ORETNOM23 Packers And Movers Management System vulnerabilities

6 CVEs affecting ORETNOM23 Packers And Movers Management System, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2024-57523, published 2025-02-06.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2023-46956, published 2023-11-30. High severity, CVSS 7.2. EPSS: 1.2% chance of exploitation in the next 30 days. SQL injection vulnerability in Packers and Movers Management System v.1.0 allows a remote attacker to execute arbitrary code via crafted payload to the /mpms/admin/?page=user/manage_user&id file.
CVE-2024-57522, published 2025-02-03. Medium severity, CVSS 6.4. EPSS: 1% chance of exploitation in the next 30 days. SourceCodester Packers and Movers Management System v1.0 is vulnerable to Cross Site Scripting (XSS) in Users.php. An attacker can inject a malicious script into the username or name field during…
CVE-2023-30415, published 2023-09-28. Critical severity, CVSS 9.8. EPSS: 1% chance of exploitation in the next 30 days. Sourcecodester Packers and Movers Management System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /inquiries/view_inquiry.php.
CVE-2024-48427, published 2024-10-24. High severity, CVSS 8.8. EPSS: 0.9% chance of exploitation in the next 30 days. A SQL injection vulnerability in Sourcecodester Packers and Movers Management System v1.0 allows remote authenticated users to execute arbitrary SQL commands via the id parameter in…
CVE-2023-46435, published 2023-10-26. Critical severity, CVSS 9.8. EPSS: 0.6% chance of exploitation in the next 30 days. Sourcecodester Packers and Movers Management System v1.0 is vulnerable to SQL Injection via mpms/?p=services/view_service&id.
CVE-2024-57523, published 2025-02-06. Medium severity, CVSS 4.5. EPSS: 0.5% chance of exploitation in the next 30 days. Cross Site Request Forgery (CSRF) in Users.php in SourceCodester Packers and Movers Management System 1.0 allows attackers to create unauthorized admin accounts via crafted requests sent to an…