Phpgurukul Client Management System vulnerabilities

8 CVEs affecting Phpgurukul Client Management System, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2024-51209, published 2024-11-20.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2024-30985, published 2024-04-17. Critical severity, CVSS 9.8. EPSS: 0.7% chance of exploitation in the next 30 days. SQL Injection vulnerability in "B/W Dates Reports" page in phpgurukul Client Management System using PHP & MySQL 1.1 allows attacker to execute arbitrary SQL commands via "todate" and "fromdate"…
CVE-2024-30990, published 2024-04-17. Critical severity, CVSS 9.8. EPSS: 0.6% chance of exploitation in the next 30 days. SQL Injection vulnerability in the "Invoices" page in phpgurukul Client Management System using PHP & MySQL 1.1 allows attacker to execute arbitrary SQL commands via "searchdata" parameter.
CVE-2024-30988, published 2024-04-17. Medium severity, CVSS 6.8. EPSS: 0.6% chance of exploitation in the next 30 days. Cross Site Scripting vulnerability in /search-invoices.php of phpgurukul Client Management System using PHP & MySQL 1.1 allows attackers to execute arbitrary code and obtain sensitive information via…
CVE-2024-30987, published 2024-04-17. Medium severity, CVSS 6.8. EPSS: 0.6% chance of exploitation in the next 30 days. Cross Site Scripting vulnerability in /bwdates-reports-ds.php of phpgurukul Client Management System using PHP & MySQL 1.1 allows attackers to execute arbitrary code and obtain sensitive information…
CVE-2024-48570, published 2024-10-22. High severity, CVSS 7.5. EPSS: 0.5% chance of exploitation in the next 30 days. Client Management System 1.0 was discovered to contain a SQL injection vulnerability via the Between Dates Reports parameter at /admin/bwdates-reports-ds.php.
CVE-2024-30989, published 2024-04-17. Medium severity, CVSS 5.4. EPSS: 0.4% chance of exploitation in the next 30 days. Cross Site Scripting vulnerability in /edit-client-details.php of phpgurukul Client Management System using PHP & MySQL 1.1 allows attackers to execute arbitrary code via the "cname", "comname",…
CVE-2024-30986, published 2024-04-17. Medium severity, CVSS 6.5. EPSS: 0.4% chance of exploitation in the next 30 days. Cross Site Scripting vulnerability in /edit-services-details.php of phpgurukul Client Management System using PHP & MySQL 1.1 allows attackers to execute arbitrary code and via "price" and "sname"…
CVE-2024-51209, published 2024-11-20. Medium severity, CVSS 5.4. EPSS: 0.3% chance of exploitation in the next 30 days. Cross-Site Scripting (XSS) vulnerabilities in Anuj Kumar's Client Management System Version 1.2 allow local attackers to inject arbitrary web script or HTML via the search input field parameter to…