Oretnom23 Customer Support System
19 CVEs affecting Oretnom23 Customer Support System. Latest disclosed: 2026-02-18. Critical: 3, High: 7.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2023-49970 | Critical | 9.8 | 2024-03-05 | Customer Support System v1 was discovered to contain a SQL injection vulnerability via the subject parameter at /customer_support/ajax.php?action=save_ticket. |
CVE-2023-49547 | Critical | 9.8 | 2024-03-05 | Customer Support System v1 was discovered to contain a SQL injection vulnerability via the username parameter at /customer_support/ajax.php?action=login. |
CVE-2025-70141 | Critical | 9.4 | 2026-02-18 | SourceCodester Customer Support System 1.0 contains an incorrect access control vulnerability in ajax.php. The AJAX dispatcher does not enforce authentication… |
CVE-2025-40728 | High | 8.8 | 2025-06-16 | SQL injection vulnerability in Customer Support System v1.0. This vulnerability allows an authenticated attacker to retrieve, create, update and delete databas… |
CVE-2023-49978 | High | 8.8 | 2024-03-21 | Incorrect access control in Customer Support System v1 allows non-administrator users to access administrative pages and execute actions reserved for administr… |
CVE-2023-49548 | High | 8.8 | 2024-03-05 | Customer Support System v1 was discovered to contain a SQL injection vulnerability via the lastname parameter at /customer_support/ajax.php?action=save_user. |
CVE-2023-49546 | High | 8.8 | 2024-03-05 | Customer Support System v1 was discovered to contain a SQL injection vulnerability via the email parameter at /customer_support/ajax.php. |
CVE-2023-50070 | High | 8.8 | 2023-12-29 | Sourcecodester Customer Support System 1.0 has multiple SQL injection vulnerabilities in /customer_support/ajax.php?action=save_ticket via department_id, custo… |
CVE-2023-49545 | High | 7.5 | 2024-03-01 | A directory listing vulnerability in Customer Support System v1 allows attackers to list directories and sensitive files within the application without requiri… |
CVE-2023-49968 | High | 7.3 | 2024-03-05 | Customer Support System v1 was discovered to contain a SQL injection vulnerability via the id parameter at /customer_support/manage_department.php. |
CVE-2025-40729 | Medium | 6.1 | 2025-06-16 | Reflected Cross-Site Scripting (XSS) in /customer_support/index.php in Customer Support System v1.0, which allows remote attackers to execute arbitrary code vi… |
CVE-2023-49974 | Medium | 6.1 | 2024-03-06 | A cross-site scripting (XSS) vulnerability in Customer Support System v1 allows attackers to execute arbitrary web scripts or HTML via a crafted payload inject… |
CVE-2023-49973 | Medium | 6.1 | 2024-03-06 | A cross-site scripting (XSS) vulnerability in Customer Support System v1 allows attackers to execute arbitrary web scripts or HTML via a crafted payload inject… |
CVE-2023-49971 | Medium | 6.1 | 2024-03-06 | A cross-site scripting (XSS) vulnerability in Customer Support System v1 allows attackers to execute arbitrary web scripts or HTML via a crafted payload inject… |
CVE-2023-51281 | Medium | 5.4 | 2024-03-07 | Cross Site Scripting vulnerability in Customer Support System v.1.0 allows a remote attacker to escalate privileges via a crafted script firstname, "lastname"… |
CVE-2023-49977 | Medium | 5.4 | 2024-03-06 | A cross-site scripting (XSS) vulnerability in Customer Support System v1 allows attackers to execute arbitrary web scripts or HTML via a crafted payload inject… |
CVE-2023-49976 | Medium | 5.4 | 2024-03-06 | A cross-site scripting (XSS) vulnerability in Customer Support System v1 allows attackers to execute arbitrary web scripts or HTML via a crafted payload inject… |
CVE-2023-49544 | Medium | 4.9 | 2024-03-01 | A local file inclusion (LFI) in Customer Support System v1 allows attackers to include internal PHP files and gain unauthorized acces via manipulation of the p… |
CVE-2023-49969 | Medium | 4.3 | 2024-03-05 | Customer Support System v1 was discovered to contain a SQL injection vulnerability via the id parameter at /customer_support/index.php?page=edit_customer. |