Code-Projects Inventory Management vulnerabilities

6 CVEs affecting Code-Projects Inventory Management, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2024-11250, published 2024-11-15.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2024-11250, published 2024-11-15. Critical severity, CVSS 9.8. EPSS: 0.7% chance of exploitation in the next 30 days. A vulnerability was found in code-projects Inventory Management up to 1.0. It has been declared as critical. This vulnerability affects unknown code of the file /model/editProduct.php. The…
CVE-2024-8710, published 2024-09-12. High severity, CVSS 8.8. EPSS: 0.6% chance of exploitation in the next 30 days. A vulnerability classified as critical was found in code-projects Inventory Management 1.0. Affected by this vulnerability is an unknown functionality of the file /model/viewProduct.php of the…
CVE-2024-8605, published 2024-09-09. Medium severity, CVSS 5.4. EPSS: 0.6% chance of exploitation in the next 30 days. A vulnerability classified as problematic was found in code-projects Inventory Management 1.0. This vulnerability affects unknown code of the file /view/registration.php of the component Registration…
CVE-2023-46580, published 2023-11-14. Medium severity, CVSS 5.4. EPSS: 0.5% chance of exploitation in the next 30 days. Cross-Site Scripting (XSS) vulnerability in Inventory Management V1.0 allows attackers to execute arbitrary code via the pname parameter of the editProduct.php component.
CVE-2023-46581, published 2023-11-14. Medium severity, CVSS 5.5. EPSS: 0.3% chance of exploitation in the next 30 days. SQL injection vulnerability in Inventory Management v.1.0 allows a local attacker to execute arbitrary code via the name, uname and email parameters in the registration.php component.
CVE-2023-46582, published 2023-11-14. High severity, CVSS 7.8. EPSS: 0.3% chance of exploitation in the next 30 days. SQL injection vulnerability in Inventory Management v.1.0 allows a local attacker to execute arbitrary SQL commands via the id paramter in the deleteProduct.php component.