Oretnom23
Oretnom23 Customer Support System: vulnerabilidades y CVE
Oretnom23 Customer Support System tiene 19 vulnerabilidades publicadas, 1 de ellas en los últimos 12 meses. 3 son críticas y 0 figuran en el catálogo de explotación activa de CISA.
CVE19
Últimos 12 meses1
Críticas3
Explotadas activamente0
Todas las vulnerabilidades en el catálogo →⭐ Seguir esta tecnología
Últimas vulnerabilidades
| CVE | Severidad | EPSS | Explotación activa | Publicada | Descripción |
|---|---|---|---|---|---|
| CVE-2025-70141 | Crítica (9.4) | 0.69% | — | 18 feb 2026 | SourceCodester Customer Support System 1.0 contains an incorrect access control vulnerability in ajax.php. The AJAX dispatcher does not enforce authentication or authorization before invoking administrative methods in… |
| CVE-2025-40729 | Media (4.8) | 0.39% | — | 16 jun 2025 | Reflected Cross-Site Scripting (XSS) in /customer_support/index.php in Customer Support System v1.0, which allows remote attackers to execute arbitrary code via the page parameter. |
| CVE-2025-40728 | Alta (8.7) | 0.50% | — | 16 jun 2025 | SQL injection vulnerability in Customer Support System v1.0. This vulnerability allows an authenticated attacker to retrieve, create, update and delete databases via the id parameter in the… |
| CVE-2023-49978 | Alta (8.8) | 0.83% | — | 21 mar 2024 | Incorrect access control in Customer Support System v1 allows non-administrator users to access administrative pages and execute actions reserved for administrators. |
| CVE-2023-51281 | Media (5.4) | 0.48% | — | 7 mar 2024 | Cross Site Scripting vulnerability in Customer Support System v.1.0 allows a remote attacker to escalate privileges via a crafted script firstname, "lastname", "middlename", "contact" and address parameters. |
| CVE-2023-49977 | Media (5.4) | 0.45% | — | 6 mar 2024 | A cross-site scripting (XSS) vulnerability in Customer Support System v1 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the address parameter at… |
| CVE-2023-49976 | Media (5.4) | 0.47% | — | 6 mar 2024 | A cross-site scripting (XSS) vulnerability in Customer Support System v1 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the subject parameter at… |
| CVE-2023-49974 | Media (6.1) | 0.45% | — | 6 mar 2024 | A cross-site scripting (XSS) vulnerability in Customer Support System v1 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the contact parameter at… |
| CVE-2023-49973 | Media (6.1) | 0.45% | — | 6 mar 2024 | A cross-site scripting (XSS) vulnerability in Customer Support System v1 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the email parameter at… |
| CVE-2023-49971 | Media (6.1) | 0.43% | — | 6 mar 2024 | A cross-site scripting (XSS) vulnerability in Customer Support System v1 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the firstname parameter at… |
| CVE-2023-49970 | Crítica (9.8) | 0.82% | — | 5 mar 2024 | Customer Support System v1 was discovered to contain a SQL injection vulnerability via the subject parameter at /customer_support/ajax.php?action=save_ticket. |
| CVE-2023-49969 | Media (4.3) | 0.52% | — | 5 mar 2024 | Customer Support System v1 was discovered to contain a SQL injection vulnerability via the id parameter at /customer_support/index.php?page=edit_customer. |
| CVE-2023-49968 | Alta (7.3) | 0.46% | — | 5 mar 2024 | Customer Support System v1 was discovered to contain a SQL injection vulnerability via the id parameter at /customer_support/manage_department.php. |
| CVE-2023-49548 | Alta (8.8) | 0.76% | — | 5 mar 2024 | Customer Support System v1 was discovered to contain a SQL injection vulnerability via the lastname parameter at /customer_support/ajax.php?action=save_user. |
| CVE-2023-49547 | Crítica (9.8) | 1.1% | — | 5 mar 2024 | Customer Support System v1 was discovered to contain a SQL injection vulnerability via the username parameter at /customer_support/ajax.php?action=login. |
| CVE-2023-49546 | Alta (8.8) | 0.76% | — | 5 mar 2024 | Customer Support System v1 was discovered to contain a SQL injection vulnerability via the email parameter at /customer_support/ajax.php. |
| CVE-2023-49545 | Alta (7.5) | 0.77% | — | 1 mar 2024 | A directory listing vulnerability in Customer Support System v1 allows attackers to list directories and sensitive files within the application without requiring authorization. |
| CVE-2023-49544 | Media (4.9) | 0.73% | — | 1 mar 2024 | A local file inclusion (LFI) in Customer Support System v1 allows attackers to include internal PHP files and gain unauthorized acces via manipulation of the page= parameter at /customer_support/index.php. |
| CVE-2023-50070 | Alta (8.8) | 0.79% | — | 29 dic 2023 | Sourcecodester Customer Support System 1.0 has multiple SQL injection vulnerabilities in /customer_support/ajax.php?action=save_ticket via department_id, customer_id, and subject. |
🎯 Cómo se explota (técnicas ATT&CK)
Número de CVE de esta tecnología asignadas a cada técnica de explotación o de impacto principal.
Otros productos de Oretnom23
Online Computer AND Laptop Store · 32Computer Laboratory Management System · 30Online Food Ordering System · 29Human Resource Management System · 29Online Eyewear Shop · 29Clinic's Patient Management System · 27Lost AND Found Information System · 27Food Ordering Management System · 17Simple Online Bidding System · 17AC Repair AND Services System · 16Employee AND Visitor Gate Pass Logging System · 15Employee Task Management System · 15