CVE-2026-114577 is a medium severity SQL injection vulnerability in the oretnom23 php-travel-agency-system. It affects the admin/insert.php file's Insertion Handler component, where manipulation of several parameters can lead to SQL injection. The vulnerability can be exploited remotely without authentication. Although the issue was reported early, the project has not yet responded or issued a fix. Public exploit code is available, increasing the risk of exploitation.
A weakness has been identified in oretnom23 php-travel-agency-system. This issue affects some unknown processing of the file admin/update.php. This manipulation of the argument action/full_name/visa_no/hiden/title/description/page_id/user causes sql injection. The attack may be initiated remotely. The exploit has been made available to the public and could be used for attacks. This product uses a rolling release model to deliver continuous updates. As a result, specific version information for affected or updated releases is not available. The project was informed of the problem early through an issue report but has not responded yet.
CVE-2026-114440 is a SQL injection vulnerability in the oretnom23 php-travel-agency-system affecting the admin/delete.php file. The vulnerability arises from manipulation of several parameters including costomer_id, ticket_id, payment_id, id, document_id, salary_id, emp_id, and user_id. The attack can be performed remotely without authentication. The product uses continuous delivery with rolling releases, so no specific affected or fixed versions are identified. The vendor has been informed but has not responded or issued a fix. The vulnerability has a CVSS 4.0 score of 6.9, indicating medium severity. Exploit code is publicly available, but no known exploitation in the wild has been reported.
CVE-2026-114439 is a medium severity vulnerability in the oretnom23 php-travel-agency-system affecting the admin/session.php file's Session Handler component. It allows remote attackers to bypass authentication by manipulating the user_id argument. The vulnerability has been publicly disclosed, but no patch or version details are available due to the product's rolling release model. The vendor has not yet responded to the issue report.
A vulnerability has been found in oretnom23 file-management-system-php up to 2e3c1ebe60f121e8df4fb3f544f0e9591d9a01e4. This vulnerability affects the function delete_folder of the file ajax.php of the component AJAX Handler. The manipulation of the argument ID leads to missing authentication. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. Continious delivery with rolling releases is used by this product. Therefore, no version details of affected nor updated releases are available. The project was informed of the problem early through an issue report but has not responded yet.
CVE-2026-114259 is a medium severity vulnerability in the oretnom23 file-management-system-php affecting the save_files function in admin_class.php. It allows remote attackers to perform unrestricted file uploads by manipulating the Upload argument. The vulnerability has been publicly disclosed with exploit code available. The project uses rolling releases, so specific affected and fixed versions are not provided, and no vendor response or patch is currently available.
CVE-2026-114258 is a medium severity SQL injection vulnerability in the oretnom23 file-management-system-php affecting the files.php component. The flaw arises from manipulation of the fid/id argument, allowing remote attackers to perform SQL injection. The product uses a rolling release model, so no specific affected or fixed versions are available. The vulnerability is publicly known, but no patch or vendor response has been provided yet.
A security vulnerability has been detected in oretnom23 file-management-system-php up to 2e3c1ebe60f121e8df4fb3f544f0e9591d9a01e4. Affected by this vulnerability is the function readfile of the file download.php of the component File Download. Such manipulation of the argument ID leads to sql injection. The attack may be performed from remote. The exploit has been disclosed publicly and may be used. This product utilizes a rolling release system for continuous delivery, and as such, version information for affected or updated releases is not disclosed. The project was informed of the problem early through an issue report but has not responded yet.
CVE-2026-114256 is a SQL injection vulnerability in the oretnom23 file-management-system-php affecting the Folder Management component's admin_class.php file. The vulnerability arises from improper handling of arguments such as name, parent_id, id, type, folder_id, and description in functions like save_folder, delete_folder, delete_file, file_rename, and save_files. This flaw allows remote attackers to execute SQL injection attacks. The project uses a rolling release strategy, so specific affected or fixed versions are not provided. The issue was reported early but has not yet received a response from the project. Public exploit code is available. The CVSS 4.0 base score is 6.9, indicating a medium severity.
CVE-2026-114255 is a medium severity SQL injection vulnerability in the oretnom23 file-management-system-php. It affects the save_user function in the admin_class.php file within the User Account Management component. The vulnerability arises from improper handling of the name, username, password, type, and id arguments, allowing remote attackers to perform SQL injection. The product uses a rolling release model, so specific affected or fixed versions are not available. The issue was reported early to the project, but no response or patch has been provided yet. Public exploit code is available, increasing the risk of exploitation.
A vulnerability was identified in oretnom23 file-management-system-php up to 2e3c1ebe60f121e8df4fb3f544f0e9591d9a01e4. This affects the function Login of the file admin_class.php. The manipulation of the argument username/password leads to sql injection. Remote exploitation of the attack is possible. The exploit is publicly available and might be used. This product follows a rolling release approach for continuous delivery, so version details for affected or updated releases are not provided. The project was informed of the problem early through an issue report but has not responded yet.
CVE-2026-114253 is a file inclusion vulnerability in the oretnom23 file-management-system-php affecting the include function in index.php. Manipulating the 'page' argument can lead to remote file inclusion. The vulnerability has been publicly disclosed, but no patch or version details are available due to the product's rolling release model. The vendor has been informed but has not responded yet.
Automotive Shop Management System version 1.0 is affected by a SQL injection vulnerability. This vulnerability allows an attacker to manipulate SQL queries executed by the application, potentially leading to unauthorized data access or modification.
POMS oretnom23v1.0 contains SQL injection vulnerabilities that allow attackers to manipulate backend SQL queries, potentially leading to unauthorized data access or modification. No specific affected versions or patches are identified.