Niaoniaolll

**Name of the Vulnerable Software and Affected Versions** SililaWijesinghe Food Ordering System versions up to ba314e897e3365600461e5ea59432e39ceaa0fa5 **Description** An issue exists in the `/search.php` endpoint where manipulation of the `search box` variable allows for SQL injection. This allows remote attackers to execute unauthorized database queries. **Recommendations** Update SililaWijesinghe Food Ordering System to a version later than ba314e897e3365600461e5ea59432e39ceaa0fa5. As a temporary mitigation, restrict access to the `/search.php` endpoint.

**Name of the Vulnerable Software and Affected Versions** code-projects Employee Management System version 1.0 **Description** A SQL injection flaw exists in the Admin Login Endpoint within the `/process/aprocess.php` file. The issue occurs when the `mailuid` argument is manipulated, allowing for remote exploitation. SQL injection is a technique where malicious SQL statements are inserted into entry fields for execution, potentially allowing unauthorized access to the database. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability. Avoid using the `mailuid` argument in the `/process/aprocess.php` file until the issue is resolved.

**Name of the Vulnerable Software and Affected Versions** code-projects Hospital Information System version 1.0 **Description** A remote SQL injection exists in the User Login Handler component. The issue occurs within the `User::login()` function located in the `includes/users/UsersController.php` file, where improper handling of the `email` argument allows for the execution of arbitrary SQL commands. **Recommendations** As a temporary mitigation, restrict access to the `User::login()` function or the login interface until a patch is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** code-projects Online Job Portal System version 1.0 **Description** An issue exists in the Password Recovery component within the `/ForPass.php` file. Remote manipulation of the `txtUserName` argument allows for SQL injection, a technique where malicious SQL statements are inserted into entry fields for execution. **Recommendations** Restrict access to the `/ForPass.php` file or the Password Recovery component until a fix is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** code-projects Assessment Management version 1.0 **Description** A remote SQL injection is possible due to the improper handling of the `userid` argument within an unknown function in the `/welcome.php` file. SQL injection is a technique where an attacker inserts malicious SQL code into a query, allowing them to manipulate the database. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability. Avoid using the `userid` argument in the `/welcome.php` endpoint until the issue is resolved.

**Name of the Vulnerable Software and Affected Versions** PHPGurukul Complaint Management System version 1.0 **Description** An issue exists in the `user/check availability.php` file where improper handling of the `email` argument allows for SQL injection. This flaw enables remote exploitation, allowing an attacker to interfere with the database queries. **Recommendations** As a temporary workaround, restrict access to the `user/check availability.php` file until a fix is applied.

A vulnerability was identified in code-projects Task Management System 1.0. This affects the function Operation::select with multiple condition of the file /index.php of the component Login Form. Such manipulation of the argument email leads to sql injection. It is possible to launch the attack remotely. The exploit is publicly available and might be used.

**Name of the Vulnerable Software and Affected Versions** SourceCodester Pet Grooming Management Software version 1.0 **Description** A flaw in the `/admin/get barcode data.php` endpoint allows for remote SQL injection. This occurs through the manipulation of the `barcode` variable, which can be exploited to execute unauthorized database queries. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.