file or restricting access to it until a patch is available. As a temporary workaround, avoid using the `username` and `password` arguments in the affected file to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this issue.

The system contains a cross-site scripting (XSS) vulnerability in the Add Resident function at "/barangay-population-monitoring-system/masterlist.php". This issue allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the `Full Name` parameter.

The issue is related to a SQL injection vulnerability. This vulnerability can be exploited via the `expense` parameter at the "/endpoint/delete expense.php" API endpoint.

The issue is related to a SQL injection vulnerability. This vulnerability can be exploited via the `id` parameter at the "/delete.php" API endpoint.

The issue is related to a SQL injection vulnerability. This vulnerability can be exploited via the `id` parameter at the "/edit.php" API endpoint.

An issue in the Employee Managment System allows attackers to bypass authentication via injecting a crafted payload into the `E-mail` and `Password` parameters at the "/alogin.html" API endpoint.

The issue is related to a SQL injection vulnerability. This vulnerability can be exploited via the `pwd` parameter at the "/aprocess.php" API endpoint.

The issue is related to a SQL injection vulnerability. This vulnerability can be exploited via the `mailud` parameter at the "/aprocess.php" API endpoint.

The issue is related to a SQL injection vulnerability. This vulnerability can be exploited via the `id` parameter at the "/omos/?p=products/view product" API endpoint.

The system contains a cross-site scripting (XSS) vulnerability in the Add Resident function at "/barangay-population-monitoring-system/masterlist.php". This issue allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the `Contact Number` parameter.

A cross-site scripting (XSS) issue allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the `Task Name` parameter in the "/TaskManager/Task.php" API endpoint.

The issue is related to a SQL injection vulnerability. This vulnerability can be exploited via the `taskID` parameter at the "/TaskManager/EditTask.php" API endpoint.

A cross-site scripting (XSS) issue allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the `Note Section` parameter at "/TaskManager/Tasks.php". This enables attackers to potentially manipulate the application's behavior or steal user data.

The issue is related to a SQL injection vulnerability. This vulnerability can be exploited via the `projectID` parameter at the "/TaskManager/EditProject.php" API endpoint.

The issue is related to a SQL injection vulnerability. This vulnerability can be exploited via the `orderID` parameter at the "/adminView/viewEachOrder.php" API endpoint.

A cross-site scripting (XSS) issue allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the `Size Number` parameter under the `Add Size` function.

A cross-site scripting (XSS) issue allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the `Category Name` parameter under the `Add Category` function.

A cross-site scripting (XSS) issue allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the `Category Name` parameter under the `Add Category` function.

A cross-site scripting (XSS) issue allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the `Project Name` parameter in the "/TaskManager/Projects.php" API endpoint. This enables attackers to potentially manipulate the application's behavior or steal user data.