Maloyroyorko

A security flaw exists in Tasin1025 SwiftBuy. The issue involves improper restriction of excessive authentication attempts within an unknown functionality of the `/login.php` file. Remote exploitation is possible, though considered difficult. The exploit has been publicly released. The product utilizes a rolling release model, and the vendor did not respond to early disclosure attempts.

A security issue has been identified in ScriptAndTools Real Estate Management System 1.0. The vulnerability involves an unknown function within the `/admin/userlist.php` file, leading to execution after redirect. This manipulation can be executed remotely. The exploit for this issue has been publicly disclosed.

A weakness has been identified in an unknown function of the `register.php` file, allowing for unrestricted file upload through manipulation of the `uimage` argument. Remote exploitation is possible, and the exploit has been made publicly available.

A vulnerability exists in shafhasan chatbox due to SQL injection. The issue is located in the `/chat.php` file and affects an unknown function. Manipulation of the `user id` argument can trigger the vulnerability. The attack can be performed remotely. The exploit has been made public.

Name of the Vulnerable Software and Affected Versions: ScriptAndTools Real Estate Management System version 1.0 Description: A critical issue affects the unknown processing of the file userdelete.php of the component User Delete Handler in ScriptAndTools Real Estate Management System. The manipulation of the argument `ID` leads to authorization bypass. The attack may be initiated remotely. Recommendations: For ScriptAndTools Real Estate Management System version 1.0, consider disabling the `userdelete.php` file or restricting access to the User Delete Handler component until a patch is available. Avoid using the `ID` argument in the affected component to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

A critical vulnerability was found in the Admin Login Panel of the ScriptAndTools Real-Estate-website-in-PHP. The manipulation of the `Password` argument leads to SQL injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

A critical vulnerability has been found in the software, affecting an unknown function of the file /admin/viewpackage.php. This leads to improper access controls, allowing for remote attacks. The exploit has been disclosed publicly and may be used.

A critical issue has been found, affecting an unknown part of the file /admin/viewenquiry.php, leading to improper access controls. The manipulation can be initiated remotely.

A critical issue has been identified, affecting the /admin/addadvertisement.php file, which leads to improper access controls. The issue can be exploited remotely.

A critical issue affects the processing of the file `/admin/addpackage.php`, leading to improper access controls. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. This issue allows for unauthenticated remote access.

A vulnerability was found in the processing of the file `/admin/subscriber-csv.php`, which can lead to information disclosure. The attack may be initiated remotely.

A problematic issue has been identified in the software. The issue involves improper restriction of excessive authentication attempts, potentially allowing remote attacks. The complexity of exploiting this issue is considered high, and exploitability is difficult. The exploit has been publicly disclosed, and the vendor was notified but did not respond. The vulnerability affects an unknown function within the `/login.php` file.

A problematic issue has been identified in ScriptAndTools eCommerce-website-in-PHP. The issue affects some unknown functionality and allows for cross-site request forgery (CSRF). This manipulation can be initiated remotely, and the exploit is publicly available. Multiple endpoints are affected. The vendor was informed of this disclosure but did not respond.

A problematic vulnerability exists due to improper restriction of excessive authentication attempts. This issue affects an unknown functionality within the `/admin/login.php` file and can be exploited remotely. The complexity of the attack is considered high, and exploitation appears to be difficult. The vulnerability has been publicly disclosed and is actively exploited. The vendor was notified but did not respond.

Name of the Vulnerable Software and Affected Versions: Tutorials-Website Employee Management System version 1.0 Description: A vulnerability was found in the Tutorials-Website Employee Management System, affecting an unknown part of the file `/admin/update-user.php`. The manipulation of the `ID` argument leads to improper authorization, allowing for remote attacks. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way. Recommendations: As a temporary workaround, consider restricting access to the `/admin/update-user.php` file until a patch is available. Avoid using the `ID` argument in the affected file until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Name of the Vulnerable Software and Affected Versions: Tutorials-Website Employee Management System version 1.0 Description: A critical issue was found in the Tutorials-Website Employee Management System, affecting some unknown functionality of the file /admin/delete-user.php. The manipulation of the `ID` argument leads to improper authorization, and the attack can be launched remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted about this disclosure but did not respond. Recommendations: As a temporary workaround, consider restricting access to the /admin/delete-user.php file until a patch is available. Avoid using the `ID` argument in the affected API endpoint until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Name of the Vulnerable Software and Affected Versions: Nababur Simple-User-Management-System version 1.0 Description: A vulnerability was found in the file /register.php, where the manipulation of the `name/username` argument leads to cross-site scripting. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. Other parameters might be affected as well. The vendor was contacted early about this disclosure but did not respond in any way. Recommendations: As a temporary workaround, consider disabling the functionality related to the `name/username` argument in the /register.php file until a patch is available. Restrict access to the /register.php file to minimize the risk of exploitation. Avoid using the `name/username` argument in the affected file until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

A critical issue has been found, affecting an unknown part of the file details.php. The manipulation of the `pro id` argument leads to SQL injection. It is possible to initiate the attack remotely.

A critical issue was found in the software, affecting some unknown functionality of the file /customer register.php. The manipulation of the `name` argument leads to unrestricted upload. This issue can be exploited remotely.

A critical issue has been found in the software, affecting some unknown functionality of the file /shop.php. The manipulation of the `p cat` argument leads to SQL injection. This issue can be exploited remotely.