John Correche

**Name of the Vulnerable Software and Affected Versions** CampCodes Computer Laboratory Management System version 1.0 **Description** A critical issue has been found in the system, affecting some unknown functionality of the file /class/edit/edit. The manipulation of the `e photo` argument leads to unrestricted upload. The attack may be launched remotely. **Recommendations** For version 1.0, consider disabling the file /class/edit/edit or restricting access to it until a patch is available. Avoid using the `e photo` argument in the affected file to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this issue.

**Name of the Vulnerable Software and Affected Versions** CampCodes DepEd Equipment Inventory System version 1.0 **Description** A vulnerability was found in the system, rated as problematic. It affects the processing of the file /data/add employee.php, where the manipulation of the `data` argument leads to cross-site scripting. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. **Recommendations** For version 1.0, consider disabling the /data/add employee.php file or restricting access to it until a patch is available. Avoid using the `data` argument in the affected file to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** CampCodes Computer Laboratory Management System version 1.0 **Description** A problem has been found in the system. It affects a part of the file /class/edit/edit. The manipulation of the `s lname` argument leads to cross site scripting attacks. It is possible to initiate the attack remotely. Other parameters might also be affected. **Recommendations** For version 1.0, consider disabling the `s lname` argument in the /class/edit/edit file until a patch is available. Restrict access to the /class/edit/edit file to minimize the risk of exploitation. Avoid using the `s lname` argument in the affected API endpoint until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Campcodes School Faculty Scheduling System version 1.0 **Description** A critical issue has been found in the system, affecting an unknown functionality of the file /admin/ajax.php?action=login. The manipulation of the `username` argument leads to SQL injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. **Recommendations** For Campcodes School Faculty Scheduling System version 1.0, as a temporary workaround, consider disabling the `/admin/ajax.php?action=login` endpoint until a patch is available. Restrict access to this endpoint to minimize the risk of exploitation. Avoid using the `username` argument in the affected endpoint until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Campcodes School Faculty Scheduling System version 1.0 **Description** A critical issue was found in the system, affecting some unknown functionality of the file /admin/index.php. The manipulation of the `page` argument leads to file inclusion. This issue can be exploited remotely. The exploit has been disclosed to the public and may be used. **Recommendations** For Campcodes School Faculty Scheduling System version 1.0, as a temporary workaround, consider restricting access to the /admin/index.php file until a patch is available. Avoid manipulating the `page` argument in the affected file to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Campcodes Student Grading System version 1.0 **Description** A critical issue has been found in the system, affecting an unknown part of the file /view students.php. The manipulation of the `id` argument leads to SQL injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. **Recommendations** For Campcodes Student Grading System version 1.0, as a temporary workaround, consider restricting access to the `/view students.php` file until a patch is available. Avoid using the `id` argument in the affected file to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this issue.

**Name of the Vulnerable Software and Affected Versions** Campcodes Project Management System version 1.0 **Description** A critical issue has been found in the code of the file /forms/update forms.php?action=change pic2&id=4, allowing for unrestricted upload due to the manipulation of the argument file. The attack can be initiated remotely, and the exploit has been disclosed to the public. **Recommendations** For Campcodes Project Management System version 1.0, as a temporary workaround, consider disabling the /forms/update forms.php file until a patch is available. Restrict access to the `action` and `id` parameters in the affected API endpoint to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** CodeAstro Online Food Ordering System version 1.0 **Description** A critical issue affects some unknown processing of the file /admin/all users.php of the component All Users Page, leading to improper access controls. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. **Recommendations** For CodeAstro Online Food Ordering System version 1.0, as a temporary workaround, consider restricting access to the /admin/all users.php file until a patch is available. Additionally, review and strengthen access controls to prevent improper access. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** SourceCodester Multi Role Login System version 1.0 **Description** A vulnerability was found in the SourceCodester Multi Role Login System. It has been classified as problematic. The issue is in an unknown function of the file /endpoint/add-user.php. The manipulation of the `name` argument leads to cross-site scripting. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. **Recommendations** As a temporary workaround, consider disabling the affected function in the /endpoint/add-user.php file until a patch is available. Restrict access to the /endpoint/add-user.php endpoint to minimize the risk of exploitation. Avoid using the `name` argument in the affected endpoint until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** CodeAstro Online Food Ordering System version 1.0 **Description** A critical issue has been identified in the CodeAstro Online Food Ordering System, affecting an unknown functionality of the file /admin/update users.php, specifically the Update User Page component. The manipulation of the `user upd` argument leads to SQL injection. This issue can be exploited remotely. The exploit has been publicly disclosed and may be used. **Recommendations** For CodeAstro Online Food Ordering System version 1.0, consider disabling the Update User Page component or restricting access to the /admin/update users.php file until a patch is available. As a temporary workaround, avoid using the `user upd` argument in the affected file to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this issue.

**Name of the Vulnerable Software and Affected Versions** CodeAstro Simple Loan Management System version 1.0 **Description** A critical issue has been found in the CodeAstro Simple Loan Management System. The problem affects an unknown functionality of the /index.php file in the Login component. Manipulation of the `email` argument leads to SQL injection. This attack can be launched remotely. The exploit has been made public. **Recommendations** For CodeAstro Simple Loan Management System version 1.0, as a temporary workaround, consider restricting access to the /index.php file in the Login component to minimize the risk of exploitation. Avoid using the `email` argument in the affected functionality until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Codezips College Management System version 1.0 **Description** A critical issue has been found in the Codezips College Management System. The problem affects an unknown function of the file /Front-end/faculty.php. Manipulation of the `book name`/`book author` argument leads to SQL injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. **Recommendations** For Codezips College Management System version 1.0, as a temporary workaround, consider restricting access to the /Front-end/faculty.php file until a patch is available. Avoid using the `book name` and `book author` arguments in the affected function until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** SourceCodester Road Accident Map Marker version 1.0 **Description** A problematic issue has been found in the software, affecting some unknown functionality of the file /endpoint/add-mark.php. The manipulation of the `mark name/details` argument leads to cross site scripting. The attack may be launched remotely. Other parameters might be affected as well. **Recommendations** For version 1.0, consider disabling access to the /endpoint/add-mark.php file until a patch is available. As a temporary workaround, avoid using the `mark name/details` argument in the affected endpoint to minimize the risk of exploitation. Restrict access to the vulnerable functionality to minimize the risk of remote attacks.