Carmelo
Monthly
SQL injection in Simple Pizza Ordering System 1.0 allows remote, unauthenticated attackers to manipulate the ID parameter in the /large.php file to execute arbitrary SQL queries, potentially compromising data confidentiality, integrity, and availability. Public exploit code is available, though the EPSS score of 0.06% suggests low likelihood of widespread exploitation.
SQL injection in Simple Pizza Ordering System 1.0 allows remote attackers to manipulate database queries via the 'ID' parameter of /addpro.php. With no authentication or user interaction required, an attacker can read, modify, or delete data. Exploit code is publicly available but EPSS indicates a low probability of widespread exploitation.
SQL injection in Movie Ticketing System 1.0 allows remote attackers with low privileges to manipulate the backend database through the Date parameter of the /ticketConfirmation.php endpoint. Exploit code is publicly available, but no active exploitation has been confirmed by CISA KEV. The impact is rated low by CVSS, limiting the risk to data exposure or minor data tampering.
SQL injection in code-projects Movie Ticketing System 1.0 via the postName parameter in /logIn.php allows remote attackers to manipulate database queries. The vulnerability has a CVSS 4.0 score of 5.5 with low confidentiality, integrity, and availability impact. A public exploit is available, but there is no evidence of active exploitation.
SQL injection in Staff Audit System 1.0 allows remote attackers with low privileges to execute arbitrary SQL commands via the Search parameter in /search_index.php. A public exploit is available, though EPSS estimates very low exploitation probability (0.04%) and no active exploitation has been confirmed.
SQL injection in Staff Audit System 1.0 enables remote authenticated attackers to manipulate database queries via the updateid argument in /update_index.php. Exploit code is public, though no active exploitation is reported. The vulnerability poses low real-world risk due to limited impact and low EPSS score.
CVE-2025-6483 is a critical SQL injection vulnerability in code-projects Simple Pizza Ordering System version 1.0, specifically in the /edituser.php file's ID parameter. An unauthenticated remote attacker can exploit this weakness to execute arbitrary SQL commands, potentially compromising data confidentiality, integrity, and availability. The vulnerability has been publicly disclosed with exploit code available, increasing the likelihood of active exploitation.
CVE-2025-6482 is a SQL injection vulnerability in Simple Pizza Ordering System 1.0 affecting the /edituser-exec.php endpoint via the userid parameter, allowing unauthenticated remote attackers to execute arbitrary SQL commands and potentially exfiltrate, modify, or delete database contents. The vulnerability has been publicly disclosed with proof-of-concept exploitation available, presenting immediate risk to affected installations. With a CVSS score of 7.3 and network-based attack vector requiring no user interaction, this represents a moderately critical risk requiring urgent patching.
CVE-2025-6481 is a critical SQL injection vulnerability in code-projects Simple Pizza Ordering System 1.0 affecting the /update.php file's ID parameter, allowing unauthenticated remote attackers to manipulate database queries and potentially extract, modify, or delete sensitive data. The vulnerability has been publicly disclosed with proof-of-concept availability, significantly increasing exploitation risk in production environments. With a CVSS score of 7.3 and low attack complexity, this represents an immediate threat to any organization running the affected version without patches.
A SQL injection vulnerability in A vulnerability classified as critical (CVSS 7.3). Risk factors: public PoC available.
CVE-2025-6479 is a critical SQL injection vulnerability in code-projects Simple Pizza Ordering System 1.0 affecting the /salesreport.php file parameter 'dayfrom'. An unauthenticated attacker can remotely execute arbitrary SQL queries with no user interaction required, potentially enabling data exfiltration, modification, or deletion. The vulnerability has been publicly disclosed with exploit proof-of-concept availability, increasing real-world exploitation risk.
A SQL injection vulnerability in A vulnerability (CVSS 7.3). Risk factors: public PoC available.
CVE-2025-6363 is a critical SQL injection vulnerability in code-projects Simple Pizza Ordering System version 1.0, specifically in the /adding-exec.php file where the 'ingname' parameter is improperly sanitized. An unauthenticated remote attacker can exploit this vulnerability to execute arbitrary SQL queries, potentially leading to unauthorized data access, modification, or deletion of database records. With a CVSS score of 7.3 and network-based attack vector requiring no user interaction, this vulnerability poses significant risk to affected deployments, though real-world exploitation likelihood depends on whether POC code and active exploitation attempts are documented.
CVE-2025-6362 is a critical SQL injection vulnerability in code-projects Simple Pizza Ordering System version 1.0, specifically in the /editpro.php file where the ID parameter is improperly validated. An unauthenticated remote attacker can exploit this vulnerability to execute arbitrary SQL queries, potentially leading to unauthorized data access, modification, or system compromise. The vulnerability has a CVSS score of 7.3 (High) and requires no user interaction or authentication, making it a significant risk for deployments of this application.
CVE-2025-6361 is a critical SQL injection vulnerability in code-projects Simple Pizza Ordering System version 1.0, affecting the /adds.php file's userid parameter. An unauthenticated remote attacker can exploit this vulnerability without user interaction to execute arbitrary SQL queries, potentially leading to unauthorized data access, modification, or deletion of the application database. The vulnerability has a CVSS score of 7.3 (High) and represents an immediate risk to any organization running this unpatched system in production.
CVE-2025-6360 is a critical SQL injection vulnerability in code-projects Simple Pizza Ordering System version 1.0, affecting the /portal.php file's ID parameter. An unauthenticated remote attacker can exploit this to execute arbitrary SQL commands, potentially compromising data confidentiality, integrity, and availability. The vulnerability has been publicly disclosed with exploit code available, increasing real-world exploitation risk.
CVE-2025-6359 is a critical SQL injection vulnerability in code-projects Simple Pizza Ordering System version 1.0, specifically in the /cashconfirm.php file where the 'transactioncode' parameter is unsanitized. An unauthenticated remote attacker can exploit this to execute arbitrary SQL queries, potentially leading to unauthorized data access, modification, or deletion. The vulnerability has been publicly disclosed with exploit code available, increasing real-world exploitation risk.
CVE-2025-6358 is a critical SQL injection vulnerability in code-projects Simple Pizza Ordering System version 1.0, affecting the /saveorder.php file's ID parameter. An unauthenticated remote attacker can exploit this vulnerability to execute arbitrary SQL queries, potentially leading to unauthorized data access, modification, and system disruption. Public proof-of-concept code is available, increasing the immediate risk of active exploitation.
CVE-2025-6357 is a critical SQL injection vulnerability in code-projects Simple Pizza Ordering System version 1.0, specifically in the /paymentportal.php file where the 'person' parameter is not properly sanitized. An unauthenticated remote attacker can exploit this vulnerability with no user interaction required to execute arbitrary SQL commands, potentially leading to unauthorized data access, modification, or deletion of database contents. The vulnerability has been publicly disclosed with proof-of-concept code available, increasing the likelihood of active exploitation.
CVE-2025-6356 is a critical SQL injection vulnerability in code-projects Simple Pizza Ordering System version 1.0, specifically in the /addmem.php file that allows unauthenticated remote attackers to manipulate database queries. An attacker can exploit this vulnerability to read, modify, or delete sensitive data from the underlying database. The vulnerability has public exploit code available and may be actively exploited in the wild.
Stored cross-site scripting in code-projects Traffic Offense Reporting System 1.0 allows an authenticated attacker to inject arbitrary JavaScript via multiple parameters in /save-reported.php. Public exploit code exists, but EPSS score is low (0.05%) and no active exploitation has been reported.
Cross-site request forgery in code-projects Traffic Offense Reporting System 1.0 allows an attacker to perform unauthorized actions on behalf of an authenticated user. Publicly available exploit code exists, but no active exploitation has been confirmed. The low EPSS score (0.06%) suggests limited real-world risk.
A vulnerability, which was classified as problematic, was found in code-projects Traffic Offense Reporting System 1.0. This affects an unknown part of the file /save-settings.php of the component Setting Handler. The manipulation of the argument site_name leads to cross site scripting. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.
A vulnerability, which was classified as problematic, has been found in code-projects Traffic Offense Reporting System 1.0. This issue affects some unknown processing of the file saveuser.php. The manipulation of the argument user_id/username/email/name/position leads to cross site scripting. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used.
SQL injection vulnerability in Online Exam Mastering System v.1.0 allows a remote attacker to execute arbitrary code via the fid parameter. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
Code-projects Computer Book Store 1.0 is vulnerable to SQL Injection via book.php?bookisbn=. Rated high severity (CVSS 7.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
SQL Injection vulnerability in code-projects Agro-School Management System 1.0 allows attackers to run arbitrary code via the Login page. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
SQL Injection vulnerability in Code-projects Computer Science Time Table System 1.0 allows attackers to run arbitrary code via adminFormvalidation.php. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity. No vendor patch available.
Code-projects Computer Book Store 1.0 is vulnerable to SQL Injection via PublisherID. Rated high severity (CVSS 8.3), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Code-projects Computer Book Store 1.0 is vulnerable to SQL Injection via BookSBIN. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity. No vendor patch available.
code-projects Agro-School Management System 1.0 is suffers from Incorrect Access Control. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
SQL injection in Simple Pizza Ordering System 1.0 allows remote, unauthenticated attackers to manipulate the ID parameter in the /large.php file to execute arbitrary SQL queries, potentially compromising data confidentiality, integrity, and availability. Public exploit code is available, though the EPSS score of 0.06% suggests low likelihood of widespread exploitation.
SQL injection in Simple Pizza Ordering System 1.0 allows remote attackers to manipulate database queries via the 'ID' parameter of /addpro.php. With no authentication or user interaction required, an attacker can read, modify, or delete data. Exploit code is publicly available but EPSS indicates a low probability of widespread exploitation.
SQL injection in Movie Ticketing System 1.0 allows remote attackers with low privileges to manipulate the backend database through the Date parameter of the /ticketConfirmation.php endpoint. Exploit code is publicly available, but no active exploitation has been confirmed by CISA KEV. The impact is rated low by CVSS, limiting the risk to data exposure or minor data tampering.
SQL injection in code-projects Movie Ticketing System 1.0 via the postName parameter in /logIn.php allows remote attackers to manipulate database queries. The vulnerability has a CVSS 4.0 score of 5.5 with low confidentiality, integrity, and availability impact. A public exploit is available, but there is no evidence of active exploitation.
SQL injection in Staff Audit System 1.0 allows remote attackers with low privileges to execute arbitrary SQL commands via the Search parameter in /search_index.php. A public exploit is available, though EPSS estimates very low exploitation probability (0.04%) and no active exploitation has been confirmed.
SQL injection in Staff Audit System 1.0 enables remote authenticated attackers to manipulate database queries via the updateid argument in /update_index.php. Exploit code is public, though no active exploitation is reported. The vulnerability poses low real-world risk due to limited impact and low EPSS score.
CVE-2025-6483 is a critical SQL injection vulnerability in code-projects Simple Pizza Ordering System version 1.0, specifically in the /edituser.php file's ID parameter. An unauthenticated remote attacker can exploit this weakness to execute arbitrary SQL commands, potentially compromising data confidentiality, integrity, and availability. The vulnerability has been publicly disclosed with exploit code available, increasing the likelihood of active exploitation.
CVE-2025-6482 is a SQL injection vulnerability in Simple Pizza Ordering System 1.0 affecting the /edituser-exec.php endpoint via the userid parameter, allowing unauthenticated remote attackers to execute arbitrary SQL commands and potentially exfiltrate, modify, or delete database contents. The vulnerability has been publicly disclosed with proof-of-concept exploitation available, presenting immediate risk to affected installations. With a CVSS score of 7.3 and network-based attack vector requiring no user interaction, this represents a moderately critical risk requiring urgent patching.
CVE-2025-6481 is a critical SQL injection vulnerability in code-projects Simple Pizza Ordering System 1.0 affecting the /update.php file's ID parameter, allowing unauthenticated remote attackers to manipulate database queries and potentially extract, modify, or delete sensitive data. The vulnerability has been publicly disclosed with proof-of-concept availability, significantly increasing exploitation risk in production environments. With a CVSS score of 7.3 and low attack complexity, this represents an immediate threat to any organization running the affected version without patches.
A SQL injection vulnerability in A vulnerability classified as critical (CVSS 7.3). Risk factors: public PoC available.
CVE-2025-6479 is a critical SQL injection vulnerability in code-projects Simple Pizza Ordering System 1.0 affecting the /salesreport.php file parameter 'dayfrom'. An unauthenticated attacker can remotely execute arbitrary SQL queries with no user interaction required, potentially enabling data exfiltration, modification, or deletion. The vulnerability has been publicly disclosed with exploit proof-of-concept availability, increasing real-world exploitation risk.
A SQL injection vulnerability in A vulnerability (CVSS 7.3). Risk factors: public PoC available.
CVE-2025-6363 is a critical SQL injection vulnerability in code-projects Simple Pizza Ordering System version 1.0, specifically in the /adding-exec.php file where the 'ingname' parameter is improperly sanitized. An unauthenticated remote attacker can exploit this vulnerability to execute arbitrary SQL queries, potentially leading to unauthorized data access, modification, or deletion of database records. With a CVSS score of 7.3 and network-based attack vector requiring no user interaction, this vulnerability poses significant risk to affected deployments, though real-world exploitation likelihood depends on whether POC code and active exploitation attempts are documented.
CVE-2025-6362 is a critical SQL injection vulnerability in code-projects Simple Pizza Ordering System version 1.0, specifically in the /editpro.php file where the ID parameter is improperly validated. An unauthenticated remote attacker can exploit this vulnerability to execute arbitrary SQL queries, potentially leading to unauthorized data access, modification, or system compromise. The vulnerability has a CVSS score of 7.3 (High) and requires no user interaction or authentication, making it a significant risk for deployments of this application.
CVE-2025-6361 is a critical SQL injection vulnerability in code-projects Simple Pizza Ordering System version 1.0, affecting the /adds.php file's userid parameter. An unauthenticated remote attacker can exploit this vulnerability without user interaction to execute arbitrary SQL queries, potentially leading to unauthorized data access, modification, or deletion of the application database. The vulnerability has a CVSS score of 7.3 (High) and represents an immediate risk to any organization running this unpatched system in production.
CVE-2025-6360 is a critical SQL injection vulnerability in code-projects Simple Pizza Ordering System version 1.0, affecting the /portal.php file's ID parameter. An unauthenticated remote attacker can exploit this to execute arbitrary SQL commands, potentially compromising data confidentiality, integrity, and availability. The vulnerability has been publicly disclosed with exploit code available, increasing real-world exploitation risk.
CVE-2025-6359 is a critical SQL injection vulnerability in code-projects Simple Pizza Ordering System version 1.0, specifically in the /cashconfirm.php file where the 'transactioncode' parameter is unsanitized. An unauthenticated remote attacker can exploit this to execute arbitrary SQL queries, potentially leading to unauthorized data access, modification, or deletion. The vulnerability has been publicly disclosed with exploit code available, increasing real-world exploitation risk.
CVE-2025-6358 is a critical SQL injection vulnerability in code-projects Simple Pizza Ordering System version 1.0, affecting the /saveorder.php file's ID parameter. An unauthenticated remote attacker can exploit this vulnerability to execute arbitrary SQL queries, potentially leading to unauthorized data access, modification, and system disruption. Public proof-of-concept code is available, increasing the immediate risk of active exploitation.
CVE-2025-6357 is a critical SQL injection vulnerability in code-projects Simple Pizza Ordering System version 1.0, specifically in the /paymentportal.php file where the 'person' parameter is not properly sanitized. An unauthenticated remote attacker can exploit this vulnerability with no user interaction required to execute arbitrary SQL commands, potentially leading to unauthorized data access, modification, or deletion of database contents. The vulnerability has been publicly disclosed with proof-of-concept code available, increasing the likelihood of active exploitation.
CVE-2025-6356 is a critical SQL injection vulnerability in code-projects Simple Pizza Ordering System version 1.0, specifically in the /addmem.php file that allows unauthenticated remote attackers to manipulate database queries. An attacker can exploit this vulnerability to read, modify, or delete sensitive data from the underlying database. The vulnerability has public exploit code available and may be actively exploited in the wild.
Stored cross-site scripting in code-projects Traffic Offense Reporting System 1.0 allows an authenticated attacker to inject arbitrary JavaScript via multiple parameters in /save-reported.php. Public exploit code exists, but EPSS score is low (0.05%) and no active exploitation has been reported.
Cross-site request forgery in code-projects Traffic Offense Reporting System 1.0 allows an attacker to perform unauthorized actions on behalf of an authenticated user. Publicly available exploit code exists, but no active exploitation has been confirmed. The low EPSS score (0.06%) suggests limited real-world risk.
A vulnerability, which was classified as problematic, was found in code-projects Traffic Offense Reporting System 1.0. This affects an unknown part of the file /save-settings.php of the component Setting Handler. The manipulation of the argument site_name leads to cross site scripting. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.
A vulnerability, which was classified as problematic, has been found in code-projects Traffic Offense Reporting System 1.0. This issue affects some unknown processing of the file saveuser.php. The manipulation of the argument user_id/username/email/name/position leads to cross site scripting. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used.
SQL injection vulnerability in Online Exam Mastering System v.1.0 allows a remote attacker to execute arbitrary code via the fid parameter. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
Code-projects Computer Book Store 1.0 is vulnerable to SQL Injection via book.php?bookisbn=. Rated high severity (CVSS 7.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
SQL Injection vulnerability in code-projects Agro-School Management System 1.0 allows attackers to run arbitrary code via the Login page. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
SQL Injection vulnerability in Code-projects Computer Science Time Table System 1.0 allows attackers to run arbitrary code via adminFormvalidation.php. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity. No vendor patch available.
Code-projects Computer Book Store 1.0 is vulnerable to SQL Injection via PublisherID. Rated high severity (CVSS 8.3), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Code-projects Computer Book Store 1.0 is vulnerable to SQL Injection via BookSBIN. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity. No vendor patch available.
code-projects Agro-School Management System 1.0 is suffers from Incorrect Access Control. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.