CVE-2025-1871

SQL injection vulnerability in 101news

SQL injection vulnerability have been found in 101news affecting version 1.0 through the "category" and "subcategory" parameters in admin/add-subcategory.php.

CVSS 4.0 · 9.3 Critical EPSS < 1% KEV · Not listed

Vendors

Mayurik

Products

Best Online News Portal

CVE-2025-1873

SQL injection vulnerability in 101news

SQL injection vulnerability have been found in 101news affecting version 1.0 through the "pagetitle" and "pagedescription" parameters in admin/contactus.php.

CVSS 4.0 · 9.3 Critical EPSS < 1% KEV · Not listed

Vendors

Mayurik

Products

Best Online News Portal

CVE-2025-1870

SQL injection vulnerability in 101news

SQL injection vulnerability have been found in 101news affecting version 1.0 through the "pagedescription" parameter in admin/aboutus.php.

CVSS 4.0 · 9.3 Critical EPSS < 1% KEV · Not listed

Vendors

Mayurik

Products

Best Online News Portal

CVE-2025-1869

SQL injection vulnerability in 101news

SQL injection vulnerability have been found in 101news affecting version 1.0 through the "username" parameter in admin/check_avalability.php.

CVSS 4.0 · 9.3 Critical EPSS < 1% KEV · Not listed

Vendors

Mayurik

Products

Best Online News Portal

CVE-2023-5269

SourceCodester Best Courier Management System GET Parameter parcel_list.php sql injection

A vulnerability was found in SourceCodester Best Courier Management System 1.0. It has been classified as critical. Affected is an unknown function of the file parcel_list.php of the component GET Parameter Handler. The manipulation of the argument id/s leads to sql injection. The exploit has been disclosed to the public and may be used.

CVSS 4.0 · 5.1 Medium EPSS < 1% KEV · Not listed

Vendors

Mayurik

Products

Best Courier Management System

CVE-2025-1598

SourceCodester Best Church Management Software asset_crud.php unrestricted upload

A vulnerability was found in SourceCodester Best Church Management Software 1.0. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the file /admin/app/asset_crud.php. The manipulation of the argument photo1 leads to unrestricted upload. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Mayurik

Products

Best Church Management Software

CVE-2025-1592

SourceCodester Best Employee Management System Add Role Page Role.php cross site scripting

A vulnerability was found in SourceCodester Best Employee Management System 1.0. It has been rated as problematic. Affected by this issue is some unknown functionality of the file /admin/Operations/Role.php of the component Add Role Page. The manipulation of the argument assign_name/description leads to cross site scripting. The attack may be launched remotely.

CVSS 4.0 · 4.8 Medium EPSS < 1% KEV · Not listed

Vendors

Mayurik

Products

Best Employee Management System

CVE-2025-1596

SourceCodester Best Church Management Software fpassword.php sql injection

A vulnerability was found in SourceCodester Best Church Management Software 1.0 and classified as critical. This issue affects some unknown processing of the file /fpassword.php. The manipulation of the argument email leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed

Vendors

Mayurik

Products

Best Church Management Software

CVE-2025-1593

SourceCodester Best Employee Management System Profile Picture unrestricted upload

A vulnerability classified as critical has been found in SourceCodester Best Employee Management System 1.0. This affects an unknown part of the file /_hr_soft/assets/uploadImage/Profile/ of the component Profile Picture Handler. The manipulation leads to unrestricted upload. It is possible to initiate the attack remotely.

CVSS 4.0 · 5.1 Medium EPSS < 1% KEV · Not listed

Vendors

Mayurik

Products

Best Employee Management System

CVE-2025-1597

SourceCodester Best Church Management Software redirect.php cross site scripting

A vulnerability was found in SourceCodester Best Church Management Software 1.0. It has been classified as problematic. Affected is an unknown function of the file /admin/redirect.php. The manipulation of the argument a leads to cross site scripting. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

CVSS 4.0 · 5.1 Medium EPSS < 1% KEV · Not listed

Vendors

Mayurik

Products

Best Church Management Software

CVE-2025-1606

SourceCodester Best Employee Management System backups.php information disclosure

A vulnerability classified as problematic was found in SourceCodester Best Employee Management System 1.0. This vulnerability affects unknown code of the file /admin/backup/backups.php. The manipulation leads to information disclosure. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Mayurik

Products

Best Employee Management System

CVE-2024-3221

SourceCodester PHP Task Management System attendance-info.php sql injection

A vulnerability classified as critical was found in SourceCodester PHP Task Management System 1.0. This vulnerability affects unknown code of the file attendance-info.php. The manipulation of the argument user_id leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. VDB-259066 is the identifier assigned to this vulnerability.

CVSS 3.1 · 6.3 Medium EPSS < 1% KEV · Not listed

Vendors

Mayurik

Products

Php Task Management System

CVE-2025-1599

SourceCodester Best Church Management Software profile_crud.php path traversal

A vulnerability was found in SourceCodester Best Church Management Software 1.0. It has been rated as problematic. Affected by this issue is some unknown functionality of the file /admin/app/profile_crud.php. The manipulation of the argument old_cat_img leads to path traversal: '../filedir'. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

CVSS 4.0 · 5.3 Medium EPSS 1.1% KEV · Not listed

Vendors

Mayurik

Products

Best Church Management Software

CVE-2025-1199

SourceCodester Best Church Management Software role_crud.php sql injection

A vulnerability was found in SourceCodester Best Church Management Software 1.1. It has been classified as critical. This affects an unknown part of the file /admin/app/role_crud.php. The manipulation of the argument id leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Mayurik

Products

Best Church Management Software

CVE-2025-1202

SourceCodester Best Church Management Software edit_slider.php sql injection

A vulnerability classified as critical has been found in SourceCodester Best Church Management Software 1.1. Affected is an unknown function of the file /admin/edit_slider.php. The manipulation of the argument id leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Mayurik

Products

Best Church Management Software

CVE-2025-1201

SourceCodester Best Church Management Software profile_crud.php sql injection

A vulnerability was found in SourceCodester Best Church Management Software 1.1. It has been rated as critical. This issue affects some unknown processing of the file /admin/app/profile_crud.php. The manipulation leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. Multiple parameters might be affected.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Mayurik

Products

Best Church Management Software

CVE-2024-3225

SourceCodester PHP Task Management System edit-task.php sql injection

A vulnerability was found in SourceCodester PHP Task Management System 1.0 and classified as critical. Affected by this issue is some unknown functionality of the file edit-task.php. The manipulation of the argument task_id leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. VDB-259070 is the identifier assigned to this vulnerability.

CVSS 3.1 · 6.3 Medium EPSS < 1% KEV · Not listed

Vendors

Mayurik

Products

Php Task Management System

CVE-2024-3224

SourceCodester PHP Task Management System task-details.php sql injection

A vulnerability has been found in SourceCodester PHP Task Management System 1.0 and classified as critical. Affected by this vulnerability is an unknown functionality of the file task-details.php. The manipulation of the argument task_id leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-259069 was assigned to this vulnerability.

CVSS 3.1 · 6.3 Medium EPSS < 1% KEV · Not listed

Vendors

Mayurik

Products

Php Task Management System

CVE-2024-2418

SourceCodester Best POS Management System view_order.php sql injection

A vulnerability was found in SourceCodester Best POS Management System 1.0. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the file /view_order.php. The manipulation of the argument id leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-256705 was assigned to this vulnerability.

CVSS 3.1 · 6.3 Medium EPSS < 1% KEV · Not listed

Vendors

Mayurik

Products

Best Pos Management System

CVE-2024-2168

SourceCodester Online Tours & Travels Management System HTTP POST Request expense_category.php sql injection

A vulnerability was found in SourceCodester Online Tours & Travels Management System 1.0. It has been classified as critical. Affected is an unknown function of the file /admin/operations/expense_category.php of the component HTTP POST Request Handler. The manipulation of the argument status leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. VDB-255678 is the identifier assigned to this vulnerability.

CVSS 3.1 · 4.7 Medium EPSS < 1% KEV · Not listed

Vendors

Mayurik

Products

Online Tours \& Travels Management System