PatchTheCVE: ordermanagementscripthttps://patchthecve.com/CVEs with upgrade or downgrade fix stepsCVE-2018-6934: CSRF exists in student/personal-info in PHP Scripts Mall Online Tutoring Script 2.0.3.https://patchthecve.com/cve/CVE-2018-6934.htmlhttps://patchthecve.com/cve/CVE-2018-6934.htmlWed, 17 Jun 2026 02:02:28 +0000HIGH 8.8: CSRF exists in student/personal-info in PHP Scripts Mall Online Tutoring Script 2.0.3.CVE-2017-17930: PHP Scripts Mall Professional Service Script has CSRF via admin/general_settingupd.php, as demonstrated by modhttps://patchthecve.com/cve/CVE-2017-17930.htmlhttps://patchthecve.com/cve/CVE-2017-17930.htmlWed, 17 Jun 2026 01:11:54 +0000HIGH 8.8: PHP Scripts Mall Professional Service Script has CSRF via admin/general_settingupd.php, as demonstrated by modifying a setting in the user panel.CVE-2017-17929: PHP Scripts Mall Professional Service Script has XSS via the admin/bannerview.php view parameter.https://patchthecve.com/cve/CVE-2017-17929.htmlhttps://patchthecve.com/cve/CVE-2017-17929.htmlWed, 17 Jun 2026 01:11:54 +0000MEDIUM 4.8: PHP Scripts Mall Professional Service Script has XSS via the admin/bannerview.php view parameter.CVE-2017-17928: PHP Scripts Mall Professional Service Script has SQL injection via the admin/review.php id parameter.https://patchthecve.com/cve/CVE-2017-17928.htmlhttps://patchthecve.com/cve/CVE-2017-17928.htmlWed, 17 Jun 2026 01:11:54 +0000CRITICAL 9.8: PHP Scripts Mall Professional Service Script has SQL injection via the admin/review.php id parameter.CVE-2017-17927: PHP Scripts Mall Professional Service Script allows remote attackers to obtain sensitive full-path informationhttps://patchthecve.com/cve/CVE-2017-17927.htmlhttps://patchthecve.com/cve/CVE-2017-17927.htmlWed, 17 Jun 2026 01:11:54 +0000MEDIUM 5.3: PHP Scripts Mall Professional Service Script allows remote attackers to obtain sensitive full-path information via a crafted PATH_INFO to service-list/category/.CVE-2017-17926: PHP Scripts Mall Professional Service Script has a predicable registration URL, which makes it easier for remohttps://patchthecve.com/cve/CVE-2017-17926.htmlhttps://patchthecve.com/cve/CVE-2017-17926.htmlWed, 17 Jun 2026 01:11:54 +0000MEDIUM 5.3: PHP Scripts Mall Professional Service Script has a predicable registration URL, which makes it easier for remote attackers to register with an invalid or spoofed e-mail address.CVE-2017-17925: PHP Scripts Mall Professional Service Script has XSS via the admin/general_settingupd.php website_title paramehttps://patchthecve.com/cve/CVE-2017-17925.htmlhttps://patchthecve.com/cve/CVE-2017-17925.htmlWed, 17 Jun 2026 01:11:54 +0000MEDIUM 4.8: PHP Scripts Mall Professional Service Script has XSS via the admin/general_settingupd.php website_title parameter.CVE-2017-17924: PHP Scripts Mall Professional Service Script allows remote attackers to obtain sensitive full-path informationhttps://patchthecve.com/cve/CVE-2017-17924.htmlhttps://patchthecve.com/cve/CVE-2017-17924.htmlWed, 17 Jun 2026 01:11:53 +0000MEDIUM 5.3: PHP Scripts Mall Professional Service Script allows remote attackers to obtain sensitive full-path information via the id parameter to admin/review_userwise.php.