CVE’s

Attendance and Payroll System v1.0 was discovered to contain a SQL injection vulnerability via the component adminposition_delete.php.

Attendance and Payroll System v1.0 was discovered to contain a SQL injection vulnerability via the component adminschedule_delete.php.

Attendance and Payroll System v1.0 was discovered to contain a SQL injection vulnerability via the component adminovertime_delete.php.

A vulnerability, which was classified as critical, was found in SourceCodester Automated Beer Parlour Billing System. This affects an unknown part of the component Login. The manipulation of the argument username leads to sql injection. It is possible to initiate the attack remotely. The associated identifier of this vulnerability is VDB-206247.

Attendance and Payroll System v1.0 was discovered to contain a SQL injection vulnerability via the component adminattendance_delete.php.

Attendance and Payroll System v1.0 was discovered to contain a SQL injection vulnerability via the component adminattendance_delete.php.

Attendance and Payroll System v1.0 was discovered to contain a SQL injection vulnerability via the component admincashadvance_delete.php.

Attendance and Payroll System v1.0 was discovered to contain a SQL injection vulnerability via the component adminemployee_delete.php.

An issue was discovered in the 3CX Phone System Management Console prior to version 18 Update 3 FINAL. An unauthenticated attacker could abuse improperly secured access to arbitrary files on the server, leading to cleartext credential disclosure. Afterwards, the authenticated attacker is able to upload a file that overwrites a 3CX service binary, leading to Remote Code Execution as NT AUTHORITYSYSTEM on Windows installations. Versions prior to version 18, Hotfix 1 Build 18.0.3.461 March 2022, are prone to an additional unauthenticated file system access to C:WindowsSystem32.

Movie Seat Reservation v1 was discovered to contain an unauthenticated file disclosure vulnerability via /index.php?page=home.