CVE-2023-7075

MediumCVSS 6.1/10Last modified Jun 17, 2026

Description

A vulnerability was found in code-projects Point of Sales and Inventory Management System 1.0 and classified as problematic. Affected by this issue is some unknown functionality of the file /main/checkout.php. The manipulation of the argument pt leads to cross site scripting. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. VDB-248846 is the identifier assigned to this vulnerability.

Metrics

CVSS 3.1 6.1/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

Vendor	Product	Versions
code-projects	Point of Sales and Inventory Management System	1.0

References

https://github.com/Glunko/vulnerability/blob/main/Point-of-Sales-And-Inventory-Management-System.mdExploit, Third Party Advisory
https://vuldb.com/?ctiid.248846Permissions Required, Third Party Advisory
https://vuldb.com/?id.248846Third Party Advisory
https://github.com/Glunko/vulnerability/blob/main/Point-of-Sales-And-Inventory-Management-System.mdExploit, Third Party Advisory
https://vuldb.com/?ctiid.248846Permissions Required, Third Party Advisory
https://vuldb.com/?id.248846Third Party Advisory

Timeline

Published: Dec 22, 2023
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2023

CVE-2023-70766.1A vulnerability was found in slawkens MyAAC up to 0.8.13. It has been declared as problematic. This vulnerability affects unknown code of th CVE-2023-70779.8Sharp NEC Displays (P403, P463, P553, P703, P801, X554UN, X464UN, X554UNS, X464UNV, X474HB, X464UNS, X554UNV, X555UNS, X555UNV, X754HB, X554 CVE-2023-70788.1Sending specially crafted HTTP requests to Miniflare's server could result in arbitrary HTTP and WebSocket requests being sent from the serv CVE-2023-70795.7Sending specially crafted HTTP requests and inspector messages to Wrangler's dev server could result in any file on the user's computer bein CVE-2023-70808.0The V8 inspector intentionally allows arbitrary code execution within the Workers sandbox for debugging. wrangler dev would previously start CVE-2023-70819.8Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in POSTAHSİL Online Payment System allows CVE-2023-70827.2The Import any XML or CSV File to WordPress plugin before 3.7.3 accepts all zip files and automatically extracts the zip file into a publicl CVE-2023-70835.4The Voting Record WordPress plugin through 2.0 does not have CSRF check in some places, and is missing sanitisation as well as escaping, whi CVE-2023-70845.4The Voting Record WordPress plugin through 2.0 is missing sanitisation as well as escaping, which could allow any authenticated users, such CVE-2023-70855.4The Scalable Vector Graphics (SVG) WordPress plugin through 3.4 does not sanitize uploaded SVG files, which could allow users with a role as CVE-2023-70865.4The SVG Uploads Support WordPress plugin through 2.1.1 does not sanitize uploaded SVG files, which could allow users with a role as low as A CVE-2023-70885.4The Add SVG Support for Media Uploader | inventivo WordPress plugin through 1.0.5 does not sanitize uploaded SVG files, which could allow us