CVE-2023-0515

HighCVSS 7.2/10Last modified Jun 17, 2026

Description

A vulnerability was found in SourceCodester Online Tours & Travels Management System 1.0 and classified as critical. This issue affects some unknown processing of the file admin/forget_password.php of the component Parameter Handler. The manipulation of the argument email leads to sql injection. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-219335.

Metrics

CVSS 3.1 7.2/10CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-89

Affected software

Vendor	Product	Versions
SourceCodester	Online Tours & Travels Management System	1.0

References

https://github.com/linmoren/online-tours-travels-management-system/blob/main/admin_forget_password_email.mdExploit, Third Party Advisory
https://vuldb.com/?ctiid.219335Permissions Required, Third Party Advisory, VDB Entry
https://vuldb.com/?id.219335Permissions Required, Third Party Advisory, VDB Entry
https://github.com/linmoren/online-tours-travels-management-system/blob/main/admin_forget_password_email.mdExploit, Third Party Advisory
https://vuldb.com/?ctiid.219335Permissions Required, Third Party Advisory, VDB Entry
https://vuldb.com/?id.219335Permissions Required, Third Party Advisory, VDB Entry

Timeline

Published: Jan 26, 2023
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2023

CVE-2023-05167.2A vulnerability was found in SourceCodester Online Tours & Travels Management System 1.0. It has been classified as critical. Affected is an CVE-2023-05187.5An issue has been discovered in GitLab CE/EE affecting all versions starting from 14.0 before 15.6.7, all versions starting from 15.7 before CVE-2023-05195.4Cross-site Scripting (XSS) - Stored in GitHub repository modoboa/modoboa prior to 2.0.4.CVE-2023-05205.4The RapidExpCart WordPress plugin through 1.0 does not sanitize and escape the url parameter in the rapidexpcart endpoint before storing it CVE-2023-05226.5The Enable/Disable Auto Login when Register WordPress plugin through 1.1.0 does not have CSRF check in place when updating its settings, whi CVE-2023-05236.1An issue has been discovered in GitLab affecting all versions starting from 15.6 before 15.8.5, 15.9 before 15.9.4, and 15.10 before 15.10.1 CVE-2023-05248.8As part of our Security Development Lifecycle, a potential privilege escalation issue was identified internally. This could allow a maliciou CVE-2023-05257.5Weak Encoding for Password vulnerability in Mitsubishi Electric Corporation GOT2000 Series GT27 model versions 01.49.000 and prior, GT25 mod CVE-2023-05265.4The Post Shortcode WordPress plugin through 2.0.9 does not validate and escape some of its shortcode attributes before outputting them back CVE-2023-05276.1A vulnerability was found in PHPGurukul Online Security Guards Hiring System 1.0 and classified as problematic. Affected by this issue is so CVE-2023-05286.3A vulnerability was found in SourceCodester Online Tours & Travels Management System 1.0. It has been classified as critical. This affects a CVE-2023-05296.3A vulnerability was found in SourceCodester Online Tours & Travels Management System 1.0. It has been declared as critical. This vulnerabili