Sanjay Singh

**Name of the Vulnerable Software and Affected Versions** Motopress Hotel Booking Lite version 4.2.4 **Description** A stored cross-site scripting issue allows authenticated attackers to inject malicious scripts. This occurs when payloads are submitted through the `title` and `excerpt` parameters during the creation of accommodation types. These scripts execute in the browser of visitors who access the accommodations page. **Recommendations** As a temporary workaround, restrict the ability of authenticated users to create or edit accommodation types, specifically avoiding the use of the `title` and `excerpt` parameters, until a fix is applied.

**Name of the Vulnerable Software and Affected Versions** CloudClassroom-PHP-Project version 1.0 **Description** A SQL injection vulnerability exists in the registrationform endpoint of CloudClassroom-PHP-Project due to improper input validation, allowing attackers to inject SQL queries. The `pass` parameter is specifically vulnerable. This issue risks remote data theft and authentication bypass. **Recommendations** As a temporary workaround, consider using prepared statements and sanitization to mitigate the risk of SQL injection. Restrict access to the `registrationform` endpoint to minimize the risk of exploitation. Avoid using the `pass` parameter in the affected endpoint until the issue is resolved. Update the software to a version that includes a fix for this issue, once available.

**Name of the Vulnerable Software and Affected Versions** Doctor Appointment Management System version 1.0.0 **Description** The issue is related to a cross-site scripting (XSS) vulnerability. Cross-site scripting is a type of security vulnerability that occurs when an attacker is able to inject malicious scripts into a website, which are then executed by the user's browser. This can allow the attacker to steal user data, take control of the user's session, or perform other malicious actions. **Recommendations** For Doctor Appointment Management System version 1.0.0, as a temporary workaround, consider disabling any features that allow user input to be displayed on the website until a patch is available. Restrict access to sensitive areas of the system to minimize the risk of exploitation. Avoid using any parameters that may be vulnerable to XSS in affected API endpoints until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Doctor Appointment Management System version 1.0.0 **Description** A cross-site scripting (XSS) issue allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the `Employee ID` parameter. **Recommendations** For Doctor Appointment Management System version 1.0.0, consider restricting access to the `Employee ID` parameter to minimize the risk of exploitation until a patch is available.

**Name of the Vulnerable Software and Affected Versions** Judging Management System version 1.0 **Description** A cross-site scripting (XSS) issue allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the `firstname` parameter. **Recommendations** For Judging Management System version 1.0, consider restricting the input for the `firstname` parameter to prevent the injection of malicious scripts until a patch is available.

**Name of the Vulnerable Software and Affected Versions** Judging Management System version 1.0.0 **Description** The Judging Management System contains a SQL injection issue via the `username` parameter. This allows for potential exploitation. **Recommendations** For Judging Management System version 1.0.0, consider restricting access to the `username` parameter to minimize the risk of exploitation until a patch is available. At the moment, there is no information about a newer version that contains a fix for this issue.

**Name of the Vulnerable Software and Affected Versions** Student Study Center Management System version 1.0 **Description** A cross-site scripting (XSS) issue allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the `name` parameter. This enables the execution of malicious code on the client-side. **Recommendations** For Student Study Center Management System version 1.0, consider restricting the input for the `name` parameter to prevent the injection of malicious payloads until a patch is available. As a temporary workaround, validate and sanitize all user input to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** Book Store Management System version 1.0.0 **Description** A cross-site scripting (XSS) issue allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the `Level` parameter under the Add New System User module. **Recommendations** For Book Store Management System version 1.0.0, consider disabling the Add New System User module or restricting access to it until a patch is available. Avoid using the `Level` parameter in the affected module to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** AutoTaxi Stand Management System version 1.0 **Description** The AutoTaxi Stand Management System contains a cross-site scripting (XSS) issue via the `search.php` component. This allows for potential malicious script injection and execution. **Recommendations** For AutoTaxi Stand Management System version 1.0, consider disabling the `search.php` component until a patch is available to prevent exploitation of the XSS vulnerability.

**Name of the Vulnerable Software and Affected Versions** Online Birth Certificate System version 1.2 **Description** The issue allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the `fname` or `lname` parameters in the `/obcs/user/profile.php` component. This enables the execution of malicious code on the victim's browser, potentially leading to unauthorized actions or data theft. **Recommendations** For Online Birth Certificate System version 1.2, consider validating and sanitizing user input for the `fname` and `lname` parameters to prevent malicious code injection. As a temporary workaround, restrict access to the `/obcs/user/profile.php` component until a patch is available. Avoid using the `fname` and `lname` parameters in the affected component until the issue is resolved.

**Name of the Vulnerable Software and Affected Versions** Diary Management System version 1.0 **Description** The Diary Management System contains a cross-site scripting (XSS) issue via the `Name` parameter in the "search-result.php" endpoint. This allows for potential malicious script injection. **Recommendations** For Diary Management System version 1.0, as a temporary workaround, consider restricting access to the `Name` parameter in the "search-result.php" endpoint until a patch is available. At the moment, there is no information about a newer version that contains a fix for this issue.

**Name of the Vulnerable Software and Affected Versions** Dairy Farm Shop Management System version 1.0 **Description** The issue concerns multiple SQL injection vulnerabilities via the `username` and `password` parameters in the Admin panel, allowing attackers to bypass authentication. **Recommendations** For Dairy Farm Shop Management System version 1.0, consider disabling the Admin panel or restricting access to it until a patch is available. Avoid using the `username` and `password` parameters in the affected API endpoint until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Directory Management System version 1.0 **Description** The issue allows attackers to bypass authentication due to multiple SQL injection vulnerabilities via the `username` and `password` parameters in the Admin panel. **Recommendations** For Directory Management System version 1.0, as a temporary workaround, consider restricting access to the Admin panel until a patch is available. Avoid using the `username` and `password` parameters in the affected API endpoint until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Cyber Cafe Management System Project version 1.0 **Description** The issue concerns multiple SQL injection vulnerabilities via the `username` and `password` parameters in the Admin panel, allowing attackers to bypass authentication. **Recommendations** For Cyber Cafe Management System Project version 1.0, update the software to a version that fixes the SQL injection vulnerabilities in the Admin panel, specifically ensuring that the `username` and `password` parameters are properly sanitized to prevent authentication bypass.