repository icon
unilogies / bumsys Project repository

An open sources project called Business Management System

Submit a report

FIRST INTERACTION

WITHIN1 DAY

REVIEW

WITHIN5 DAYS

FIX

WITHIN20 DAYS

Application using hardcoded credentials for SMS System
0xdhinu
self closed
Stored XSS in ajax_select2.php
jomc98
duplicate
Medium
SQL Injection in expenses/ajax.php & loan-management/ajax.php
jomc98
High
SQL Injection in ajax_data.php
jomc98
High
•CVE-2023-2832
File Upload Path Validation Error
jomc98
High
•CVE-2023-2554
Unable to indicate negative amount in captial
popcorn94
Medium
Multiple XSS on update funtions with module select options and search form
tht1997
Medium
•CVE-2023-2553
Input validation and money transfer vulnerability with negative number
tht1997
Medium
Default FTP
lambardarr
informative
Medium
Path Traversal in code
hatlesswizard
Medium
SQL Injection
ka1n4t
Critical
SQL Injection in '/module/accounts/ajax.php'
tsarsecurity
High
Full CSRF Bypass
tsarsecurity
High
•CVE-2023-2552
SQL Injection in 'core/ajax/ajax_data.php'
tsarsecurity
High
SQL Injection in 'core/ajax/ajax_data.php'
tsarsecurity
High
•CVE-2023-1361
SQL Injection leads to code execution
jrozner
High
Local file inclusion leading to RCE
jrozner
High
•CVE-2023-2551
UI REDRESSING
ctflearner
High
•CVE-2023-1362
LFI in module invoice-print and print
mukundbhuva
High
Stored XSS in Customer Support
hatlesswizard
Medium
•CVE-2023-0995
Improper Neutralization of Input in paperWidth param During Web Page Generation
mukundbhuva
High
Rxss in msg parameter
mukundbhuva
High
Unauthenticated CSRF to XSS on login page
leorac
Medium
No limit in length of "Account Name" & ”Bank Name” parameter results in DOS atta...
ctflearner
not applicable
No permission user can increase his role to administrator
bruhbey
High
Cookie without “Secure “ and “ HttpOnly ” flag attribute
ctflearner
Medium
Account Takeover via Response Manipulation
sachinh09
self closed
File Upload Type Validation Error
ctflearner
High
•CVE-2023-0455
FTP Port Open
sachinh09
not applicable
Cookie missing the Secure attribute
sachinh09
duplicate
High
Reflected XSS on msg Parameter
mu57f4
High
Reflected XSS on multiple locations and parameters
krizzsk
Medium
Reflected XSS on ID parameter
krizzsk
Medium