Remote SQL injection in Simple Stock System 1.0 allows unauthenticated attackers to manipulate SQL queries via the email parameter in /market/update.php. Public exploit code exists, but no active exploitation has been confirmed. The vulnerability affects the code-projects.org stock management application, potentially exposing database contents.
SQL injection in itsourcecode Student Management System 1.0 allows remote attackers to manipulate database queries via the school_year parameter in /candidates_report.php. Public exploit code is available, enabling unauthorized data access and potential database compromise, though EPSS probability of exploitation is very low (0.05%). No active exploitation has been reported to CISA KEV at this time.
SQL injection in Campcodes Supplier Management System 1.0 allows remote attackers to manipulate the txtCategoryName parameter in /admin/add_category.php, potentially enabling unauthorized data access or modification. The vulnerability is unauthenticated and exploit code is publicly available, though no active exploitation in the wild has been confirmed. EPSS probability is low (0.05%), indicating limited real-world exploitation likelihood.
SQL injection in Scholars Tracking System 1.0 allows remote attackers to manipulate the post_content parameter in /home.php, potentially extracting or modifying database contents. A public proof-of-concept exploit exists, but no active exploitation is confirmed and EPSS indicates low exploitation probability.
SQL injection in code-projects Scholars Tracking System 1.0 allows remote, unauthenticated attackers to manipulate database queries via the ID parameter of /delete_post.php. A publicly available proof-of-concept exists, but the EPSS score is only 0.05% (15th percentile), indicating a currently low probability of widespread exploitation. The vulnerability is not listed in CISA's Known Exploited Vulnerabilities catalog.
SQL injection in Scholars Tracking System 1.0 allows remote unauthenticated attackers to manipulate the ID parameter in /admin/delete_user.php. The vulnerability enables limited modification or deletion of database records. A public proof-of-concept exploit exists, but no active exploitation in the wild has been confirmed.
Remote SQL injection in Simple Blood Donor Management System 1.0 allows unauthenticated attackers to execute arbitrary SQL commands via the campaignname parameter in /editedcampaign.php. A public exploit exists, though the vulnerability is not listed in CISA KEV and has a 0.05% EPSS score, suggesting low current exploitation likelihood.
SQL injection in code-projects Simple Blood Donor Management System 1.0 allows remote attackers to manipulate database queries via the Name parameter in /editeddonor.php. Exploit code is publicly available, but no active exploitation known; low real-world impact due to limited product footprint.
SQL injection in Simple Stock System 1.0 allows unauthenticated remote attackers to manipulate database queries via the Username field in /market/signup.php. Public exploit code is available, lowering the barrier to exploitation, though EPSS indicates low probability of widespread attacks.
Account linkage via Cross-Site Request Forgery (CSRF) in fastapi-sso before 0.19.0 allows attackers to trick a victim into visiting a malicious callback URL that links the attacker's OAuth provider account to the victim's internal application account, granting the attacker unauthorized access. The vulnerability stems from missing state parameter validation during OAuth callback processing. A public proof-of-concept exists, but no active exploitation has been confirmed.
Restajet Online Food Delivery System allows authenticated users to redirect victims to untrusted external sites through an unvalidated URL redirection mechanism, enabling phishing attacks and forceful browsing. The vulnerability affects all versions through 19122025 and has a moderate CVSS score of 5.4 with low exploitation probability (EPSS 0.04%, 12th percentile), indicating limited real-world attack likelihood despite the functional impact. The vendor has not responded to early disclosure attempts by the Turkish national CERT, leaving no official patch available.