CVE-2024-1269

MediumCVSS 6.1/10Last modified Jun 17, 2026

Description

A vulnerability has been found in SourceCodester Product Management System 1.0 and classified as problematic. This vulnerability affects unknown code of the file /supplier.php. The manipulation of the argument supplier_name/supplier_contact leads to cross site scripting. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-253012.

Metrics

CVSS 3.1 6.1/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

Vendor	Product	Versions
SourceCodester	Product Management System	1.0

References

https://github.com/PrecursorYork/Product-Management-System-Using-PHP-and-MySQL-Reflected-XSS-POC/blob/main/README.mdExploit, Third Party Advisory
https://vuldb.com/?ctiid.253012Permissions Required, Third Party Advisory, VDB Entry
https://vuldb.com/?id.253012Permissions Required, Third Party Advisory, VDB Entry
https://github.com/PrecursorYork/Product-Management-System-Using-PHP-and-MySQL-Reflected-XSS-POC/blob/main/README.mdExploit, Third Party Advisory
https://vuldb.com/?ctiid.253012Permissions Required, Third Party Advisory, VDB Entry
https://vuldb.com/?id.253012Permissions Required, Third Party Advisory, VDB Entry

Timeline

Published: Feb 7, 2024
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2024

CVE-2024-126928.8Type Confusion in V8 in Google Chrome prior to 131.0.6778.204 allowed a remote attacker to potentially exploit heap corruption via a crafted CVE-2024-126938.8Out of bounds memory access in V8 in Google Chrome prior to 131.0.6778.204 allowed a remote attacker to execute arbitrary code inside a sand CVE-2024-126948.8Use after free in Compositing in Google Chrome prior to 131.0.6778.204 allowed a remote attacker to potentially exploit heap corruption via CVE-2024-126958.8Out of bounds write in V8 in Google Chrome prior to 131.0.6778.204 allowed a remote attacker to execute arbitrary code inside a sandbox via CVE-2024-126966.4The Picture Gallery – Frontend Image Uploads, AJAX Photo List plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plug CVE-2024-126976.4The real.Kit plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all versions up to, and including, 5.1.1 due to insufficie CVE-2024-126986.5An incomplete fix for ose-olm-catalogd-container was issued for the Rapid Reset Vulnerability (CVE-2023-39325/CVE-2023-44487) where only una CVE-2024-126996.4The Service Box plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all versions up to, and including, 1.9 due to insuffici CVE-2024-127008.8There is an unrestricted file upload vulnerability where it is possible for an authenticated user (low privileged) to upload an jsp shell an CVE-2024-127016.1The WP Smart Import : Import any XML File to WordPress plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘ page’ CVE-2024-127037.8CWE-502: Deserialization of untrusted data vulnerability exists that could lead to loss of confidentiality, integrity and potential remote c CVE-2024-127047.5A vulnerability in the LangChainLLM class of the run-llama/llama_index repository, version v0.12.5, allows for a Denial of Service (DoS) att