Mini-Inventory-and-Sales-Management-System vulnerabilities

A cross-site scripting (XSS) vulnerability was found in mini-inventory-and-sales-management-system in the Items.php file. Manipulating the itemName argument allows remote attack. The exploit is publicly available.

A SQL injection vulnerability was found in Mini-Inventory-and-Sales-Management-System in the order_by function. Manipulating the orderBy argument allows remote attack. The exploit is public. The project is no longer maintained.

A security flaw has been discovered in Mini-Inventory-and-Sales-Management-System 0.1. The function Transaction::getAll in application/models/Transaction.php is affected. Manipulation of the orderBy/orderFormat arguments results in SQL injection, and the attack can be initiated remotely. The exploit has been publicly released.