Code Projects
Monthly
Buffer overflow in TOTOLINK A800R router firmware 4.1.2cu.5137 enables authenticated remote attackers to achieve arbitrary code execution with high privileges. The vulnerability exists in the setWiFiMultipleConfig function of the wireless configuration module (wireless.so) within the cstecgi.cgi web interface, exploitable via malformed wepkey2 parameter. Public proof-of-concept exploit code is available on GitHub. EPSS data not provided, CISA KEV status not listed, indicating exploitation is demonstrated but not yet observed in widespread campaigns.
In Code-Projects Online Car Rental System 1.0, the file upload feature does not validate file extensions or MIME types allowing an attacker to upload a PHP shell without any restrictions and execute. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Epss exploitation probability 45.1% and no vendor patch available.
Direct web-accessible SQL backup file exposure in code-projects Student Crud Operation 1.0 allows unauthenticated remote attackers to download the raw database dump `/card_activation.sql` from the web root. The file likely contains database schema and card activation records, exposing sensitive application data without any authentication. No public exploit identified at time of analysis is incorrect - publicly available exploit code exists per the referenced GitHub writeup, though no CISA KEV listing is present.
Time-based blind SQL injection in code-projects Student Crud Operation 1.0 allows low-privileged remote attackers to extract database contents by manipulating the `id` parameter in `/edit.php`. A public proof-of-concept exploit documenting the exact technique has been published on GitHub, making exploitation straightforward with automated tooling. No vendor patch has been identified, and the product shows no evidence of active maintenance.
Hospital Information System 1.0 by code-projects exposes its raw SQL database backup file at the web-accessible path `/HIS/his.sql`, allowing unauthenticated remote attackers to download the full database dump over HTTP with no prerequisites. The vulnerability (CWE-200) stems from placing the database export file inside the application's web root without access controls. A public proof-of-concept exploit document is available on GitHub, confirming practical exploitability; no KEV listing has been issued at time of analysis.
Reflected cross-site scripting (XSS) in code-projects Hospital Information System 1.0 allows a remote authenticated attacker to inject arbitrary JavaScript into victim browsers via the unsanitized `id` parameter in `/HIS/src/patients/editPatient.php`. An attacker who can craft a malicious URL and induce an authenticated user to click it can execute scripts in the victim's browser session, enabling session hijacking, credential theft, or UI redress. A public proof-of-concept exploit is available on GitHub; no KEV listing exists, and the CVSS 4.0 score of 2.0 reflects the limited real-world impact given authentication and user-interaction prerequisites.
Unauthenticated remote download of a raw SQL database backup in code-projects Hotel and Tourism Reservation in PHP 1.0 exposes the full application database to any internet-connected attacker. The file /ht/hotel_db%20(1).sql is placed inside the web root without access restrictions, making it directly retrievable over HTTP with no credentials. A publicly available proof-of-concept exploit exists; the database dump likely contains guest PII, booking records, and potentially hashed or plaintext admin credentials.
Reflected cross-site scripting in code-projects Hotel and Tourism Reservation in PHP 1.0 allows unauthenticated remote attackers to inject arbitrary JavaScript via the `room` parameter in `/ht/details.php`. When a victim user follows a crafted URL, the unsanitized parameter is reflected directly into the HTML response, executing attacker-controlled script in the victim's browser context and enabling session hijacking or credential theft. A public proof-of-concept writeup exists on GitHub, though no active exploitation has been confirmed and no CISA KEV listing is present.
Stored cross-site scripting in code-projects Task Management System 1.0 allows authenticated remote attackers to inject malicious scripts via the `lname` parameter in `/user/UpdateUserProfile.php`. When a victim views the tampered profile, the injected script executes in their browser session. A public proof-of-concept exploit is available on GitHub, lowering the bar for exploitation.
SQL injection in the Login component of code-projects Task Management System In PHP 1.0 exposes the application's database to unauthenticated remote attackers via the `email` parameter in `/index.php`. The root cause is unsanitized user input passed directly into a SQL query (CWE-89), enabling authentication bypass and arbitrary data extraction. A public proof-of-concept writeup has been published on GitHub, significantly lowering the exploitation barrier; no vendor patch has been identified.
Unauthenticated remote access to an exposed SQL database backup file in code-projects Daily Expense Manager 1.0 allows any network attacker to retrieve sensitive application data. The file `/Daily-Expense-Manager/exp_ak.sql` - a raw database dump - is served directly from the web root without access control, disclosing potentially credentials, user records, and expense data. No public exploitation via CISA KEV, but a public exploit writeup is available on GitHub confirming the exposure path.
SQL injection in code-projects Content Management System 1.0 allows unauthenticated remote attackers to manipulate database queries via the user_name parameter in /login.php. Because the vulnerable endpoint is the authentication form itself, successful exploitation can achieve authentication bypass - granting admin-level access without credentials - as well as full database enumeration. A public proof-of-concept exploit has been published to GitHub, materially lowering the bar for exploitation.
SQL injection in code-projects Online Shopping System 1.0 allows authenticated administrators to manipulate database queries via the `mobile` parameter in admin/adduser.php. The vulnerable call passes unsanitized user input directly to mysqli_query(), enabling an admin-level attacker to read, modify, or delete database contents. A public proof-of-concept exploit has been published on GitHub; no vendor patch has been identified.
Sensitive database exposure in code-projects Vehicle Management System 1.0 allows unauthenticated remote attackers to download the raw SQL database backup file at /vehicle_management.sql directly over HTTP, leaking the full application database contents. The backup file is stored in or under the web root with no access controls, making it trivially accessible to any internet-connected attacker. A public proof-of-concept is available, and no vendor patch has been identified at time of analysis.
SQL injection in code-projects Doctor Appointment System 1.0 permits unauthenticated remote attackers to manipulate backend database queries by supplying crafted input in the `firstname` parameter of `/contactus.php`. The flaw (CWE-89) stems from unsanitized user input concatenated directly into SQL statements, enabling data extraction or modification without any credentials. A public proof-of-concept exploit is available on GitHub, reducing the barrier for opportunistic attacks despite a moderate CVSS 4.0 score of 6.9.
Unauthenticated SQL injection in code-projects Doctor Appointment System 1.0 exposes the `/patient/booking.php` endpoint to remote database manipulation via the unsanitized `doc_id` parameter. Attackers with network access can extract patient records, appointment data, and stored credentials, or modify database contents without any authentication. Public exploit code exists on GitHub, significantly lowering the bar for exploitation; no vendor patch has been identified at time of analysis.
SQL injection in code-projects Hospital Information System 1.0 allows unauthenticated remote attackers to manipulate database queries through the `ID` parameter of the `getSinglePresp` function in `includes/presp/PrespController.php`. A public exploit has been released via GitHub, lowering the barrier for opportunistic attacks. Successful exploitation could expose sensitive patient records and medical data stored in the backend database, or allow unauthorized data modification.
SQL injection in code-projects Hospital Information System 1.0 allows unauthenticated remote attackers to manipulate backend database queries by supplying a crafted value in the ID argument to the viewReq() function within viewReq.php. The attack requires no authentication or user interaction, and a proof-of-concept exploit is publicly available via a GitHub issue. No vendor patch has been identified at time of analysis, leaving deployments with no official remediation path.
SQL injection in code-projects Hospital Information System 1.0 allows unauthenticated remote attackers to manipulate database queries via the Search argument in the findBySearch() function of addReq.php. The CVSS 4.0 vector confirms network accessibility with no authentication, no complexity, and no user interaction required. Publicly available exploit code exists via a GitHub issue; no CISA KEV listing.
Unauthenticated SQL injection in code-projects Doctor Appointment System 1.0 allows remote attackers to enumerate and extract database contents by exploiting the email parameter in the patient login endpoint (/patient_login.php) via time-based blind techniques. A public GitHub proof-of-concept documents the exact method, lowering the exploitation bar to script-kiddie level. No patch has been released by the vendor; the product appears to be an educational PHP demo with limited production presence.
Unauthenticated SQL injection in code-projects Online Shopping System 1.0 exposes the backend database through the Search Functionality's `keyword` parameter in `/action.php`. The GitHub-linked proof-of-concept specifically documents a time-based blind injection technique, allowing remote attackers without credentials to enumerate database contents, extract data, and potentially modify records. No public KEV listing exists, but exploit code is publicly available, lowering the bar for opportunistic exploitation.
Stored cross-site scripting in code-projects Simple Inventory System 1.0 allows remote unauthenticated attackers to inject persistent JavaScript via the last_name parameter of /register.php during user registration. When an administrator or privileged user subsequently views the registered user list, the stored payload executes in their browser context, enabling session hijacking or credential theft. A public proof-of-concept is available on GitHub; the vulnerability is not listed in CISA KEV and carries a CVSS 4.0 score of 2.1 reflecting limited real-world scope.
Direct remote access to an unprotected SQL database backup file in code-projects Simple Inventory System 1.0 allows unauthenticated attackers to retrieve the full contents of the inventory database without any credentials or user interaction. The file inventorymanagement.sql is stored within the web-accessible directory and is directly downloadable via HTTP. A publicly documented proof-of-concept on GitHub confirms trivial exploitability of this exposure.
Stored cross-site scripting in code-projects Employee Leave Managing System 1.0 allows an authenticated low-privilege employee to inject persistent malicious script via the Name parameter in the Employee Profile Update endpoint (/EmpManageSys/editaction.php). When a privileged user such as an HR administrator subsequently views the tampered employee profile, the payload executes in their browser, enabling session hijacking or unauthorized administrative actions. A public proof-of-concept exploit is available on GitHub; no CISA KEV listing exists, so confirmed in-the-wild exploitation is not established at time of analysis.
Authorization bypass via Insecure Direct Object Reference (IDOR) in the Boarder Management Module of code-projects Barangay Resident Profiling Management System 1.0 allows authenticated remote attackers to access or modify boarder records belonging to other users by manipulating the `ID` parameter in `/boarders.php`. A publicly available proof-of-concept exploit exists on GitHub, materially lowering the exploitation barrier. The vulnerability is not listed in CISA KEV, so no confirmed active exploitation campaigns have been identified at time of analysis.
SQL injection in code-projects Barangay Resident Profiling Management System 1.0 allows unauthenticated remote attackers to manipulate database queries via the Search argument in residents.php. The Resident Search Functionality fails to sanitize user-supplied input before constructing SQL statements, enabling read, write, or denial-of-service impact against the underlying database. A public proof-of-concept exploit is available on GitHub, lowering the bar for opportunistic exploitation; however, the product's extremely limited real-world deployment significantly constrains actual attack surface.
Authorization bypass in code-projects Barangay Resident Profiling Management System 1.0 exposes the /archived_records.php endpoint to insecure direct object reference (IDOR) exploitation, allowing low-privileged authenticated attackers to restore or delete archived resident records they do not own by manipulating the resident_id parameter. A public proof-of-concept exploit is available via GitHub, though the vulnerability is not listed in CISA's Known Exploited Vulnerabilities catalog. The CVSS 4.0 score of 2.1 reflects limited confidentiality, integrity, and availability impact scoped to the vulnerable system with no lateral scope change.
SQL injection in code-projects Simple Inventory System 1.0 allows remote unauthenticated attackers to manipulate backend database queries via the ID parameter in /delete.php. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) confirms no authentication or user interaction is required, enabling exploitation from the network. A public proof-of-concept exploit has been disclosed via GitHub, making this immediately actionable for opportunistic attackers targeting deployments of this PHP application.
Direct HTTP access to an exposed SQL database backup file in code-projects Login Registration System 1.0 allows unauthenticated remote attackers to download the raw database dump at /loginsystem/database/login_registration_system.sql, disclosing user credentials, schema details, and any sensitive data stored in the application database. This is a CWE-552 file exposure defect - the backup artifact is stored within the web-accessible document root with no access controls. No exploitation beyond a standard HTTP GET request is required. A public proof-of-concept exploit exists; no KEV listing at time of analysis.
SQL injection in code-projects Employee Management System 1.0 allows remote unauthenticated attackers to manipulate backend database queries via the `mailuid` parameter at the Admin Login Endpoint (`/process/aprocess.php`). Successful exploitation can result in authentication bypass, credential extraction, or partial data manipulation depending on database user privileges. A public proof-of-concept exploit is available, materially lowering the technical barrier for opportunistic attacks.
SQL injection in code-projects Online Job Portal System 1.0 exposes the unauthenticated Password Recovery endpoint (/ForPass.php) to remote exploitation via the txtUserName parameter. The flaw requires no credentials and no user interaction, meaning any network-reachable instance can be targeted directly. A public proof-of-concept exploit has been disclosed via GitHub, confirming the attack is reproducible; no vendor patch has been identified at time of analysis.
SQL injection in code-projects Task Management System 1.0 exposes the login endpoint at /index.php to unauthenticated remote exploitation via the email parameter. The vulnerable function Operation::select_with_multiple_condition fails to sanitize user input before constructing SQL queries, enabling authentication bypass or database enumeration. A public proof-of-concept exploit is available per VulDB and a linked GitHub issue, materially lowering the skill threshold for exploitation; no confirmed CISA KEV listing exists at time of analysis.
Reflected cross-site scripting in code-projects Online Shopping System 1.0 allows remote attackers to inject arbitrary JavaScript into victim browsers by manipulating the email argument in offersmail.php. The vulnerability requires no authentication (PR:N per CVSS 4.0 vector) but does require a victim to interact with a crafted link or page (UI:P). Publicly available exploit code exists on GitHub, though no active exploitation has been confirmed by CISA KEV.
SQL injection in code-projects Online Shopping System 1.0 allows remote low-privileged attackers to manipulate the `total_count` parameter in `/checkout_process.php` to execute arbitrary SQL commands against the backend database. The CVSS 4.0 score is 5.3 (Medium) with partial confidentiality, integrity, and availability impact; no subsequent-system scope change is indicated. A public proof-of-concept exploit is available on GitHub, substantially lowering the bar for opportunistic exploitation - though the product's niche footprint limits broad real-world blast radius.
Cross-site scripting in code-projects Online Shopping System 1.0 allows remote low-privileged attackers to inject arbitrary JavaScript into victim browsers via the unsanitized `amount_1` parameter in `/checkout.php`, enabling session hijacking, credential theft, or UI manipulation against users who interact with the crafted response. The affected product is a PHP-based e-commerce application distributed by code-projects.org, with the vulnerability tracked exclusively through VulDB. A public proof-of-concept exploit has been released on GitHub, elevating the practical risk beyond the moderate CVSS 4.0 score of 5.1 suggests in isolation.
Missing authorization in code-projects Task Management System 1.0 allows remote unauthenticated attackers to manipulate task records by sending crafted requests to /user/UpdateTaskStatus.php with arbitrary task_id and val parameters. The server performs no permission check before processing the status update, enabling any network-reachable party to alter task data belonging to any user. A public proof-of-concept exploit exists per VulDB and a GitHub issue report, making opportunistic abuse straightforward despite the absence of a CISA KEV listing.
SQL injection in code-projects Task Management System 1.0 exposes unauthenticated remote attackers a path to manipulate database queries through the task_id parameter in /user/comment_count_user.php. The flaw is a textbook CWE-89 input-neutralization failure in a PHP application with no authentication barrier, and exploit code has been publicly disclosed via GitHub. No CISA KEV listing exists at time of analysis, but the zero-authentication network attack vector combined with available proof-of-concept code significantly lowers the exploitation bar.
SQL injection in code-projects Task Management System 1.0 exposes the pre-authentication admin login endpoint at /admin/AdminLogin.php to unauthenticated remote attackers who can manipulate the email or password parameters to execute arbitrary SQL commands. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) confirms fully unauthenticated, low-complexity network exploitation with no special conditions required. A public proof-of-concept exploit has been published on GitHub, materially lowering the skill threshold for exploitation; however, this CVE does not appear in the CISA KEV catalog at time of analysis.
Authentication bypass in code-projects Task Management System 1.0 exposes the login endpoint at /index.php to remote unauthenticated attackers who can manipulate the Password parameter to circumvent credential verification entirely. The flaw is classified under CWE-287 (Improper Authentication) and affects all known versions of this PHP application per the wildcard CPE string. A public proof-of-concept exploit is available on GitHub, and no vendor-released patch has been identified at time of analysis.
Cross-site scripting in code-projects Online Examination System 1.0 allows remote attackers to inject arbitrary JavaScript by manipulating the eid, n, or t parameters in the /account.php?q=quiz endpoint. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:P) confirms unauthenticated remote exploitation requiring only passive victim interaction, consistent with a reflected XSS delivery via crafted link. A proof-of-concept exploit is publicly available on GitHub; this CVE is not listed in the CISA KEV catalog, so no confirmed active exploitation has been identified at time of analysis.
SQL injection in the Login Form of code-projects Hospital Bed Management System 1.0 exposes unauthenticated remote attackers to database manipulation via the Username parameter. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) confirms trivial, unauthenticated network exploitation with no user interaction, and the E:P modifier reflects a publicly available proof-of-concept on Gitee. While not listed in CISA KEV, the low barrier to exploitation combined with a public POC elevates practical urgency for any organization running this software, despite the product's niche footprint.
Cross-site scripting in code-projects Online Job Portal 1.0 allows a remote, low-privileged attacker to inject malicious JavaScript via the /Admin/DetailJob.php endpoint, which executes in the browser of any user who views the affected page. The CVSS 4.0 vector (PR:L/UI:P) confirms that exploitation requires an authenticated session and passive victim interaction, constraining but not eliminating real-world risk. A public proof-of-concept has been disclosed on GitHub; no patch from the vendor has been identified at time of analysis.
Unrestricted file upload in code-projects Online Job Portal 1.0 exposes unauthenticated remote attackers to arbitrary file upload via the txtFile parameter in /JobSeekerInsert.php, enabling likely webshell deployment and subsequent server-side code execution. A public proof-of-concept exploit exists (no KEV listing), substantially lowering the exploitation barrier for any internet-exposed instance. The CVSS 4.0 impact metrics are conservatively rated Low across C/I/A, which understates the realistic post-exploitation potential of an unrestricted PHP file upload - successful webshell placement typically yields full OS command execution in the web server process context.
SQL injection in code-projects Online Job Portal 1.0 exposes the /Admin/DeleteUser.php endpoint to unauthenticated remote database manipulation. An attacker can craft HTTP requests that inject arbitrary SQL, enabling data extraction, modification, or deletion from the underlying database. A public proof-of-concept exploit exists (GitHub: shihuizhang-dazhi/MY-CVE/issues/4), lowering the bar for exploitation; this vulnerability is not currently listed in CISA KEV.
SQL injection in code-projects Online Job Portal 1.0 exposes the /Admin/EditUser.php endpoint to remote database manipulation via the unsanitized UserId parameter. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) classifies this as remotely exploitable with no authentication or interaction required, though the Admin path location raises questions about actual auth gating in practice. A public exploit exists (E:P confirmed in CVSS 4.0 and via GitHub issue), lowering the skill bar for exploitation considerably; this CVE is not currently listed in CISA KEV.
SQL injection in code-projects Interview Management System 1.0 exposes the application to remote, unauthenticated database manipulation via the ID parameter in /inc/classes/View.php. An attacker with network access can read, modify, or partially disrupt data stored in the underlying database with no authentication required and no user interaction needed. A public exploit exists (referenced via GitHub at https://github.com/susususua-AI/CVE/issues/2), though no active exploitation has been confirmed by CISA KEV as of this analysis.
SQL injection in code-projects Real State Services 1.0 exposes the `/pay.php` endpoint to remote unauthenticated attackers who can manipulate the `Bankname` parameter to execute arbitrary SQL commands against the backend database. A public proof-of-concept exploit has been disclosed on GitHub, materially lowering the skill threshold for exploitation. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) confirms zero-friction remote reachability, though partial CIA impact scores indicate constrained blast radius rather than full database takeover; no public confirmation of active exploitation (CISA KEV) exists at time of analysis.
SQL injection in code-projects Hotel and Tourism Reservation 1.0 allows remote attackers to manipulate the backend database via the fdetails parameter in /admin/add_event.php. The flaw is reachable over the network with no authentication required per the CVSS 4.0 vector, enabling data extraction, modification, or disruption against the application's database. A public exploit has been disclosed on GitHub; no patch has been identified at time of analysis.
SQL injection in code-projects Hotel and Tourism Reservation 1.0 allows remote attackers to manipulate the unsanitized `tour` parameter in /admin/tour_reserves.php, enabling arbitrary SQL query execution against the backend database. The CVSS 4.0 vector assigns PR:N (no privileges required), though the admin-panel endpoint raises questions about whether authentication is genuinely absent or misconfigured - a discrepancy worth verifying in deployments. A public proof-of-concept exploit has been published via GitHub, raising the practical risk despite the medium CVSS 4.0 score of 6.9 and absence of CISA KEV listing.
SQL injection in code-projects Hotel and Tourism Reservation 1.0 exposes the reservation database to remote manipulation via the `delete_image` parameter in the admin Tour Management Page (`/admin/add_tour.php`). The CVSS 4.0 vector asserts no privileges required (PR:N), yet the vulnerable endpoint sits under an `/admin/` path - this conflict is unresolved in available data and defenders must verify whether the admin panel is publicly accessible without authentication. A public proof-of-concept is available on GitHub, elevating practical risk beyond the moderate base score, though no CISA KEV listing indicates confirmed widespread exploitation at time of analysis.
SQL injection in code-projects Hotel and Tourism Reservation 1.0 exposes the /admin/reservations.php endpoint to database manipulation via the unsanitized `delete` parameter. The vulnerability is reachable over the network with no confirmed complexity barriers, and a public proof-of-concept exploit has been disclosed. No vendor patch has been identified, leaving all deployments of version 1.0 exposed to database read, write, and potential full compromise of hosted reservation data.
SQL injection in code-projects Real State Services 1.0 exposes the application's database to remote unauthenticated manipulation via the `amen` parameter in `/addprojectsale.php`. Any attacker with network access to the PHP web application can craft a malicious HTTP request to read, modify, or partially disrupt the underlying database without authentication. No active exploitation is confirmed in CISA KEV, but a GitHub issue filed under the researcher's CVE repository suggests reproduction steps or proof-of-concept detail is publicly accessible.
SQL injection in code-projects Real State Services 1.0 allows remote unauthenticated attackers to manipulate the backend database via the `amen` parameter in `/addprojectrent.php`. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) confirms trivial, unauthenticated network exploitation with no attack preconditions. A publicly available proof-of-concept exploit has been disclosed via GitHub, elevating the realistic threat beyond theoretical; however, this CVE is not currently listed in the CISA KEV catalog, and the product's limited enterprise footprint constrains broad impact.
SQL injection in code-projects Real State Services 1.0 allows remote unauthenticated attackers to manipulate the `id` parameter of `/single-list_rent.php` to read, modify, or corrupt backend database contents. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) confirms zero-friction unauthenticated network exploitation against a standard installation. A public proof-of-concept exploit is available on GitHub (E:P confirmed in CVSS 4.0 supplemental metrics), raising realistic risk of opportunistic automated attacks against any internet-exposed instance; no CISA KEV listing and no patch are confirmed at time of analysis.
SQL injection in code-projects Real State Services 1.0 exposes unauthenticated remote attackers a direct path to manipulate the backend database via the `loc` parameter in `/normalHomeRent.php`. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) confirms no authentication, no user interaction, and no special configuration are required against default deployments. A public proof-of-concept exploit has been released on GitHub, materially increasing opportunistic exploitation risk despite the moderate aggregate score; no CISA KEV listing has been identified at time of analysis.
SQL injection in code-projects Real State Services 1.0 exposes the `/normalHomeSale.php` endpoint to unauthenticated remote database manipulation via the unsanitized `loc` parameter. Any internet-accessible deployment of this PHP real estate application is vulnerable to data extraction or modification without credentials. A public proof-of-concept exploit is available on GitHub, lowering the skill barrier for opportunistic attackers; however, no CISA KEV listing has been issued and no patch has been identified from the vendor.
SQL injection in code-projects Online Examination 1.0 allows authenticated remote attackers to manipulate database queries through multiple unsanitized parameters in the Quiz Creation Feature. The endpoint /update.php?q=addquiz accepts user-supplied input for the name, total, right, wrong, time, tag, and desc arguments without adequate sanitization, enabling read and write access to the underlying database. A public proof-of-concept exploit exists on GitHub, though the application's extremely limited deployment footprint constrains real-world impact.
SQL injection in code-projects Online Examination 1.0 exposes the login endpoint to unauthenticated remote attackers via the uname and password parameters in head.php. Manipulation of either parameter enables classic SQL injection, allowing database enumeration, authentication bypass, and potential data manipulation against any deployed instance. A public proof-of-concept exploit is available on GitHub (no public exploit identified as KEV), making weaponization trivial for low-skill attackers targeting this application.
SQL injection in code-projects Internship Management System 1.0 exposes authenticated employer accounts to database query manipulation via the `Current` parameter in the password change endpoint (`employer/details/change_password.php`). The flaw carries a CVSS 4.0 score of 5.3, is rooted in unsanitized PHP input passed directly into SQL queries (CWE-89), and has a publicly available proof-of-concept exploit on GitHub. No public exploit identified as confirmed in CISA KEV, but the combination of low attack complexity and public PoC meaningfully raises real-world exploitation likelihood against any internet-exposed deployment.
SQL injection in code-projects Internship Management System 1.0 permits unauthenticated remote attackers to manipulate the email and password parameters of employer/login.php, altering backend SQL query logic to bypass authentication or partially expose database contents. A proof-of-concept exploit has been publicly disclosed on GitHub, materially lowering the skill threshold for exploitation. The CVSS 4.0 score of 6.9 with PR:N and no attack complexity reflects straightforward unauthenticated access, though impact is bounded at Low across confidentiality, integrity, and availability - suggesting partial rather than full database compromise.
SQL injection in code-projects Online Job Portal 1.0 exposes the login.php endpoint to remote unauthenticated exploitation via the txtUser and txtPass parameters, enabling attackers to manipulate backend SQL queries without any credentials or user interaction. A public proof-of-concept exploit is documented on GitHub, significantly lowering the barrier to attack for any internet-exposed instance. No patch has been identified from the vendor at time of analysis; the wildcard CPE suggests all versions are affected.
SQL injection in code-projects Assessment Management 1.0 allows authenticated remote attackers to execute arbitrary SQL queries by manipulating the smarksrange[] array parameter in /lecturer/marking-scheme.php. The CVSS 4.0 vector (PR:L) confirms low-privilege authentication is required, limiting the attack surface to registered users such as lecturers. A public exploit proof-of-concept is available on GitHub, elevating the practical risk despite the medium CVSS 4.0 score of 5.3 and no confirmed active exploitation in the CISA KEV catalog.
SQL injection in code-projects Assessment Management 1.0 exposes database query handling in the lecturer marking-scheme feature to manipulation via the unsanitized `squestions[]` parameter at `/lecturer/marking-scheme.php`. Authenticated remote attackers with low-privilege access can alter SQL query logic to extract or modify student assessment data. A public proof-of-concept exploit is documented on GitHub, lowering the skill bar for exploitation; however, the application is not listed in CISA KEV and carries a CVSS 4.0 score of 2.1 reflecting its constrained impact and authentication prerequisite.
Cross-site scripting in code-projects Assessment Management 1.0 allows remote unauthenticated attackers to inject malicious scripts via the unsanitized `ID` parameter in `/admin/remove-user.php`. A public proof-of-concept exploit is available on GitHub (E:P in the CVSS 4.0 supplemental metrics), lowering the bar for exploitation. The vulnerability is not listed in the CISA KEV catalog, so confirmed widespread active exploitation has not been established, though the admin-facing endpoint makes session hijacking of privileged users a realistic outcome.
Cross-site scripting (XSS) in code-projects Assessment Management 1.0 allows a remote attacker with administrative credentials to inject malicious scripts via the User parameter in admin/view-users.php, executing arbitrary JavaScript in the browser context of users who view the affected admin page. The CVSS 4.0 vector (PR:H, UI:P) confirms exploitation is gated behind high-privilege authentication and requires a victim to load the tampered page. A public proof-of-concept exploit exists on GitHub, though no active exploitation or CISA KEV listing has been identified at time of analysis.
Unauthenticated SQL injection in code-projects Online Voting System 0.x-1.0 exposes the admin login endpoint to full authentication bypass and database extraction. The vulnerability resides in the `test_input` function within `/authentication.php`, where the `adminUserName` and `adminPassword` parameters are passed unsanitized into SQL queries, enabling classic injection attacks against the login form. A public proof-of-concept exploit has been published on GitHub; no vendor patch has been identified at time of analysis.
Cross-site scripting in code-projects Online Music Site 1.0 allows unauthenticated remote attackers to inject malicious scripts via the feedback form's fname, femail, faddress, or fmessage parameters handled by /Frontend/Feedback.php. The CVSS 4.0 score of 2.1 (Low) reflects the UI:P requirement - a victim must interact with the crafted content for the payload to execute, limiting autonomous exploitation. A public proof-of-concept is available via GitHub, though no confirmed active exploitation (CISA KEV) has been recorded.
Cross-site scripting in code-projects Project Management System 1.0 allows a remote authenticated attacker to inject malicious scripts via the /mail.php Mail Compose Page, targeting other users who interact with the crafted mail content. The CVSS 4.0 vector (PR:L/UI:P) confirms exploitation requires a low-privileged authenticated session and passive victim interaction, limiting scope but not eliminating risk in shared environments. A public proof-of-concept exploit has been disclosed on GitHub; no KEV listing and no vendor patch have been identified at time of analysis.
SQL injection in code-projects Online Music Site 1.0 allows remote unauthenticated attackers to manipulate the Category parameter in /Frontend/Search.php to execute arbitrary SQL commands against the backend database. Publicly available exploit code exists (disclosed via GitHub), increasing the practical risk despite the small footprint of this PHP application. No active exploitation has been confirmed in CISA KEV at the time of analysis.
SQL injection in code-projects Online Music Site 1.0 allows remote attackers to manipulate the ID parameter in /Administrator/PHP/AdminDeleteAlbum.php to execute arbitrary database queries. Publicly available exploit code exists (published via GitHub and tracked by VulDB), and the flaw is reachable over the network without authentication per the CVSS vector. There is no public exploit identified as actively used in the wild (not CISA KEV), but the combination of trivial attack complexity and public PoC raises the practical exploitation risk for any exposed deployment.
SQL injection in code-projects Simple Flight Ticket Booking System 1.0 allows remote unauthenticated attackers to manipulate database queries via the Username POST parameter in checkUser.php. Publicly available exploit code exists (disclosed via GitHub), increasing the likelihood of opportunistic attacks against exposed instances, though the issue is not listed in CISA KEV. The CVSS 3.1 base score of 7.3 reflects network-reachable, low-complexity exploitation with no privileges or user interaction required.
Unrestricted file upload in code-projects Vehicle Management System 1.0 allows remote unauthenticated attackers to upload arbitrary files via the photo parameter of the New Driver Registration Form (newdriver.php), enabling remote code execution. Publicly available exploit code exists on GitHub, increasing the likelihood of opportunistic abuse against exposed instances despite no CISA KEV listing.
SQL injection in code-projects Hotel and Tourism Reservation System 1.0 allows remote unauthenticated attackers to manipulate the 'room' parameter of /details.php to inject arbitrary SQL queries. Publicly available exploit code exists (published via GitHub by researcher and indexed by VulDB), increasing the likelihood of opportunistic exploitation against exposed instances. The flaw is reachable over the network with no privileges or user interaction, making any internet-facing deployment of this PHP application a viable target.
SQL injection in code-projects Student Admission System 1.0 allows remote unauthenticated attackers to manipulate the 'eid' and 'did' parameters in /index.php to inject arbitrary SQL queries. Publicly available exploit code exists (referenced via GitHub issue tracker), increasing the likelihood of opportunistic attacks against exposed deployments. The vulnerability carries a CVSS 3.1 base score of 7.3, with low impact across confidentiality, integrity, and availability, but no special prerequisites for exploitation.
Insecure Direct Object Reference (IDOR) in code-projects Online Hospital Management System 1.0 allows a high-privileged remote attacker to manipulate the `delid` parameter in `viewdoctortimings.php`, resulting in unauthorized modification or deletion of doctor timing records beyond the attacker's intended access scope. The CVSS 4.0 score of 2.0 reflects the high privilege prerequisite (PR:H), low integrity impact (VI:L), and low availability impact (VA:L) to the vulnerable component. No public exploit identified at time of analysis as active exploitation - however, publicly available exploit code exists, documented in a GitHub proof-of-concept writeup.
SQL injection in code-projects Hotel and Tourism Reservation System 1.0 allows remote unauthenticated attackers to manipulate the `tour` GET parameter in `tour.php` to inject arbitrary SQL into backend database queries. Publicly available exploit code exists (hosted on GitHub), enabling low-skilled attackers to extract or modify database contents, though no CISA KEV listing or EPSS signal indicates widespread active exploitation at this time.
Cross-site scripting in code-projects Hotel and Tourism Reservation System 1.0 allows remote unauthenticated attackers to inject and execute arbitrary JavaScript by manipulating the name, email, people, or number parameters submitted to /ht/tour.php. The POC repository title ('Stored-XSS') strongly suggests this is a persistent (stored) XSS variant, meaning injected payloads survive in the application and execute in the browsers of subsequent users who view the affected reservation data - not merely the attacker's own session. Publicly available exploit code exists; this CVE has not been added to the CISA KEV catalog at time of analysis.
Authentication bypass in code-projects Hotel and Tourism Reservation System 1.0 allows remote attackers to defeat admin login by manipulating the Password argument processed by the password_verify function in /admin/login.php. The flaw is reachable over the network without prior authentication, and publicly available exploit code exists, increasing the likelihood of opportunistic abuse against exposed deployments.
SQL injection in code-projects Online Hospital Management System 1.0 exposes backend database contents via the `editid` parameter in `appointmentdetail.php`. A low-privilege authenticated attacker can remotely manipulate SQL queries to read, modify, or corrupt patient and appointment records. A proof-of-concept exploit is publicly available per the GitHub reference, raising the likelihood of opportunistic exploitation against internet-facing deployments of this PHP application.
SQL injection in code-projects Online Hospital Management System 1.php enables remote unauthenticated attackers to manipulate the Username parameter sent to the login_user function in login_1.php, allowing arbitrary SQL query execution against the backend database. Publicly available exploit code exists (published on GitHub by researcher Mi0uno), increasing the likelihood of opportunistic exploitation, though the CVE is not listed in CISA KEV and EPSS data is not provided. Per CVSS, exploitation requires no authentication or user interaction and impacts confidentiality, integrity, and availability at a low level (CVSS 7.3).
SQL injection in code-projects Online Music Site 1.0 allows remote unauthenticated attackers to manipulate the ID parameter of /Administrator/PHP/AdminEditAlbum.php to inject arbitrary SQL queries. Publicly available exploit code exists (disclosed via VulDB submission 819912 and a GitHub issue), though there is no CISA KEV listing and no EPSS data provided to gauge exploitation probability. The vulnerability carries a CVSS 7.3 score reflecting low complexity and no authentication requirement, but only partial CIA impact.
SQL injection in code-projects Online Music Site 1.0 exposes the administrator backend endpoint /Administrator/PHP/AdminUpdateAlbum.php to database manipulation via an unsanitized ID parameter. Exploitation requires high-privilege (administrator) credentials per CVSS PR:H, meaning only authenticated admins - or attackers who have already compromised an admin account - can trigger the flaw. A public proof-of-concept has been disclosed via GitHub, but no CISA KEV listing exists, and no public exploitation activity has been confirmed at this time.
SQL injection in code-projects Visitor Management System 1.0 exposes the `/vms/php/phone_0.php` endpoint to database manipulation via the unsanitized `phone` parameter, exploitable by authenticated remote attackers. A publicly available exploit chain on GitHub (by Xmyronn) explicitly demonstrates escalation from this SQL injection to remote code execution, elevating the real-world severity beyond the CVSS 6.3 base score. No public exploit identified at time of analysis as actively exploited (not in CISA KEV), but the published RCE chain makes this a meaningful risk for any internet-exposed deployment.
SQL injection in code-projects Student Details Management System 1.0 exposes the application's database to unauthenticated remote attackers via the unsanitized `roll` parameter in /index.php. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) confirms this is exploitable over the network with no privileges or user interaction required, and a public proof-of-concept exploit is hosted on GitHub, materially lowering the barrier to exploitation. Impact is rated as partial across confidentiality, integrity, and availability (VC:L/VI:L/VA:L), though SQL injection primitives often enable escalation beyond the initial access implied by the base score.
SQL injection in code-projects Project Management System 1.0 allows remote unauthenticated attackers to manipulate database queries through the login handler (chk.php). The flaw stems from unsanitized input being passed into a SQL statement, enabling authentication-context query tampering and data disclosure. Publicly available exploit code exists, though the vulnerability is not listed in CISA KEV and no active exploitation is confirmed.
SQL injection in code-projects Employee Management System 1.0 allows remote low-privileged attackers to manipulate the `ID` parameter in `/process/applyleaveprocess.php`, enabling unauthorized database read and write operations with partial impact across confidentiality, integrity, and availability. A publicly available proof-of-concept exploit exists on GitHub, though no confirmed active exploitation (CISA KEV) has been recorded. EPSS at 0.03% (8th percentile) and an SSVC assessment of 'not automatable' indicate low broad exploitation likelihood, though the accessible POC meaningfully lowers the barrier for targeted manual attacks against organizations running this application.
SQL injection in the /psubmit.php endpoint of code-projects Employee Management System 1.0 enables authenticated remote attackers to manipulate the pid parameter and inject arbitrary SQL commands against the backend database. A public proof-of-concept exploit has been released on GitHub, reducing the skill barrier for exploitation against unpatched deployments. Despite a low CVSS 4.0 base score of 2.1 reflecting partial impact scope and low-privilege requirements, the combination of network accessibility and public PoC warrants prompt remediation for any internet-facing instance; no public exploit identified meets CISA KEV criteria, and no vendor-released patch has been confirmed at time of analysis.
SQL injection in code-projects Employee Management System 1.0 exposes the /changepassemp.php password-change endpoint to database manipulation by authenticated low-privilege users over the network. The CVSS 4.0 score of 2.1 reflects limited, non-cascading impact - partial confidentiality, integrity, and availability degradation confined to the vulnerable component with no downstream system scope change. A publicly available proof-of-concept exploit exists on GitHub, though the EPSS score of 0.03% (8th percentile) and SSVC 'automatable: no' classification indicate this is unlikely to see widespread opportunistic exploitation; no public exploit identified at time of analysis corroborating active KEV-level campaigns.
Reflected cross-site scripting in code-projects Employee Management System 1.0 allows remote unauthenticated attackers to inject arbitrary JavaScript into victim browsers via the unsanitized `id` parameter in `/applyleave.php`. The attack requires victim interaction (UI:P per CVSS 4.0), meaning a victim must visit or be socially engineered into clicking a crafted URL. Publicly available exploit code exists on GitHub (no public exploit identified at time of analysis for widespread KEV-confirmed exploitation), though EPSS at 0.03% (10th percentile) signals negligible observed exploitation activity at scale.
Reflected cross-site scripting in code-projects Employee Management System 1.0 allows unauthenticated remote attackers to inject and execute arbitrary JavaScript in a victim's browser by manipulating the `ID` parameter of `/empproject.php`. A publicly available proof-of-concept exploit exists on GitHub, lowering the barrier to exploitation, though user interaction is required to trigger the payload. No active exploitation has been confirmed by CISA KEV, and the EPSS score of 0.03% places this in the bottom 10th percentile of exploitation likelihood, consistent with the low CVSS 4.0 score of 2.1.
Buffer overflow in TOTOLINK A800R router firmware 4.1.2cu.5137 enables authenticated remote attackers to achieve arbitrary code execution with high privileges. The vulnerability exists in the setWiFiMultipleConfig function of the wireless configuration module (wireless.so) within the cstecgi.cgi web interface, exploitable via malformed wepkey2 parameter. Public proof-of-concept exploit code is available on GitHub. EPSS data not provided, CISA KEV status not listed, indicating exploitation is demonstrated but not yet observed in widespread campaigns.
In Code-Projects Online Car Rental System 1.0, the file upload feature does not validate file extensions or MIME types allowing an attacker to upload a PHP shell without any restrictions and execute. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Epss exploitation probability 45.1% and no vendor patch available.
Direct web-accessible SQL backup file exposure in code-projects Student Crud Operation 1.0 allows unauthenticated remote attackers to download the raw database dump `/card_activation.sql` from the web root. The file likely contains database schema and card activation records, exposing sensitive application data without any authentication. No public exploit identified at time of analysis is incorrect - publicly available exploit code exists per the referenced GitHub writeup, though no CISA KEV listing is present.
Time-based blind SQL injection in code-projects Student Crud Operation 1.0 allows low-privileged remote attackers to extract database contents by manipulating the `id` parameter in `/edit.php`. A public proof-of-concept exploit documenting the exact technique has been published on GitHub, making exploitation straightforward with automated tooling. No vendor patch has been identified, and the product shows no evidence of active maintenance.
Hospital Information System 1.0 by code-projects exposes its raw SQL database backup file at the web-accessible path `/HIS/his.sql`, allowing unauthenticated remote attackers to download the full database dump over HTTP with no prerequisites. The vulnerability (CWE-200) stems from placing the database export file inside the application's web root without access controls. A public proof-of-concept exploit document is available on GitHub, confirming practical exploitability; no KEV listing has been issued at time of analysis.
Reflected cross-site scripting (XSS) in code-projects Hospital Information System 1.0 allows a remote authenticated attacker to inject arbitrary JavaScript into victim browsers via the unsanitized `id` parameter in `/HIS/src/patients/editPatient.php`. An attacker who can craft a malicious URL and induce an authenticated user to click it can execute scripts in the victim's browser session, enabling session hijacking, credential theft, or UI redress. A public proof-of-concept exploit is available on GitHub; no KEV listing exists, and the CVSS 4.0 score of 2.0 reflects the limited real-world impact given authentication and user-interaction prerequisites.
Unauthenticated remote download of a raw SQL database backup in code-projects Hotel and Tourism Reservation in PHP 1.0 exposes the full application database to any internet-connected attacker. The file /ht/hotel_db%20(1).sql is placed inside the web root without access restrictions, making it directly retrievable over HTTP with no credentials. A publicly available proof-of-concept exploit exists; the database dump likely contains guest PII, booking records, and potentially hashed or plaintext admin credentials.
Reflected cross-site scripting in code-projects Hotel and Tourism Reservation in PHP 1.0 allows unauthenticated remote attackers to inject arbitrary JavaScript via the `room` parameter in `/ht/details.php`. When a victim user follows a crafted URL, the unsanitized parameter is reflected directly into the HTML response, executing attacker-controlled script in the victim's browser context and enabling session hijacking or credential theft. A public proof-of-concept writeup exists on GitHub, though no active exploitation has been confirmed and no CISA KEV listing is present.
Stored cross-site scripting in code-projects Task Management System 1.0 allows authenticated remote attackers to inject malicious scripts via the `lname` parameter in `/user/UpdateUserProfile.php`. When a victim views the tampered profile, the injected script executes in their browser session. A public proof-of-concept exploit is available on GitHub, lowering the bar for exploitation.
SQL injection in the Login component of code-projects Task Management System In PHP 1.0 exposes the application's database to unauthenticated remote attackers via the `email` parameter in `/index.php`. The root cause is unsanitized user input passed directly into a SQL query (CWE-89), enabling authentication bypass and arbitrary data extraction. A public proof-of-concept writeup has been published on GitHub, significantly lowering the exploitation barrier; no vendor patch has been identified.
Unauthenticated remote access to an exposed SQL database backup file in code-projects Daily Expense Manager 1.0 allows any network attacker to retrieve sensitive application data. The file `/Daily-Expense-Manager/exp_ak.sql` - a raw database dump - is served directly from the web root without access control, disclosing potentially credentials, user records, and expense data. No public exploitation via CISA KEV, but a public exploit writeup is available on GitHub confirming the exposure path.
SQL injection in code-projects Content Management System 1.0 allows unauthenticated remote attackers to manipulate database queries via the user_name parameter in /login.php. Because the vulnerable endpoint is the authentication form itself, successful exploitation can achieve authentication bypass - granting admin-level access without credentials - as well as full database enumeration. A public proof-of-concept exploit has been published to GitHub, materially lowering the bar for exploitation.
SQL injection in code-projects Online Shopping System 1.0 allows authenticated administrators to manipulate database queries via the `mobile` parameter in admin/adduser.php. The vulnerable call passes unsanitized user input directly to mysqli_query(), enabling an admin-level attacker to read, modify, or delete database contents. A public proof-of-concept exploit has been published on GitHub; no vendor patch has been identified.
Sensitive database exposure in code-projects Vehicle Management System 1.0 allows unauthenticated remote attackers to download the raw SQL database backup file at /vehicle_management.sql directly over HTTP, leaking the full application database contents. The backup file is stored in or under the web root with no access controls, making it trivially accessible to any internet-connected attacker. A public proof-of-concept is available, and no vendor patch has been identified at time of analysis.
SQL injection in code-projects Doctor Appointment System 1.0 permits unauthenticated remote attackers to manipulate backend database queries by supplying crafted input in the `firstname` parameter of `/contactus.php`. The flaw (CWE-89) stems from unsanitized user input concatenated directly into SQL statements, enabling data extraction or modification without any credentials. A public proof-of-concept exploit is available on GitHub, reducing the barrier for opportunistic attacks despite a moderate CVSS 4.0 score of 6.9.
Unauthenticated SQL injection in code-projects Doctor Appointment System 1.0 exposes the `/patient/booking.php` endpoint to remote database manipulation via the unsanitized `doc_id` parameter. Attackers with network access can extract patient records, appointment data, and stored credentials, or modify database contents without any authentication. Public exploit code exists on GitHub, significantly lowering the bar for exploitation; no vendor patch has been identified at time of analysis.
SQL injection in code-projects Hospital Information System 1.0 allows unauthenticated remote attackers to manipulate database queries through the `ID` parameter of the `getSinglePresp` function in `includes/presp/PrespController.php`. A public exploit has been released via GitHub, lowering the barrier for opportunistic attacks. Successful exploitation could expose sensitive patient records and medical data stored in the backend database, or allow unauthorized data modification.
SQL injection in code-projects Hospital Information System 1.0 allows unauthenticated remote attackers to manipulate backend database queries by supplying a crafted value in the ID argument to the viewReq() function within viewReq.php. The attack requires no authentication or user interaction, and a proof-of-concept exploit is publicly available via a GitHub issue. No vendor patch has been identified at time of analysis, leaving deployments with no official remediation path.
SQL injection in code-projects Hospital Information System 1.0 allows unauthenticated remote attackers to manipulate database queries via the Search argument in the findBySearch() function of addReq.php. The CVSS 4.0 vector confirms network accessibility with no authentication, no complexity, and no user interaction required. Publicly available exploit code exists via a GitHub issue; no CISA KEV listing.
Unauthenticated SQL injection in code-projects Doctor Appointment System 1.0 allows remote attackers to enumerate and extract database contents by exploiting the email parameter in the patient login endpoint (/patient_login.php) via time-based blind techniques. A public GitHub proof-of-concept documents the exact method, lowering the exploitation bar to script-kiddie level. No patch has been released by the vendor; the product appears to be an educational PHP demo with limited production presence.
Unauthenticated SQL injection in code-projects Online Shopping System 1.0 exposes the backend database through the Search Functionality's `keyword` parameter in `/action.php`. The GitHub-linked proof-of-concept specifically documents a time-based blind injection technique, allowing remote attackers without credentials to enumerate database contents, extract data, and potentially modify records. No public KEV listing exists, but exploit code is publicly available, lowering the bar for opportunistic exploitation.
Stored cross-site scripting in code-projects Simple Inventory System 1.0 allows remote unauthenticated attackers to inject persistent JavaScript via the last_name parameter of /register.php during user registration. When an administrator or privileged user subsequently views the registered user list, the stored payload executes in their browser context, enabling session hijacking or credential theft. A public proof-of-concept is available on GitHub; the vulnerability is not listed in CISA KEV and carries a CVSS 4.0 score of 2.1 reflecting limited real-world scope.
Direct remote access to an unprotected SQL database backup file in code-projects Simple Inventory System 1.0 allows unauthenticated attackers to retrieve the full contents of the inventory database without any credentials or user interaction. The file inventorymanagement.sql is stored within the web-accessible directory and is directly downloadable via HTTP. A publicly documented proof-of-concept on GitHub confirms trivial exploitability of this exposure.
Stored cross-site scripting in code-projects Employee Leave Managing System 1.0 allows an authenticated low-privilege employee to inject persistent malicious script via the Name parameter in the Employee Profile Update endpoint (/EmpManageSys/editaction.php). When a privileged user such as an HR administrator subsequently views the tampered employee profile, the payload executes in their browser, enabling session hijacking or unauthorized administrative actions. A public proof-of-concept exploit is available on GitHub; no CISA KEV listing exists, so confirmed in-the-wild exploitation is not established at time of analysis.
Authorization bypass via Insecure Direct Object Reference (IDOR) in the Boarder Management Module of code-projects Barangay Resident Profiling Management System 1.0 allows authenticated remote attackers to access or modify boarder records belonging to other users by manipulating the `ID` parameter in `/boarders.php`. A publicly available proof-of-concept exploit exists on GitHub, materially lowering the exploitation barrier. The vulnerability is not listed in CISA KEV, so no confirmed active exploitation campaigns have been identified at time of analysis.
SQL injection in code-projects Barangay Resident Profiling Management System 1.0 allows unauthenticated remote attackers to manipulate database queries via the Search argument in residents.php. The Resident Search Functionality fails to sanitize user-supplied input before constructing SQL statements, enabling read, write, or denial-of-service impact against the underlying database. A public proof-of-concept exploit is available on GitHub, lowering the bar for opportunistic exploitation; however, the product's extremely limited real-world deployment significantly constrains actual attack surface.
Authorization bypass in code-projects Barangay Resident Profiling Management System 1.0 exposes the /archived_records.php endpoint to insecure direct object reference (IDOR) exploitation, allowing low-privileged authenticated attackers to restore or delete archived resident records they do not own by manipulating the resident_id parameter. A public proof-of-concept exploit is available via GitHub, though the vulnerability is not listed in CISA's Known Exploited Vulnerabilities catalog. The CVSS 4.0 score of 2.1 reflects limited confidentiality, integrity, and availability impact scoped to the vulnerable system with no lateral scope change.
SQL injection in code-projects Simple Inventory System 1.0 allows remote unauthenticated attackers to manipulate backend database queries via the ID parameter in /delete.php. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) confirms no authentication or user interaction is required, enabling exploitation from the network. A public proof-of-concept exploit has been disclosed via GitHub, making this immediately actionable for opportunistic attackers targeting deployments of this PHP application.
Direct HTTP access to an exposed SQL database backup file in code-projects Login Registration System 1.0 allows unauthenticated remote attackers to download the raw database dump at /loginsystem/database/login_registration_system.sql, disclosing user credentials, schema details, and any sensitive data stored in the application database. This is a CWE-552 file exposure defect - the backup artifact is stored within the web-accessible document root with no access controls. No exploitation beyond a standard HTTP GET request is required. A public proof-of-concept exploit exists; no KEV listing at time of analysis.
SQL injection in code-projects Employee Management System 1.0 allows remote unauthenticated attackers to manipulate backend database queries via the `mailuid` parameter at the Admin Login Endpoint (`/process/aprocess.php`). Successful exploitation can result in authentication bypass, credential extraction, or partial data manipulation depending on database user privileges. A public proof-of-concept exploit is available, materially lowering the technical barrier for opportunistic attacks.
SQL injection in code-projects Online Job Portal System 1.0 exposes the unauthenticated Password Recovery endpoint (/ForPass.php) to remote exploitation via the txtUserName parameter. The flaw requires no credentials and no user interaction, meaning any network-reachable instance can be targeted directly. A public proof-of-concept exploit has been disclosed via GitHub, confirming the attack is reproducible; no vendor patch has been identified at time of analysis.
SQL injection in code-projects Task Management System 1.0 exposes the login endpoint at /index.php to unauthenticated remote exploitation via the email parameter. The vulnerable function Operation::select_with_multiple_condition fails to sanitize user input before constructing SQL queries, enabling authentication bypass or database enumeration. A public proof-of-concept exploit is available per VulDB and a linked GitHub issue, materially lowering the skill threshold for exploitation; no confirmed CISA KEV listing exists at time of analysis.
Reflected cross-site scripting in code-projects Online Shopping System 1.0 allows remote attackers to inject arbitrary JavaScript into victim browsers by manipulating the email argument in offersmail.php. The vulnerability requires no authentication (PR:N per CVSS 4.0 vector) but does require a victim to interact with a crafted link or page (UI:P). Publicly available exploit code exists on GitHub, though no active exploitation has been confirmed by CISA KEV.
SQL injection in code-projects Online Shopping System 1.0 allows remote low-privileged attackers to manipulate the `total_count` parameter in `/checkout_process.php` to execute arbitrary SQL commands against the backend database. The CVSS 4.0 score is 5.3 (Medium) with partial confidentiality, integrity, and availability impact; no subsequent-system scope change is indicated. A public proof-of-concept exploit is available on GitHub, substantially lowering the bar for opportunistic exploitation - though the product's niche footprint limits broad real-world blast radius.
Cross-site scripting in code-projects Online Shopping System 1.0 allows remote low-privileged attackers to inject arbitrary JavaScript into victim browsers via the unsanitized `amount_1` parameter in `/checkout.php`, enabling session hijacking, credential theft, or UI manipulation against users who interact with the crafted response. The affected product is a PHP-based e-commerce application distributed by code-projects.org, with the vulnerability tracked exclusively through VulDB. A public proof-of-concept exploit has been released on GitHub, elevating the practical risk beyond the moderate CVSS 4.0 score of 5.1 suggests in isolation.
Missing authorization in code-projects Task Management System 1.0 allows remote unauthenticated attackers to manipulate task records by sending crafted requests to /user/UpdateTaskStatus.php with arbitrary task_id and val parameters. The server performs no permission check before processing the status update, enabling any network-reachable party to alter task data belonging to any user. A public proof-of-concept exploit exists per VulDB and a GitHub issue report, making opportunistic abuse straightforward despite the absence of a CISA KEV listing.
SQL injection in code-projects Task Management System 1.0 exposes unauthenticated remote attackers a path to manipulate database queries through the task_id parameter in /user/comment_count_user.php. The flaw is a textbook CWE-89 input-neutralization failure in a PHP application with no authentication barrier, and exploit code has been publicly disclosed via GitHub. No CISA KEV listing exists at time of analysis, but the zero-authentication network attack vector combined with available proof-of-concept code significantly lowers the exploitation bar.
SQL injection in code-projects Task Management System 1.0 exposes the pre-authentication admin login endpoint at /admin/AdminLogin.php to unauthenticated remote attackers who can manipulate the email or password parameters to execute arbitrary SQL commands. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) confirms fully unauthenticated, low-complexity network exploitation with no special conditions required. A public proof-of-concept exploit has been published on GitHub, materially lowering the skill threshold for exploitation; however, this CVE does not appear in the CISA KEV catalog at time of analysis.
Authentication bypass in code-projects Task Management System 1.0 exposes the login endpoint at /index.php to remote unauthenticated attackers who can manipulate the Password parameter to circumvent credential verification entirely. The flaw is classified under CWE-287 (Improper Authentication) and affects all known versions of this PHP application per the wildcard CPE string. A public proof-of-concept exploit is available on GitHub, and no vendor-released patch has been identified at time of analysis.
Cross-site scripting in code-projects Online Examination System 1.0 allows remote attackers to inject arbitrary JavaScript by manipulating the eid, n, or t parameters in the /account.php?q=quiz endpoint. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:P) confirms unauthenticated remote exploitation requiring only passive victim interaction, consistent with a reflected XSS delivery via crafted link. A proof-of-concept exploit is publicly available on GitHub; this CVE is not listed in the CISA KEV catalog, so no confirmed active exploitation has been identified at time of analysis.
SQL injection in the Login Form of code-projects Hospital Bed Management System 1.0 exposes unauthenticated remote attackers to database manipulation via the Username parameter. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) confirms trivial, unauthenticated network exploitation with no user interaction, and the E:P modifier reflects a publicly available proof-of-concept on Gitee. While not listed in CISA KEV, the low barrier to exploitation combined with a public POC elevates practical urgency for any organization running this software, despite the product's niche footprint.
Cross-site scripting in code-projects Online Job Portal 1.0 allows a remote, low-privileged attacker to inject malicious JavaScript via the /Admin/DetailJob.php endpoint, which executes in the browser of any user who views the affected page. The CVSS 4.0 vector (PR:L/UI:P) confirms that exploitation requires an authenticated session and passive victim interaction, constraining but not eliminating real-world risk. A public proof-of-concept has been disclosed on GitHub; no patch from the vendor has been identified at time of analysis.
Unrestricted file upload in code-projects Online Job Portal 1.0 exposes unauthenticated remote attackers to arbitrary file upload via the txtFile parameter in /JobSeekerInsert.php, enabling likely webshell deployment and subsequent server-side code execution. A public proof-of-concept exploit exists (no KEV listing), substantially lowering the exploitation barrier for any internet-exposed instance. The CVSS 4.0 impact metrics are conservatively rated Low across C/I/A, which understates the realistic post-exploitation potential of an unrestricted PHP file upload - successful webshell placement typically yields full OS command execution in the web server process context.
SQL injection in code-projects Online Job Portal 1.0 exposes the /Admin/DeleteUser.php endpoint to unauthenticated remote database manipulation. An attacker can craft HTTP requests that inject arbitrary SQL, enabling data extraction, modification, or deletion from the underlying database. A public proof-of-concept exploit exists (GitHub: shihuizhang-dazhi/MY-CVE/issues/4), lowering the bar for exploitation; this vulnerability is not currently listed in CISA KEV.
SQL injection in code-projects Online Job Portal 1.0 exposes the /Admin/EditUser.php endpoint to remote database manipulation via the unsanitized UserId parameter. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) classifies this as remotely exploitable with no authentication or interaction required, though the Admin path location raises questions about actual auth gating in practice. A public exploit exists (E:P confirmed in CVSS 4.0 and via GitHub issue), lowering the skill bar for exploitation considerably; this CVE is not currently listed in CISA KEV.
SQL injection in code-projects Interview Management System 1.0 exposes the application to remote, unauthenticated database manipulation via the ID parameter in /inc/classes/View.php. An attacker with network access can read, modify, or partially disrupt data stored in the underlying database with no authentication required and no user interaction needed. A public exploit exists (referenced via GitHub at https://github.com/susususua-AI/CVE/issues/2), though no active exploitation has been confirmed by CISA KEV as of this analysis.
SQL injection in code-projects Real State Services 1.0 exposes the `/pay.php` endpoint to remote unauthenticated attackers who can manipulate the `Bankname` parameter to execute arbitrary SQL commands against the backend database. A public proof-of-concept exploit has been disclosed on GitHub, materially lowering the skill threshold for exploitation. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) confirms zero-friction remote reachability, though partial CIA impact scores indicate constrained blast radius rather than full database takeover; no public confirmation of active exploitation (CISA KEV) exists at time of analysis.
SQL injection in code-projects Hotel and Tourism Reservation 1.0 allows remote attackers to manipulate the backend database via the fdetails parameter in /admin/add_event.php. The flaw is reachable over the network with no authentication required per the CVSS 4.0 vector, enabling data extraction, modification, or disruption against the application's database. A public exploit has been disclosed on GitHub; no patch has been identified at time of analysis.
SQL injection in code-projects Hotel and Tourism Reservation 1.0 allows remote attackers to manipulate the unsanitized `tour` parameter in /admin/tour_reserves.php, enabling arbitrary SQL query execution against the backend database. The CVSS 4.0 vector assigns PR:N (no privileges required), though the admin-panel endpoint raises questions about whether authentication is genuinely absent or misconfigured - a discrepancy worth verifying in deployments. A public proof-of-concept exploit has been published via GitHub, raising the practical risk despite the medium CVSS 4.0 score of 6.9 and absence of CISA KEV listing.
SQL injection in code-projects Hotel and Tourism Reservation 1.0 exposes the reservation database to remote manipulation via the `delete_image` parameter in the admin Tour Management Page (`/admin/add_tour.php`). The CVSS 4.0 vector asserts no privileges required (PR:N), yet the vulnerable endpoint sits under an `/admin/` path - this conflict is unresolved in available data and defenders must verify whether the admin panel is publicly accessible without authentication. A public proof-of-concept is available on GitHub, elevating practical risk beyond the moderate base score, though no CISA KEV listing indicates confirmed widespread exploitation at time of analysis.
SQL injection in code-projects Hotel and Tourism Reservation 1.0 exposes the /admin/reservations.php endpoint to database manipulation via the unsanitized `delete` parameter. The vulnerability is reachable over the network with no confirmed complexity barriers, and a public proof-of-concept exploit has been disclosed. No vendor patch has been identified, leaving all deployments of version 1.0 exposed to database read, write, and potential full compromise of hosted reservation data.
SQL injection in code-projects Real State Services 1.0 exposes the application's database to remote unauthenticated manipulation via the `amen` parameter in `/addprojectsale.php`. Any attacker with network access to the PHP web application can craft a malicious HTTP request to read, modify, or partially disrupt the underlying database without authentication. No active exploitation is confirmed in CISA KEV, but a GitHub issue filed under the researcher's CVE repository suggests reproduction steps or proof-of-concept detail is publicly accessible.
SQL injection in code-projects Real State Services 1.0 allows remote unauthenticated attackers to manipulate the backend database via the `amen` parameter in `/addprojectrent.php`. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) confirms trivial, unauthenticated network exploitation with no attack preconditions. A publicly available proof-of-concept exploit has been disclosed via GitHub, elevating the realistic threat beyond theoretical; however, this CVE is not currently listed in the CISA KEV catalog, and the product's limited enterprise footprint constrains broad impact.
SQL injection in code-projects Real State Services 1.0 allows remote unauthenticated attackers to manipulate the `id` parameter of `/single-list_rent.php` to read, modify, or corrupt backend database contents. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) confirms zero-friction unauthenticated network exploitation against a standard installation. A public proof-of-concept exploit is available on GitHub (E:P confirmed in CVSS 4.0 supplemental metrics), raising realistic risk of opportunistic automated attacks against any internet-exposed instance; no CISA KEV listing and no patch are confirmed at time of analysis.
SQL injection in code-projects Real State Services 1.0 exposes unauthenticated remote attackers a direct path to manipulate the backend database via the `loc` parameter in `/normalHomeRent.php`. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) confirms no authentication, no user interaction, and no special configuration are required against default deployments. A public proof-of-concept exploit has been released on GitHub, materially increasing opportunistic exploitation risk despite the moderate aggregate score; no CISA KEV listing has been identified at time of analysis.
SQL injection in code-projects Real State Services 1.0 exposes the `/normalHomeSale.php` endpoint to unauthenticated remote database manipulation via the unsanitized `loc` parameter. Any internet-accessible deployment of this PHP real estate application is vulnerable to data extraction or modification without credentials. A public proof-of-concept exploit is available on GitHub, lowering the skill barrier for opportunistic attackers; however, no CISA KEV listing has been issued and no patch has been identified from the vendor.
SQL injection in code-projects Online Examination 1.0 allows authenticated remote attackers to manipulate database queries through multiple unsanitized parameters in the Quiz Creation Feature. The endpoint /update.php?q=addquiz accepts user-supplied input for the name, total, right, wrong, time, tag, and desc arguments without adequate sanitization, enabling read and write access to the underlying database. A public proof-of-concept exploit exists on GitHub, though the application's extremely limited deployment footprint constrains real-world impact.
SQL injection in code-projects Online Examination 1.0 exposes the login endpoint to unauthenticated remote attackers via the uname and password parameters in head.php. Manipulation of either parameter enables classic SQL injection, allowing database enumeration, authentication bypass, and potential data manipulation against any deployed instance. A public proof-of-concept exploit is available on GitHub (no public exploit identified as KEV), making weaponization trivial for low-skill attackers targeting this application.
SQL injection in code-projects Internship Management System 1.0 exposes authenticated employer accounts to database query manipulation via the `Current` parameter in the password change endpoint (`employer/details/change_password.php`). The flaw carries a CVSS 4.0 score of 5.3, is rooted in unsanitized PHP input passed directly into SQL queries (CWE-89), and has a publicly available proof-of-concept exploit on GitHub. No public exploit identified as confirmed in CISA KEV, but the combination of low attack complexity and public PoC meaningfully raises real-world exploitation likelihood against any internet-exposed deployment.
SQL injection in code-projects Internship Management System 1.0 permits unauthenticated remote attackers to manipulate the email and password parameters of employer/login.php, altering backend SQL query logic to bypass authentication or partially expose database contents. A proof-of-concept exploit has been publicly disclosed on GitHub, materially lowering the skill threshold for exploitation. The CVSS 4.0 score of 6.9 with PR:N and no attack complexity reflects straightforward unauthenticated access, though impact is bounded at Low across confidentiality, integrity, and availability - suggesting partial rather than full database compromise.
SQL injection in code-projects Online Job Portal 1.0 exposes the login.php endpoint to remote unauthenticated exploitation via the txtUser and txtPass parameters, enabling attackers to manipulate backend SQL queries without any credentials or user interaction. A public proof-of-concept exploit is documented on GitHub, significantly lowering the barrier to attack for any internet-exposed instance. No patch has been identified from the vendor at time of analysis; the wildcard CPE suggests all versions are affected.
SQL injection in code-projects Assessment Management 1.0 allows authenticated remote attackers to execute arbitrary SQL queries by manipulating the smarksrange[] array parameter in /lecturer/marking-scheme.php. The CVSS 4.0 vector (PR:L) confirms low-privilege authentication is required, limiting the attack surface to registered users such as lecturers. A public exploit proof-of-concept is available on GitHub, elevating the practical risk despite the medium CVSS 4.0 score of 5.3 and no confirmed active exploitation in the CISA KEV catalog.
SQL injection in code-projects Assessment Management 1.0 exposes database query handling in the lecturer marking-scheme feature to manipulation via the unsanitized `squestions[]` parameter at `/lecturer/marking-scheme.php`. Authenticated remote attackers with low-privilege access can alter SQL query logic to extract or modify student assessment data. A public proof-of-concept exploit is documented on GitHub, lowering the skill bar for exploitation; however, the application is not listed in CISA KEV and carries a CVSS 4.0 score of 2.1 reflecting its constrained impact and authentication prerequisite.
Cross-site scripting in code-projects Assessment Management 1.0 allows remote unauthenticated attackers to inject malicious scripts via the unsanitized `ID` parameter in `/admin/remove-user.php`. A public proof-of-concept exploit is available on GitHub (E:P in the CVSS 4.0 supplemental metrics), lowering the bar for exploitation. The vulnerability is not listed in the CISA KEV catalog, so confirmed widespread active exploitation has not been established, though the admin-facing endpoint makes session hijacking of privileged users a realistic outcome.
Cross-site scripting (XSS) in code-projects Assessment Management 1.0 allows a remote attacker with administrative credentials to inject malicious scripts via the User parameter in admin/view-users.php, executing arbitrary JavaScript in the browser context of users who view the affected admin page. The CVSS 4.0 vector (PR:H, UI:P) confirms exploitation is gated behind high-privilege authentication and requires a victim to load the tampered page. A public proof-of-concept exploit exists on GitHub, though no active exploitation or CISA KEV listing has been identified at time of analysis.
Unauthenticated SQL injection in code-projects Online Voting System 0.x-1.0 exposes the admin login endpoint to full authentication bypass and database extraction. The vulnerability resides in the `test_input` function within `/authentication.php`, where the `adminUserName` and `adminPassword` parameters are passed unsanitized into SQL queries, enabling classic injection attacks against the login form. A public proof-of-concept exploit has been published on GitHub; no vendor patch has been identified at time of analysis.
Cross-site scripting in code-projects Online Music Site 1.0 allows unauthenticated remote attackers to inject malicious scripts via the feedback form's fname, femail, faddress, or fmessage parameters handled by /Frontend/Feedback.php. The CVSS 4.0 score of 2.1 (Low) reflects the UI:P requirement - a victim must interact with the crafted content for the payload to execute, limiting autonomous exploitation. A public proof-of-concept is available via GitHub, though no confirmed active exploitation (CISA KEV) has been recorded.
Cross-site scripting in code-projects Project Management System 1.0 allows a remote authenticated attacker to inject malicious scripts via the /mail.php Mail Compose Page, targeting other users who interact with the crafted mail content. The CVSS 4.0 vector (PR:L/UI:P) confirms exploitation requires a low-privileged authenticated session and passive victim interaction, limiting scope but not eliminating risk in shared environments. A public proof-of-concept exploit has been disclosed on GitHub; no KEV listing and no vendor patch have been identified at time of analysis.
SQL injection in code-projects Online Music Site 1.0 allows remote unauthenticated attackers to manipulate the Category parameter in /Frontend/Search.php to execute arbitrary SQL commands against the backend database. Publicly available exploit code exists (disclosed via GitHub), increasing the practical risk despite the small footprint of this PHP application. No active exploitation has been confirmed in CISA KEV at the time of analysis.
SQL injection in code-projects Online Music Site 1.0 allows remote attackers to manipulate the ID parameter in /Administrator/PHP/AdminDeleteAlbum.php to execute arbitrary database queries. Publicly available exploit code exists (published via GitHub and tracked by VulDB), and the flaw is reachable over the network without authentication per the CVSS vector. There is no public exploit identified as actively used in the wild (not CISA KEV), but the combination of trivial attack complexity and public PoC raises the practical exploitation risk for any exposed deployment.
SQL injection in code-projects Simple Flight Ticket Booking System 1.0 allows remote unauthenticated attackers to manipulate database queries via the Username POST parameter in checkUser.php. Publicly available exploit code exists (disclosed via GitHub), increasing the likelihood of opportunistic attacks against exposed instances, though the issue is not listed in CISA KEV. The CVSS 3.1 base score of 7.3 reflects network-reachable, low-complexity exploitation with no privileges or user interaction required.
Unrestricted file upload in code-projects Vehicle Management System 1.0 allows remote unauthenticated attackers to upload arbitrary files via the photo parameter of the New Driver Registration Form (newdriver.php), enabling remote code execution. Publicly available exploit code exists on GitHub, increasing the likelihood of opportunistic abuse against exposed instances despite no CISA KEV listing.
SQL injection in code-projects Hotel and Tourism Reservation System 1.0 allows remote unauthenticated attackers to manipulate the 'room' parameter of /details.php to inject arbitrary SQL queries. Publicly available exploit code exists (published via GitHub by researcher and indexed by VulDB), increasing the likelihood of opportunistic exploitation against exposed instances. The flaw is reachable over the network with no privileges or user interaction, making any internet-facing deployment of this PHP application a viable target.
SQL injection in code-projects Student Admission System 1.0 allows remote unauthenticated attackers to manipulate the 'eid' and 'did' parameters in /index.php to inject arbitrary SQL queries. Publicly available exploit code exists (referenced via GitHub issue tracker), increasing the likelihood of opportunistic attacks against exposed deployments. The vulnerability carries a CVSS 3.1 base score of 7.3, with low impact across confidentiality, integrity, and availability, but no special prerequisites for exploitation.
Insecure Direct Object Reference (IDOR) in code-projects Online Hospital Management System 1.0 allows a high-privileged remote attacker to manipulate the `delid` parameter in `viewdoctortimings.php`, resulting in unauthorized modification or deletion of doctor timing records beyond the attacker's intended access scope. The CVSS 4.0 score of 2.0 reflects the high privilege prerequisite (PR:H), low integrity impact (VI:L), and low availability impact (VA:L) to the vulnerable component. No public exploit identified at time of analysis as active exploitation - however, publicly available exploit code exists, documented in a GitHub proof-of-concept writeup.
SQL injection in code-projects Hotel and Tourism Reservation System 1.0 allows remote unauthenticated attackers to manipulate the `tour` GET parameter in `tour.php` to inject arbitrary SQL into backend database queries. Publicly available exploit code exists (hosted on GitHub), enabling low-skilled attackers to extract or modify database contents, though no CISA KEV listing or EPSS signal indicates widespread active exploitation at this time.
Cross-site scripting in code-projects Hotel and Tourism Reservation System 1.0 allows remote unauthenticated attackers to inject and execute arbitrary JavaScript by manipulating the name, email, people, or number parameters submitted to /ht/tour.php. The POC repository title ('Stored-XSS') strongly suggests this is a persistent (stored) XSS variant, meaning injected payloads survive in the application and execute in the browsers of subsequent users who view the affected reservation data - not merely the attacker's own session. Publicly available exploit code exists; this CVE has not been added to the CISA KEV catalog at time of analysis.
Authentication bypass in code-projects Hotel and Tourism Reservation System 1.0 allows remote attackers to defeat admin login by manipulating the Password argument processed by the password_verify function in /admin/login.php. The flaw is reachable over the network without prior authentication, and publicly available exploit code exists, increasing the likelihood of opportunistic abuse against exposed deployments.
SQL injection in code-projects Online Hospital Management System 1.0 exposes backend database contents via the `editid` parameter in `appointmentdetail.php`. A low-privilege authenticated attacker can remotely manipulate SQL queries to read, modify, or corrupt patient and appointment records. A proof-of-concept exploit is publicly available per the GitHub reference, raising the likelihood of opportunistic exploitation against internet-facing deployments of this PHP application.
SQL injection in code-projects Online Hospital Management System 1.php enables remote unauthenticated attackers to manipulate the Username parameter sent to the login_user function in login_1.php, allowing arbitrary SQL query execution against the backend database. Publicly available exploit code exists (published on GitHub by researcher Mi0uno), increasing the likelihood of opportunistic exploitation, though the CVE is not listed in CISA KEV and EPSS data is not provided. Per CVSS, exploitation requires no authentication or user interaction and impacts confidentiality, integrity, and availability at a low level (CVSS 7.3).
SQL injection in code-projects Online Music Site 1.0 allows remote unauthenticated attackers to manipulate the ID parameter of /Administrator/PHP/AdminEditAlbum.php to inject arbitrary SQL queries. Publicly available exploit code exists (disclosed via VulDB submission 819912 and a GitHub issue), though there is no CISA KEV listing and no EPSS data provided to gauge exploitation probability. The vulnerability carries a CVSS 7.3 score reflecting low complexity and no authentication requirement, but only partial CIA impact.
SQL injection in code-projects Online Music Site 1.0 exposes the administrator backend endpoint /Administrator/PHP/AdminUpdateAlbum.php to database manipulation via an unsanitized ID parameter. Exploitation requires high-privilege (administrator) credentials per CVSS PR:H, meaning only authenticated admins - or attackers who have already compromised an admin account - can trigger the flaw. A public proof-of-concept has been disclosed via GitHub, but no CISA KEV listing exists, and no public exploitation activity has been confirmed at this time.
SQL injection in code-projects Visitor Management System 1.0 exposes the `/vms/php/phone_0.php` endpoint to database manipulation via the unsanitized `phone` parameter, exploitable by authenticated remote attackers. A publicly available exploit chain on GitHub (by Xmyronn) explicitly demonstrates escalation from this SQL injection to remote code execution, elevating the real-world severity beyond the CVSS 6.3 base score. No public exploit identified at time of analysis as actively exploited (not in CISA KEV), but the published RCE chain makes this a meaningful risk for any internet-exposed deployment.
SQL injection in code-projects Student Details Management System 1.0 exposes the application's database to unauthenticated remote attackers via the unsanitized `roll` parameter in /index.php. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) confirms this is exploitable over the network with no privileges or user interaction required, and a public proof-of-concept exploit is hosted on GitHub, materially lowering the barrier to exploitation. Impact is rated as partial across confidentiality, integrity, and availability (VC:L/VI:L/VA:L), though SQL injection primitives often enable escalation beyond the initial access implied by the base score.
SQL injection in code-projects Project Management System 1.0 allows remote unauthenticated attackers to manipulate database queries through the login handler (chk.php). The flaw stems from unsanitized input being passed into a SQL statement, enabling authentication-context query tampering and data disclosure. Publicly available exploit code exists, though the vulnerability is not listed in CISA KEV and no active exploitation is confirmed.
SQL injection in code-projects Employee Management System 1.0 allows remote low-privileged attackers to manipulate the `ID` parameter in `/process/applyleaveprocess.php`, enabling unauthorized database read and write operations with partial impact across confidentiality, integrity, and availability. A publicly available proof-of-concept exploit exists on GitHub, though no confirmed active exploitation (CISA KEV) has been recorded. EPSS at 0.03% (8th percentile) and an SSVC assessment of 'not automatable' indicate low broad exploitation likelihood, though the accessible POC meaningfully lowers the barrier for targeted manual attacks against organizations running this application.
SQL injection in the /psubmit.php endpoint of code-projects Employee Management System 1.0 enables authenticated remote attackers to manipulate the pid parameter and inject arbitrary SQL commands against the backend database. A public proof-of-concept exploit has been released on GitHub, reducing the skill barrier for exploitation against unpatched deployments. Despite a low CVSS 4.0 base score of 2.1 reflecting partial impact scope and low-privilege requirements, the combination of network accessibility and public PoC warrants prompt remediation for any internet-facing instance; no public exploit identified meets CISA KEV criteria, and no vendor-released patch has been confirmed at time of analysis.
SQL injection in code-projects Employee Management System 1.0 exposes the /changepassemp.php password-change endpoint to database manipulation by authenticated low-privilege users over the network. The CVSS 4.0 score of 2.1 reflects limited, non-cascading impact - partial confidentiality, integrity, and availability degradation confined to the vulnerable component with no downstream system scope change. A publicly available proof-of-concept exploit exists on GitHub, though the EPSS score of 0.03% (8th percentile) and SSVC 'automatable: no' classification indicate this is unlikely to see widespread opportunistic exploitation; no public exploit identified at time of analysis corroborating active KEV-level campaigns.
Reflected cross-site scripting in code-projects Employee Management System 1.0 allows remote unauthenticated attackers to inject arbitrary JavaScript into victim browsers via the unsanitized `id` parameter in `/applyleave.php`. The attack requires victim interaction (UI:P per CVSS 4.0), meaning a victim must visit or be socially engineered into clicking a crafted URL. Publicly available exploit code exists on GitHub (no public exploit identified at time of analysis for widespread KEV-confirmed exploitation), though EPSS at 0.03% (10th percentile) signals negligible observed exploitation activity at scale.
Reflected cross-site scripting in code-projects Employee Management System 1.0 allows unauthenticated remote attackers to inject and execute arbitrary JavaScript in a victim's browser by manipulating the `ID` parameter of `/empproject.php`. A publicly available proof-of-concept exploit exists on GitHub, lowering the barrier to exploitation, though user interaction is required to trigger the payload. No active exploitation has been confirmed by CISA KEV, and the EPSS score of 0.03% places this in the bottom 10th percentile of exploitation likelihood, consistent with the low CVSS 4.0 score of 2.1.