I-Ovo-I

**Name of the Vulnerable Software and Affected Versions** SourceCodester Stock Management System version 1.0 **Description** A remote cross site scripting issue exists in the `/php action/printOrder.php` endpoint. The flaw allows an attacker to execute malicious scripts by manipulating the `clientName` or `clientContact` variables. Cross site scripting is a technique where malicious scripts are injected into trusted websites. **Recommendations** As a temporary workaround, restrict access to the `/php action/printOrder.php` endpoint or avoid using the `clientName` and `clientContact` variables until a fix is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** SourceCodester Class and Exam Timetabling System version 1.0 **Description** An issue exists in the `/BSIT2.php` file where manipulating the `course` variable allows for cross-site scripting (XSS), a technique used to inject malicious scripts into web pages viewed by other users. This flaw enables remote exploitation. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** SourceCodester Stock Management System version 1.0 **Description** An issue exists in the processing of the '/php action/getOrderReport.php' endpoint. Manipulating the `clientName` or `clientContact` variables allows for remote cross-site scripting, a technique where malicious scripts are injected into trusted websites. **Recommendations** Update SourceCodester Stock Management System version 1.0 to a patched version. As a temporary mitigation, restrict access to the '/php action/getOrderReport.php' endpoint.

**Name of the Vulnerable Software and Affected Versions** SourceCodester Class and Exam Timetabling System version 1.0 **Description** A weakness in the `/BSIS1.php` file allows for remote cross site scripting (XSS), a technique where malicious scripts are injected into trusted websites. This occurs through the manipulation of the `course` variable. **Recommendations** As a temporary workaround, avoid using the `course` variable in the `/BSIS1.php` file until a fix is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** SourceCodester Class and Exam Timetabling System version 1.0 **Description** An issue exists in the `/edit subject2.php` file that allows remote attackers to perform SQL injection, a technique used to interfere with the queries that an application makes to its database. This is achieved by manipulating the `ID` argument. **Recommendations** Update SourceCodester Class and Exam Timetabling System version 1.0 to a version that contains a fix for this issue. As a temporary workaround, restrict access to the `/edit subject2.php` file to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** SourceCodester Class and Exam Timetabling System version 1.0 **Description** Remote cross site scripting occurs due to improper handling of the `course` argument within the '/BSCE2.php' endpoint. Cross site scripting is a technique where malicious scripts are injected into trusted websites. **Recommendations** Avoid using the `course` argument in the '/BSCE2.php' endpoint until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** SourceCodester Class and Exam Timetabling System version 1.0 **Description** A security flaw allows remote exploitation via cross site scripting (XSS), a technique where malicious scripts are injected into trusted websites. The issue exists in the `/BSHRM1.php` endpoint due to improper handling of the `course` variable. **Recommendations** As a temporary workaround, restrict access to the `/BSHRM1.php` file or avoid using the `course` variable until a fix is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** SourceCodester Class and Exam Timetabling System version 1.0 **Description** Remote SQL injection is possible due to improper processing of the `/edit subject1.php` endpoint. An attacker can exploit this by manipulating the `ID` variable to execute unauthorized database queries. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** itsourcecode Electronic Judging System version 1.0 **Description** A SQL injection issue exists in the '/admin/edit judge.php' endpoint. Remote attackers can exploit this by manipulating the `judge id` argument. SQL injection is a technique where malicious SQL statements are inserted into entry fields for execution, potentially allowing unauthorized access to or modification of the database. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability. Avoid using the `judge id` parameter in the '/admin/edit judge.php' endpoint until the issue is resolved.

**Name of the Vulnerable Software and Affected Versions** itsourcecode Electronic Judging System version 1.0 **Description** An issue exists in the processing of the '/admin/judges.php' endpoint. Manipulation of the `fname` argument allows for cross-site scripting, which can be exploited remotely. **Recommendations** Update itsourcecode Electronic Judging System version 1.0 to a newer version that contains a fix. As a temporary workaround, restrict access to the '/admin/judges.php' endpoint or avoid using the `fname` parameter until the issue is resolved.

**Name of the Vulnerable Software and Affected Versions** itsourcecode Electronic Judging System version 1.0 **Description** A SQL injection issue exists in the `/admin/edit team.php` endpoint. Remote attackers can exploit this by manipulating the `num id` argument. SQL injection is a technique where malicious SQL statements are inserted into entry fields for execution, potentially allowing unauthorized access to or modification of the database. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.