Customer Support System (Oretnom23) - vulnerabilities (CVEs)
19 CVEs, 0 in the last 30 days, 1 known versions, newest CVE from 2026-02-18. Vendor: Oretnom23.
CVEs of Customer Support System
- CVE-2025-70141 - CVSS 9.4 (critical), 2026-02-18: SourceCodester Customer Support System 1.0 contains an incorrect access control vulnerability in ajax.php. The AJAX dispatcher does not enforce authentication…
- CVE-2025-40728 - CVSS 8.8 (high), 2025-06-16: SQL injection vulnerability in Customer Support System v1.0. This vulnerability allows an authenticated attacker to retrieve, create, update and delete…
- CVE-2025-40729 - CVSS 6.1 (medium), 2025-06-16: Reflected Cross-Site Scripting (XSS) in /customer_support/index.php in Customer Support System v1.0, which allows remote attackers to execute arbitrary code…
- CVE-2023-49978 - CVSS 8.8 (high), 2024-03-21: Incorrect access control in Customer Support System v1 allows non-administrator users to access administrative pages and execute actions reserved for…
- CVE-2023-51281 - CVSS 5.4 (medium), 2024-03-07: Cross Site Scripting vulnerability in Customer Support System v.1.0 allows a remote attacker to escalate privileges via a crafted script firstname,…
- CVE-2023-49977 - CVSS 5.4 (medium), 2024-03-06: A cross-site scripting (XSS) vulnerability in Customer Support System v1 allows attackers to execute arbitrary web scripts or HTML via a crafted payload…
- CVE-2023-49971 - CVSS 6.1 (medium), 2024-03-06: A cross-site scripting (XSS) vulnerability in Customer Support System v1 allows attackers to execute arbitrary web scripts or HTML via a crafted payload…
- CVE-2023-49976 - CVSS 5.4 (medium), 2024-03-06: A cross-site scripting (XSS) vulnerability in Customer Support System v1 allows attackers to execute arbitrary web scripts or HTML via a crafted payload…
- CVE-2023-49974 - CVSS 6.1 (medium), 2024-03-06: A cross-site scripting (XSS) vulnerability in Customer Support System v1 allows attackers to execute arbitrary web scripts or HTML via a crafted payload…
- CVE-2023-49973 - CVSS 6.1 (medium), 2024-03-06: A cross-site scripting (XSS) vulnerability in Customer Support System v1 allows attackers to execute arbitrary web scripts or HTML via a crafted payload…
- CVE-2023-49546 - CVSS 8.8 (high), 2024-03-05: Customer Support System v1 was discovered to contain a SQL injection vulnerability via the email parameter at /customer_support/ajax.php.
- CVE-2023-49968 - CVSS 7.3 (high), 2024-03-05: Customer Support System v1 was discovered to contain a SQL injection vulnerability via the id parameter at /customer_support/manage_department.php.
- CVE-2023-49548 - CVSS 8.8 (high), 2024-03-05: Customer Support System v1 was discovered to contain a SQL injection vulnerability via the lastname parameter at /customer_support/ajax.php?action=save_user.
- CVE-2023-49970 - CVSS 9.8 (critical), 2024-03-05: Customer Support System v1 was discovered to contain a SQL injection vulnerability via the subject parameter at /customer_support/ajax.php?action=save_ticket.
- CVE-2023-49547 - CVSS 9.8 (critical), 2024-03-05: Customer Support System v1 was discovered to contain a SQL injection vulnerability via the username parameter at /customer_support/ajax.php?action=login.
- CVE-2023-49969 - CVSS 4.3 (medium), 2024-03-05: Customer Support System v1 was discovered to contain a SQL injection vulnerability via the id parameter at /customer_support/index.php?page=edit_customer.
- CVE-2023-49545 - CVSS 7.5 (high), 2024-03-01: A directory listing vulnerability in Customer Support System v1 allows attackers to list directories and sensitive files within the application without…
- CVE-2023-49544 - CVSS 4.9 (medium), 2024-03-01: A local file inclusion (LFI) in Customer Support System v1 allows attackers to include internal PHP files and gain unauthorized acces via manipulation of the…
- CVE-2023-50070 - CVSS 8.8 (high), 2023-12-29: Sourcecodester Customer Support System 1.0 has multiple SQL injection vulnerabilities in /customer_support/ajax.php?action=save_ticket via department_id,…
