ORETNOM23 Expense Management System vulnerabilities

4 CVEs affecting ORETNOM23 Expense Management System, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2024-1031, published 2024-01-30.

More from ORETNOM23.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

• CVE-2022-36754, published 2022-09-02. High severity, CVSS 7.2. EPSS: 0.9% chance of exploitation in the next 30 days. Expense Management System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /Home/debit_credit_p.
• CVE-2021-41434, published 2022-09-28. Medium severity, CVSS 5.4. EPSS: 0.7% chance of exploitation in the next 30 days. A stored Cross-Site Scripting (XSS) vulnerability exists in version 1.0 of the Expense Management System application that allows for arbitrary execution of JavaScript commands through index.php.
• CVE-2024-1031, published 2024-01-30. Medium severity, CVSS 6.1. EPSS: 0.4% chance of exploitation in the next 30 days. A vulnerability was found in CodeAstro Expense Management System 1.0. It has been declared as problematic. This vulnerability affects unknown code of the file templates/5-Add-Expenses.php of the…
• CVE-2023-44824, published 2023-10-17. High severity, CVSS 7.8. EPSS: 0.3% chance of exploitation in the next 30 days. An issue in Expense Management System v.1.0 allows a local attacker to execute arbitrary code via a crafted file uploaded to the sign-up.php component.