HighCVSS 8.8
PHP Scripts Mall Professional Service Script has CSRF via admin/general_settingupd.php, as demonstrated by modifying a setting in the user panel.
Product
ordermanagementscript professional service script vulnerabilities
7 published CVES affecting ordermanagementscript professional service script, from public sources (CVE.org, NVD, CISA KEV, FIRST EPSS, OSV).
- Total
- 7
- Critical
- 1
- High
- 1
- Medium
- 5
- Low
- 0
- Unscored
- 0
- CISA KEV
- 0
Latest ordermanagementscript professional service script CVEs
Newest publication first
-
-
MediumCVSS 4.8
PHP Scripts Mall Professional Service Script has XSS via the admin/bannerview.php view parameter.
-
CriticalCVSS 9.8
PHP Scripts Mall Professional Service Script has SQL injection via the admin/review.php id parameter.
-
MediumCVSS 5.3
PHP Scripts Mall Professional Service Script allows remote attackers to obtain sensitive full-path information via a crafted PATH_INFO to service-list/category/.
-
MediumCVSS 5.3
PHP Scripts Mall Professional Service Script has a predicable registration URL, which makes it easier for remote attackers to register with an invalid or spoofed e-mail address.
-
MediumCVSS 4.8
PHP Scripts Mall Professional Service Script has XSS via the admin/general_settingupd.php website_title parameter.
-
MediumCVSS 5.3
PHP Scripts Mall Professional Service Script allows remote attackers to obtain sensitive full-path information via the id parameter to admin/review_userwise.php.
Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.