CVE-2023-26774

HighCVSS 7.5/10Last modified Jun 17, 2026

Description

An issue found in Sales Tracker Management System v.1.0 allows a remote attacker to access sensitive information via sales.php component of the admin/reports endpoint.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

https://packetstormsecurity.com/files/171692/Sales-Tracker-Management-System-1.0-Insecure-Direct-Object-Reference.htmlThird Party Advisory, VDB Entry
https://twitter.com/retrymp3Third Party Advisory
https://www.sourcecodester.com/download-code?nid=16061&title=Sales+Tracker+Management+System+using+PHP+Free+Source+CodeProduct
https://www.sourcecodester.com/php/16061/sales-tracker-management-system-using-php-free-source-code.htmlProduct
https://packetstormsecurity.com/files/171692/Sales-Tracker-Management-System-1.0-Insecure-Direct-Object-Reference.htmlThird Party Advisory, VDB Entry
https://twitter.com/retrymp3Third Party Advisory
https://www.sourcecodester.com/download-code?nid=16061&title=Sales+Tracker+Management+System+using+PHP+Free+Source+CodeProduct
https://www.sourcecodester.com/php/16061/sales-tracker-management-system-using-php-free-source-code.htmlProduct

Timeline

Published: Apr 10, 2023
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2023

CVE-2023-267757.8File Upload vulnerability found in Monitorr v.1.7.6 allows a remote attacker t oexecute arbitrary code via a crafted file upload to the asse CVE-2023-267766.1Cross Site Scripting vulnerability found in Monitorr v.1.7.6 allows a remote attacker to execute arbitrary code via the title parameter of t CVE-2023-267776.1Cross Site Scripting vulnerability found in : louislam Uptime Kuma v.1.19.6 and before allows a remote attacker to execute arbitrary command CVE-2023-267799.8CleverStupidDog yf-exam v 1.8.0 is vulnerable to Deserialization which can lead to remote code execution (RCE).CVE-2023-26785.4A vulnerability has been found in SourceCodester File Tracker Manager System 1.0 and classified as problematic. This vulnerability affects u CVE-2023-267809.8CleverStupidDog yf-exam v 1.8.0 is vulnerable to SQL Injection.CVE-2023-267819.8SQL injection vulnerability in mccms 2.6 allows remote attackers to run arbitrary SQL commands via Author Center ->Reader Comments ->Search.CVE-2023-267826.5An issue discovered in mccms 2.6.1 allows remote attackers to cause a denial of service via Backend management interface ->System Configurat CVE-2023-267849.8SQL Injection vulnerability found in Kirin Fortress Machine v.1.7-2020-0610 allows attackers to execute arbitrary code via the /admin.php?co CVE-2023-267859.8MariaDB v10.5 was discovered to contain a remote code execution (RCE) vulnerability via UDF Code in a Shared Object File, followed by a "cre CVE-2023-267886.1Veritas Appliance v4.1.0.1 is affected by Host Header Injection attacks. HTTP host header can be manipulated and cause the application to be CVE-2023-267896.1Veritas NetBackUp OpsCenter Version 9.1.0.1 is vulnerable to Reflected Cross-site scripting (XSS). The Web App fails to adequately sanitize