Oretnom23 vulnerabilities
765 vulnerabilities
Known vulnerabilities in Oretnom23 products, newest first, with CVSS severity, EPSS, KEV listings and ransomware use, across 114 products.
Products
50 of 114- Online Computer And Laptop Store32 vulnerabilities
- Computer Laboratory Management System30 vulnerabilities
- Human Resource Management System29 vulnerabilities
- Online Eyewear Shop29 vulnerabilities
- Online Food Ordering System29 vulnerabilities
- Clinic\'S Patient Management System27 vulnerabilities
- Lost And Found Information System27 vulnerabilities
- Customer Support System19 vulnerabilities
- Food Ordering Management System17 vulnerabilities
- Simple Online Bidding System17 vulnerabilities
- Ac Repair And Services System16 vulnerabilities
- Employee And Visitor Gate Pass Logging System15 vulnerabilities
- Employee Task Management System15 vulnerabilities
- Service Provider Management System15 vulnerabilities
- Simple Customer Relationship Management System15 vulnerabilities
- Student Study Center Desk Management System15 vulnerabilities
- Simple Student Attendance System14 vulnerabilities
- Online Car Wash Booking System13 vulnerabilities
- Simple Cold Storage Management System13 vulnerabilities
- Car Driving School Management System12 vulnerabilities
- Simple Realtime Quiz System12 vulnerabilities
- Establishment Billing Management System11 vulnerabilities
- Student Grading System11 vulnerabilities
- Lot Reservation Management System9 vulnerabilities
- Online Mobile Store Management System9 vulnerabilities
- Pharmacy Point Of Sale System9 vulnerabilities
- Simple Online Men\'S Salon Management System8 vulnerabilities
- Stock Management System8 vulnerabilities
- Tracking Monitoring Management System8 vulnerabilities
- Apartment Visitor Management System7 vulnerabilities
- Event Registration System7 vulnerabilities
- Online Id Generator System7 vulnerabilities
- Online Medicine Ordering System7 vulnerabilities
- School Fees Management System7 vulnerabilities
- Simple Company Website7 vulnerabilities
- Simple Subscription Website7 vulnerabilities
- Clinic Queuing System6 vulnerabilities
- Medicine Tracker System6 vulnerabilities
- Music Gallery Site6 vulnerabilities
- Online Bank Management System6 vulnerabilities
- Packers And Movers Management System6 vulnerabilities
- School Fees Payment System6 vulnerabilities
- Banking System5 vulnerabilities
- Cab Management System5 vulnerabilities
- Complaints Report Management System5 vulnerabilities
- Laundry Shop Management System5 vulnerabilities
- Loan Management System5 vulnerabilities
- Online Birth Certificate Management System5 vulnerabilities
- Raffle Draw System5 vulnerabilities
- Railway Reservation System5 vulnerabilities
CVE-2021-40247oretnom23budget_and_expense_tracker_system
EPSS score2.59%
SQL injection vulnerability in Sourcecodester Budget and Expense Tracker System v1 by oretnom23, allows attackers to execute arbitrary SQL commands via the username field.CVE-2021-40596oretnom23online_learning_systemEPSS score1.25%
SQL injection vulnerability in Login.php in sourcecodester Online Learning System v2 by oretnom23, allows attackers to execute arbitrary SQL commands via the faculty_id parameter.CVE-2021-41434oretnom23expense_management_systemEPSS score0.72%
A stored Cross-Site Scripting (XSS) vulnerability exists in version 1.0 of the Expense Management System application that allows for arbitrary execution of JavaScript commands through index.php.CVE-2021-41659oretnom23banking_systemEPSS score1.25%
SQL injection vulnerability in Sourcecodester Banking System v1 by oretnom23, allows attackers to execute arbitrary SQL commands via the username or password field.CVE-2021-41644oretnom23online_food_ordering_systemEPSS score2.50%
Remote Code Exection (RCE) vulnerability exists in Sourcecodester Online Food Ordering System 2.0 via a maliciously crafted PHP file that bypasses the image upload filters.CVE-2021-41645oretnom23budget_and_expense_tracker_systemEPSS score3.20%
Remote Code Execution (RCE) vulnerability exists in Sourcecodester Budget and Expense Tracker System 1.0 that allows a remote malicious user to inject arbitrary code via the image upload field. .CVE-2021-42580oretnom23online_learning_systemEPSS score9.98%
Sourcecodester Online Learning System 2.0 is vunlerable to sql injection authentication bypass in admin login file (/admin/login.php) and authenticated file upload in (Master.php) file , we can craft these two vunlerablities to get unauthenticated remote command execution.CVE-2021-43140oretnom23simple_subscription_websiteEPSS score4.73%
SQL Injection vulnerability exists in Sourcecodester. Simple Subscription Website 1.0. via the login.CVE-2021-43141oretnom23simple_subscription_websiteEPSS score1.44%
Cross Site Scripting (XSS) vulnerability exists in Sourcecodester Simple Subscription Website 1.0 via the id parameter in plan_application.CVE-2021-46200oretnom23simple_music_cloud_community_systemEPSS score1.56%
An SQL Injection vulnerability exists in Sourcecodester Simple Music Clour Community System 1.0 via the email parameter in /music/ajax.php.CVE-2021-46309oretnom23employee_and_visitor_gate_pass_logging_systemEPSS score1.56%
An SQL Injection vulnerability exists in Sourcecodester Employee and Visitor Gate Pass Logging System 1.0 via the username parameter.CVE-2021-44600oretnom23simple_online_men\'s_salon_management_systemEPSS score1.30%
The password parameter on Simple Online Mens Salon Management System (MSMS) 1.0 appears to be vulnerable to SQL injection attacks through the password parameter. The predictive tests of this application interacted with that domain, indicating that the injected SQL query was executed. The attacker can retrieve all authentication and information about the users of this system.CVE-2021-44653oretnom23online_magazine_management_systemEPSS score5.97%
Online Magazine Management System 1.0 contains a SQL injection authentication bypass vulnerability. The Admin panel authentication can be bypassed due to SQL injection vulnerability in the login form allowing attacker to gain access as admin to the application.CVE-2021-45252oretnom23simple_forum\/discussion_systemEPSS score1.28%
Multiple SQL injection vulnerabilities are found on Simple Forum-Discussion System 1.0 For example on three applications which are manage_topic.php, manage_user.php, and ajax.php. The attacker can be retrieving all information from the database of this system by using this vulnerability.CVE-2021-45435oretnom23simple_cold_storage_management_systemEPSS score1.10%
An SQL Injection vulnerability exists in Sourcecodester Simple Cold Storage Management System using PHP/OOP 1.0 via the username field in login.php.CVE-2025-63891oretnom23simple_online_book_store_systemEPSS score0.48%
Information Disclosure in web-accessible backup file in SourceCodester Simple Online Book Store System allows a remote unauthenticated attacker to disclose full database contents (including schema and credential hashes) via an unauthenticated HTTP GET request to /obs/database/obs_db.sql.CVE-2025-40729customer support systemcustomer support system+1EPSS score0.40%
Reflected Cross-Site Scripting (XSS) in /customer_support/index.php in Customer Support System v1.0, which allows remote attackers to execute arbitrary code via the page parameter.CVE-2025-40685human resource management systemhuman resource management system+1EPSS score0.18%
Reflected Cross-Site Scripting (XSS) in Human Resource Management System version 1.0. This vulnerability could allow an attacker to execute JavaScript code in the victim's browser by sending a malicious URL through the 'searcstate' parameter in/state.php.CVE-2025-40728customer support systemcustomer support system+1EPSS score0.52%
SQL injection vulnerability in Customer Support System v1.0. This vulnerability allows an authenticated attacker to retrieve, create, update and delete databases via the id parameter in the /customer_support/manage_user.php endpoint.CVE-2025-40684human resource management systemhuman resource management system+1EPSS score0.18%
Reflected Cross-Site Scripting (XSS) in Human Resource Management System version 1.0. This vulnerability could allow an attacker to execute JavaScript code in the victim's browser by sending a malicious URL through the 'searccountry' parameter in/country.php.