https://patchthecve.com/CVEs with upgrade or downgrade fix stepshttps://patchthecve.com/cve/CVE-2025-70141.htmlhttps://patchthecve.com/cve/CVE-2025-70141.htmlTue, 08 Sep 2026 20:17:27 +0000CRITICAL 9.4: SourceCodester Customer Support System 1.0 contains an incorrect access control vulnerability in ajax.php. The AJAX dispatcher does not enforce authentication or authorization before invoking administrative methods in admin_class.php based on the action parameter. An unauthenticated remote attacker https://patchthecve.com/cve/CVE-2025-40729.htmlhttps://patchthecve.com/cve/CVE-2025-40729.htmlWed, 17 Jun 2026 09:22:02 +0000MEDIUM 6.1: Reflected Cross-Site Scripting (XSS) in /customer_support/index.php in Customer Support System v1.0, which allows remote attackers to execute arbitrary code via the page parameter.https://patchthecve.com/cve/CVE-2025-40728.htmlhttps://patchthecve.com/cve/CVE-2025-40728.htmlWed, 17 Jun 2026 09:22:02 +0000HIGH 8.8: SQL injection vulnerability in Customer Support System v1.0. This vulnerability allows an authenticated attacker to retrieve, create, update and delete databases via the id parameter in the /customer_support/manage_user.php endpoint.https://patchthecve.com/cve/CVE-2023-49978.htmlhttps://patchthecve.com/cve/CVE-2023-49978.htmlWed, 17 Jun 2026 06:36:49 +0000HIGH 8.8: Incorrect access control in Customer Support System v1 allows non-administrator users to access administrative pages and execute actions reserved for administrators.https://patchthecve.com/cve/CVE-2023-51281.htmlhttps://patchthecve.com/cve/CVE-2023-51281.htmlWed, 17 Jun 2026 06:40:38 +0000MEDIUM 5.4: Cross Site Scripting vulnerability in Customer Support System v.1.0 allows a remote attacker to escalate privileges via a crafted script firstname, "lastname", "middlename", "contact" and address parameters.https://patchthecve.com/cve/CVE-2023-49977.htmlhttps://patchthecve.com/cve/CVE-2023-49977.htmlWed, 17 Jun 2026 06:36:49 +0000MEDIUM 5.4: A cross-site scripting (XSS) vulnerability in Customer Support System v1 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the address parameter at /customer_support/index.php?page=new_customer.https://patchthecve.com/cve/CVE-2023-49976.htmlhttps://patchthecve.com/cve/CVE-2023-49976.htmlWed, 17 Jun 2026 06:36:49 +0000MEDIUM 5.4: A cross-site scripting (XSS) vulnerability in Customer Support System v1 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the subject parameter at /customer_support/index.php?page=new_ticket.https://patchthecve.com/cve/CVE-2023-49974.htmlhttps://patchthecve.com/cve/CVE-2023-49974.htmlWed, 17 Jun 2026 06:36:49 +0000MEDIUM 6.1: A cross-site scripting (XSS) vulnerability in Customer Support System v1 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the contact parameter at /customer_support/index.php?page=customer_list.https://patchthecve.com/cve/CVE-2023-49973.htmlhttps://patchthecve.com/cve/CVE-2023-49973.htmlWed, 17 Jun 2026 06:36:48 +0000MEDIUM 6.1: A cross-site scripting (XSS) vulnerability in Customer Support System v1 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the email parameter at /customer_support/index.php?page=customer_list.https://patchthecve.com/cve/CVE-2023-49971.htmlhttps://patchthecve.com/cve/CVE-2023-49971.htmlWed, 17 Jun 2026 06:36:48 +0000MEDIUM 6.1: A cross-site scripting (XSS) vulnerability in Customer Support System v1 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the firstname parameter at /customer_support/index.php?page=customer_list.https://patchthecve.com/cve/CVE-2023-49970.htmlhttps://patchthecve.com/cve/CVE-2023-49970.htmlWed, 17 Jun 2026 06:36:48 +0000CRITICAL 9.8: Customer Support System v1 was discovered to contain a SQL injection vulnerability via the subject parameter at /customer_support/ajax.php?action=save_ticket.https://patchthecve.com/cve/CVE-2023-49969.htmlhttps://patchthecve.com/cve/CVE-2023-49969.htmlWed, 17 Jun 2026 06:36:48 +0000MEDIUM 4.3: Customer Support System v1 was discovered to contain a SQL injection vulnerability via the id parameter at /customer_support/index.php?page=edit_customer.https://patchthecve.com/cve/CVE-2023-49968.htmlhttps://patchthecve.com/cve/CVE-2023-49968.htmlWed, 17 Jun 2026 06:36:48 +0000HIGH 7.3: Customer Support System v1 was discovered to contain a SQL injection vulnerability via the id parameter at /customer_support/manage_department.php.https://patchthecve.com/cve/CVE-2023-49548.htmlhttps://patchthecve.com/cve/CVE-2023-49548.htmlWed, 17 Jun 2026 06:36:07 +0000HIGH 8.8: Customer Support System v1 was discovered to contain a SQL injection vulnerability via the lastname parameter at /customer_support/ajax.php?action=save_user.https://patchthecve.com/cve/CVE-2023-49547.htmlhttps://patchthecve.com/cve/CVE-2023-49547.htmlWed, 17 Jun 2026 06:36:07 +0000CRITICAL 9.8: Customer Support System v1 was discovered to contain a SQL injection vulnerability via the username parameter at /customer_support/ajax.php?action=login.https://patchthecve.com/cve/CVE-2023-49546.htmlhttps://patchthecve.com/cve/CVE-2023-49546.htmlWed, 17 Jun 2026 06:36:06 +0000HIGH 8.8: Customer Support System v1 was discovered to contain a SQL injection vulnerability via the email parameter at /customer_support/ajax.php.https://patchthecve.com/cve/CVE-2023-49545.htmlhttps://patchthecve.com/cve/CVE-2023-49545.htmlWed, 17 Jun 2026 06:36:06 +0000HIGH 7.5: A directory listing vulnerability in Customer Support System v1 allows attackers to list directories and sensitive files within the application without requiring authorization.https://patchthecve.com/cve/CVE-2023-49544.htmlhttps://patchthecve.com/cve/CVE-2023-49544.htmlWed, 17 Jun 2026 06:36:06 +0000MEDIUM 4.9: A local file inclusion (LFI) in Customer Support System v1 allows attackers to include internal PHP files and gain unauthorized acces via manipulation of the page= parameter at /customer_support/index.php.https://patchthecve.com/cve/CVE-2023-50071.htmlhttps://patchthecve.com/cve/CVE-2023-50071.htmlWed, 17 Jun 2026 06:39:08 +0000HIGH 8.8: Sourcecodester Customer Support System 1.0 has multiple SQL injection vulnerabilities in /customer_support/ajax.php?action=save_department via id or name.https://patchthecve.com/cve/CVE-2023-50070.htmlhttps://patchthecve.com/cve/CVE-2023-50070.htmlWed, 17 Jun 2026 06:39:08 +0000HIGH 8.8: Sourcecodester Customer Support System 1.0 has multiple SQL injection vulnerabilities in /customer_support/ajax.php?action=save_ticket via department_id, customer_id, and subject.