Code Projects
Monthly
Stored cross-site scripting (XSS) in code-projects Simple Laundry System 1.0 allows unauthenticated remote attackers to inject malicious scripts via the firstName parameter in /modifymember.php, which are executed in the context of other users' browsers. The vulnerability has a CVSS score of 4.3 with low impact severity but publicly available exploit code, though exploitation requires user interaction (UI:R). This represents a typical reflected or stored XSS in a parameter handler with limited immediate risk due to no confidentiality or availability impact, though it enables session hijacking and credential theft.
SQL injection in code-projects Simple Laundry System 1.0 allows unauthenticated remote attackers to manipulate the userid parameter in /delstaffinfo.php, enabling arbitrary SQL query execution with limited data confidentiality and integrity impact. Public exploit code is available, increasing real-world risk despite the moderate CVSS score of 6.9.
SQL injection in code-projects Simple Laundry System 1.0 allows unauthenticated remote attackers to manipulate the firstName parameter in /modify.php, enabling arbitrary database queries and potential data exfiltration or modification. The vulnerability affects the Parameter Handler component through CWE-74 (Improper Neutralization of Special Elements in Output Used by a Downstream Component). Publicly available exploit code exists, and the CVSS 6.9 score reflects moderate impact with low attack complexity and no authentication requirement.
Reflected cross-site scripting (XSS) in code-projects Simple Laundry System 1.0 allows unauthenticated remote attackers to inject malicious scripts via the userid parameter in /delstaffinfo.php, with public exploit code available. The vulnerability requires user interaction (clicking a crafted link) and has low confidentiality impact but can enable session hijacking, credential theft, or malware distribution.
SQL injection in code-projects Simple Gym Management System 1.0 Payment Handler allows authenticated remote attackers to manipulate Payment_id, Amount, customer_id, payment_type, and customer_name parameters to execute arbitrary SQL queries, potentially leading to unauthorized data access or modification. Publicly available exploit code exists for this vulnerability; patch status from vendor remains unconfirmed.
SQL injection in code-projects Student Membership System 1.0 admin login allows unauthenticated remote attackers to bypass authentication and access sensitive data via crafted username/password parameters at /admin/index.php. Publicly available exploit code exists (VulDB 354296, GitHub POC), enabling trivial exploitation with no attack complexity. CVSS 7.3 reflects network-accessible attack with low confidentiality/integrity/availability impact. No vendor-released patch identified at time of analysis.
SQL injection in code-projects Student Membership System 1.0 allows authenticated remote attackers to execute arbitrary SQL queries via the ID parameter in /delete_user.php, enabling unauthorized data exfiltration or manipulation. The vulnerability has CVSS score 5.3 (medium severity) with publicly available exploit code, though it requires authenticated access (PR:L) and carries low confidentiality, integrity, and availability impact per CVSS v4.0 assessment.
SQL injection in code-projects Student Membership System 1.0 allows authenticated remote attackers to execute arbitrary SQL commands via the ID parameter in /delete_member.php, resulting in limited confidentiality and integrity impact. Publicly available exploit code exists, and the vulnerability has been disclosed; however, active exploitation has not been confirmed by CISA. The attack requires valid authentication credentials but can be initiated over the network with minimal complexity.
SQL injection in code-projects Student Membership System 1.0 allows unauthenticated remote attackers to extract, modify, or delete database contents via the User Registration Handler component. The vulnerability has a CVSS score of 7.3 with network-based attack vector and low complexity, requiring no privileges or user interaction. EPSS data not available; no CISA KEV listing indicates confirmed actively exploited status is unknown. Publicly available exploit code exists per researcher disclosure on GitHub, elevating real-world risk for organizations running this application.
Reflected cross-site scripting (XSS) in code-projects Online Food Ordering System 1.0 allows unauthenticated remote attackers to inject malicious scripts via the cust_id parameter in /form/order.php, exploitable through user interaction (UI required). Publicly available exploit code exists; the vulnerability carries CVSS 4.3 (low severity) but poses reputational and user session hijacking risks typical of XSS attacks in e-commerce contexts.
Reflected cross-site scripting (XSS) in code-projects Exam Form Submission 1.0 allows authenticated remote attackers to inject malicious scripts via the sname parameter in /admin/update_fst.php, affecting user sessions with administrator privileges. The vulnerability requires user interaction (UI:R) and carries a low CVSS score of 2.4 due to the requirement for prior administrative authentication (PR:H), but publicly available exploit code exists and may be actively used. The attack vector is network-based (AV:N) with low complexity (AC:L), creating an insider threat scenario where compromised or malicious administrators can deface content or steal session tokens of other administrators.
Command injection in code-projects Chamber of Commerce Membership Management System 1.0 allows authenticated remote attackers with high privileges to execute arbitrary commands via manipulation of the mailSubject and mailMessage parameters in the admin/pageMail.php file. The vulnerability has a publicly available exploit and a moderate CVSS score of 4.7, but real-world risk is constrained by the requirement for high-privilege authenticated access.
SQL injection in code-projects Accounting System 1.0 allows unauthenticated remote attackers to execute arbitrary SQL queries via the en_id parameter in /view_work.php, potentially leading to unauthorized data access, modification, or deletion. Public exploit code is available, increasing practical exploitation risk despite the moderate CVSS score of 6.9.
SQL injection in code-projects Accounting System 1.0 allows unauthenticated remote attackers to execute arbitrary SQL commands via the cos_id parameter in /edit_costumer.php. The vulnerability has a CVSS 4.0 score of 6.9 with low impact to confidentiality, integrity, and availability. Publicly available exploit code exists, elevating real-world risk despite moderate CVSS severity.
SQL injection in code-projects Accounting System 1.0 allows unauthenticated remote attackers to extract, modify, or delete database contents via the cos_id parameter in /view_costumer.php. Publicly available exploit code exists (GitHub POC published), enabling trivial exploitation with no authentication required. CVSS 7.3 reflects high exploitability (AV:N/AC:L/PR:N) with partial impact across confidentiality, integrity, and availability. No vendor-released patch identified at time of analysis.
SQL injection in code-projects Simple Food Order System 1.0 allows unauthenticated remote attackers to extract, modify, or delete database contents via the Status parameter in all-orders.php. The vulnerability has a publicly available exploit and requires no authentication or user interaction (CVSS 7.3, AV:N/AC:L/PR:N). No vendor-released patch identified at time of analysis, representing elevated risk for installations of this PHP-based food ordering application.
SQL injection in code-projects Simple Food Order System 1.0 allows unauthenticated remote attackers to execute arbitrary SQL commands via the 'Name' parameter in register-router.php. The vulnerability permits unauthorized database access with confirmed publicly available exploit code (EPSS and CVSS both indicate medium-severity risk). Attack complexity is low with no user interaction required, enabling automated exploitation. No vendor-released patch identified at time of analysis, and exploitation requires no authentication (CVSS PR:N).
SQL injection in Simple Food Order System 1.0 allows unauthenticated remote attackers to extract, modify, or delete database contents via the Status parameter in /all-tickets.php. The vulnerability is trivially exploitable with low attack complexity and requires no user interaction. Public exploit code exists on GitHub, significantly lowering the barrier to exploitation, though no active exploitation has been confirmed by CISA KEV at time of analysis.
Stored cross-site scripting (XSS) in code-projects Online Reviewer System up to version 1.0 allows authenticated users with high privileges to inject malicious scripts via the Description parameter in /system/system/students/assessments/databank/btn_functions.php, which are then executed in the context of other users' browsers. The vulnerability requires user interaction (UI:R) and has publicly available exploit code, but poses minimal real-world risk given the high privilege requirement (PR:H) and low impact severity (CVSS 2.4).
SQL injection in code-projects Social Networking Site 1.0 allows authenticated remote attackers to execute arbitrary SQL queries via the ID parameter in delete_photos.php, potentially enabling unauthorized data access, modification, or deletion. The vulnerability affects an unknown function in the Endpoint component and has publicly available exploit code, increasing the likelihood of active abuse despite the moderate CVSS 5.3 score.
Stored cross-site scripting (XSS) in code-projects Social Networking Site 1.0 allows authenticated remote attackers to inject malicious scripts via the content parameter in the Alert Handler component (/home.php), requiring user interaction to trigger. The vulnerability carries a CVSS score of 5.1 (medium) with publicly available exploit code, though no confirmed active exploitation in the wild has been reported. Affected users can have their sessions hijacked or credentials stolen if they interact with malicious alerts crafted by authenticated attackers.
Stored cross-site scripting (XSS) in code-projects Exam Form Submission 1.0 allows authenticated remote attackers to inject malicious scripts via the sname parameter in /admin/update_s7.php, potentially compromising administrator sessions and enabling unauthorized actions. Publicly available exploit code exists for this vulnerability, though it requires high-privilege authentication to trigger. The CVSS 2.4 score reflects limited impact (information integrity only) and the requirement for authenticated access and user interaction, but the public availability of working exploit code elevates practical risk.
SQL injection in code-projects Simple Laundry System 1.0 allows unauthenticated remote attackers to extract, modify, or delete database contents via the userid parameter in /modstaffinfo.php. Publicly available exploit code exists on GitHub, significantly lowering the barrier to exploitation. The CVSS score of 7.3 reflects network accessibility without authentication requirements (PR:N), though impact is rated as Low across confidentiality, integrity, and availability.
A security vulnerability in A weakness (CVSS 5.5). Risk factors: public PoC available.
The code-projects Online Food Ordering System versions up to 1.0 contain a stored cross-site scripting (XSS) vulnerability in the /dbfood/food.php file via the cuisines parameter, allowing authenticated attackers with high privileges to inject malicious scripts that execute in users' browsers. The vulnerability carries a CVSS score of 2.4 (low severity) but has publicly available exploit code and confirmed documentation on GitHub, limiting its practical impact due to high privilege requirements and user interaction dependency. Remote exploitation is possible, but the attack requires an authenticated user with high-level administrative privileges and victim user interaction, substantially constraining real-world exploitation likelihood.
The Online Food Ordering System 1.0 by code-projects contains a reflected cross-site scripting (XSS) vulnerability in the Name parameter of /dbfood/contact.php that allows unauthenticated remote attackers to inject malicious scripts. The vulnerability has a publicly available proof-of-concept and affects all versions of the affected product line. While the CVSS score of 4.3 is moderate, the public availability of exploit code and minimal complexity of attack execution elevate practical risk for instances exposed to the internet.
SQL injection in Simple Laundry System 1.0's /checkregisitem.php parameter handler allows unauthenticated remote attackers to manipulate the Long-arm-shirtVol argument and execute arbitrary SQL queries. Public exploit code exists for this vulnerability, increasing the risk of active exploitation. No patch is currently available to remediate this issue.
A reflected cross-site scripting (XSS) vulnerability exists in code-projects Simple Laundry System version 1.0 via the firstName parameter in the /modify.php file. An attacker can inject malicious JavaScript that executes in a victim's browser when they visit a crafted link, potentially leading to session hijacking, credential theft, or malware distribution. A public proof-of-concept is available on GitHub, and exploitation requires only user interaction (clicking a malicious link), making this a practical concern despite the moderate CVSS score of 5.3.
SQL injection in the Admin Login Module of code-projects Online Food Ordering System 1.0 allows unauthenticated remote attackers to manipulate the Username parameter in /admin.php and execute arbitrary SQL queries. Public exploit code exists for this vulnerability, and no patch is currently available. Affected organizations should implement network-level controls or upgrade to a patched version once available.
SQL injection in code-projects Online Food Ordering System 1.0's Shopping Cart Module (cart.php) allows unauthenticated remote attackers to manipulate the del parameter and execute arbitrary SQL queries. Public exploit code exists for this vulnerability, and no patch is currently available. Affected PHP-based installations are at immediate risk of database compromise and data exfiltration.
SQL injection in code-projects Accounting System 1.0 allows authenticated remote attackers to execute arbitrary SQL commands via the cos_id parameter in /my_account/delete.php. Public exploit code exists for this vulnerability, enabling potential unauthorized database access and manipulation. No patch is currently available.
A stored cross-site scripting (XSS) vulnerability exists in code-projects Accounting System 1.0 within the customer management interface (/my_account/add_costumer.php), where the costumer_name parameter fails to properly sanitize user input. Attackers with low privileges and user interaction can inject malicious JavaScript that will execute in the browsers of other users viewing the affected page, potentially leading to session hijacking, credential theft, or unauthorized actions within the accounting system. A public proof-of-concept exploit is available, significantly increasing the likelihood of real-world exploitation.
SQL injection in Simple Laundry System 1.0 PHP application allows unauthenticated remote attackers to execute arbitrary database queries through the serviceId parameter in /checkcheckout.php. Public exploit code exists for this vulnerability, and no patch is currently available.
A stored cross-site scripting (XSS) vulnerability exists in code-projects Exam Form Submission version 1.0 affecting the /admin/update_s6.php file, where the sname parameter fails to properly sanitize user input. An authenticated attacker with high privileges can inject malicious JavaScript that executes in the context of other users' browsers, potentially compromising admin accounts or exfiltrating sensitive exam data. A public proof-of-concept is available on GitHub, and while the CVSS score is low at 2.4, the vulnerability requires high privileges and user interaction to exploit, limiting real-world impact.
SQL injection in Simple Laundry System 1.0's /checklogin.php parameter handler allows unauthenticated remote attackers to manipulate the Username field and execute arbitrary database queries. Public exploit code exists for this vulnerability, increasing the risk of active exploitation. No patch is currently available, leaving affected PHP installations vulnerable to data theft and unauthorized access.
SQL injection in Simple Laundry System 1.0's /checkupdatestatus.php parameter handler allows unauthenticated remote attackers to manipulate the serviceId argument and execute arbitrary SQL queries. Public exploit code exists for this vulnerability, and no patch is currently available, creating immediate risk for affected deployments.
SQL injection in Simple Laundry System 1.0 through the serviceId parameter in /viewdetail.php allows unauthenticated remote attackers to execute arbitrary SQL queries. Public exploit code exists for this vulnerability, and no patch is currently available. Attackers can exploit this to read or modify sensitive database information.
A cross-site scripting (XSS) vulnerability exists in code-projects Exam Form Submission version 1.0, specifically in the /admin/update_s3.php file where the 'sname' parameter is not properly sanitized. An authenticated attacker with high privileges can inject malicious scripts through this parameter to perform actions in the context of other users' browsers. A public proof-of-concept is available, making this vulnerability actively exploitable despite its low CVSS score of 2.4.
A Stored Cross-Site Scripting (XSS) vulnerability exists in code-projects Exam Form Submission version 1.0 affecting the /admin/update_s4.php endpoint, where the 'sname' parameter is not properly sanitized before output. An authenticated attacker with high privileges can inject malicious JavaScript that executes in the context of other users' browsers, potentially leading to session hijacking, credential theft, or administrative action abuse. A public proof-of-concept exploit is available, increasing real-world risk despite the low CVSS score of 2.4.
A Stored or Reflected Cross-Site Scripting (XSS) vulnerability exists in code-projects Exam Form Submission version 1.0, specifically in the /admin/update_s5.php file where the 'sname' parameter is not properly sanitized. An authenticated attacker with high privileges can inject malicious JavaScript code through this parameter, which will execute in the context of other users' browsers when they interact with the affected page. A public proof-of-concept exploit is available on GitHub, and the vulnerability has a low CVSS score of 2.4 due to high privilege requirements and user interaction dependency, but the public disclosure increases practical exploitation likelihood.
A stored cross-site scripting (XSS) vulnerability exists in code-projects Exam Form Submission version 1.0, affecting the /admin/update_s2.php endpoint where the 'sname' parameter is not properly sanitized. An authenticated attacker with high privileges can inject malicious JavaScript that executes in the browser of other users who view the affected page, potentially leading to session hijacking, credential theft, or administrative action manipulation. A public proof-of-concept exploit is available on GitHub, and the vulnerability carries a low CVSS score of 2.4 due to requiring high privileges and user interaction, but the published exploit status indicates active reconnaissance and potential targeted exploitation.
A Stored Cross-Site Scripting (XSS) vulnerability exists in code-projects Exam Form Submission version 1.0, affecting the /admin/update_s1.php file where the 'sname' parameter is not properly sanitized. An unauthenticated attacker can remotely inject malicious JavaScript by manipulating this parameter, which will execute in the browsers of administrators or other users who view the affected page. A public proof-of-concept exploit is available on GitHub, and the vulnerability has an EPSS score indicating probable exploitation likelihood.
SQL injection in Simple Gym Management System up to version 1.0 allows remote attackers with high privileges to manipulate the Trainer_id and fname parameters in /gym/func.php, enabling unauthorized database queries and potential data exfiltration or modification. Public exploit code exists for this vulnerability, and no patch is currently available.
SQL injection in Simple Food Ordering System 1.0 allows authenticated remote attackers to manipulate the Status parameter in all-tickets.php and execute arbitrary SQL queries. Public exploit code exists for this vulnerability, enabling attackers with valid credentials to read, modify, or delete database contents. The affected PHP application currently lacks a security patch.
The Simple Food Ordering System through version 1.0 allows unauthenticated remote attackers to access sensitive database files through improper access controls in the Database Backup Handler component. Public exploit code exists for this vulnerability, which could enable attackers to retrieve database backups containing sensitive information. Configuration changes are recommended as no patch is currently available.
SQL injection in Simple Food Order System 1.0's /routers/add-item.php endpoint allows unauthenticated remote attackers to manipulate the price parameter and execute arbitrary database queries. Public exploit code exists for this vulnerability, and no patch is currently available. The attack requires no user interaction and could lead to unauthorized data access, modification, or deletion.
SQL injection in Patient Record Management System 1.0 via the comp_id parameter in /fecalysis_not.php enables authenticated remote attackers to read, modify, or delete database contents. Public exploit code exists for this vulnerability, and no patch is currently available. The attack requires valid credentials but no user interaction.
SQL injection in the /delete_post.php endpoint of code-projects Social Networking Site 1.0 allows unauthenticated remote attackers to manipulate the ID parameter and execute arbitrary database queries. Public exploit code exists for this vulnerability, and no patch is currently available. An attacker could leverage this to read, modify, or delete sensitive data within the application's database.
SQL injection in code-projects Content Management System 1.0 via the ID parameter in /pages.php allows unauthenticated remote attackers to execute arbitrary SQL queries. Public exploit code exists for this vulnerability, and no patch is currently available. Attackers can leverage this to read, modify, or delete sensitive database information with low complexity from any network location.
Unrestricted file upload in code-projects CMS 1.0 via the image parameter in /admin/edit_posts.php allows authenticated administrators to upload arbitrary files remotely. Public exploit code exists for this vulnerability, though a patch is not yet available. The issue affects PHP-based installations and requires high-level privileges to exploit.
Content Management System versions up to 1.0 contains a vulnerability that allows attackers to sql injection (CVSS 7.3).
SQL injection in code-projects Content Management System 1.0 via the search.php parameter allows unauthenticated remote attackers to manipulate database queries and potentially extract sensitive data or modify database contents. Public exploit code exists for this vulnerability, and no patch is currently available. Affected installations should implement immediate input validation or access controls until patching is possible.
Unrestricted file upload in code-projects College Notes Uploading System 1.0 allows authenticated low-privilege attackers to upload arbitrary files via the profile image function. A publicly available exploit exists, but EPSS exploitation probability is very low (0.05%, 15th percentile). Impact is limited to file manipulation without confirmed remote code execution.
SQL injection in code-projects College Notes Uploading System 1.0 allows remote attackers to manipulate the User parameter in /login.php, potentially bypassing authentication or accessing sensitive data. A publicly available exploit exists, but there is no evidence of active exploitation and the product has a small deployment footprint.
Unrestricted file upload vulnerability in News-Buzz 1.0 (part of the code-projects/anirbandutta9 Content Management System) allows authenticated administrators to upload arbitrary files via the image parameter of /admin/editposts.php. Public exploit code exists, but the EPSS exploitation probability is very low (0.05%), and no active exploitation has been confirmed. Successful exploitation could lead to remote code execution if combined with other weaknesses.
SQL injection in code-projects Assessment Management 1.0 allows unauthenticated remote attackers to potentially read, modify, or delete database records via the userid parameter in login.php. Exploit code is publicly available, though EPSS indicates a very low probability (0.01%) of exploitation in the wild.
Unauthenticated SQL injection in Assessment Management 1.0 allows remote attackers to execute arbitrary SQL commands via the linked[] parameter in /admin/add-module.php. A public exploit is available, though real-world exploitation probability is very low (EPSS 0.01%), and no active exploitation has been confirmed.
SQL injection vulnerability in code-projects Employee Profile Management System 1.0 allows remote attackers to modify or retrieve database contents via the per_id parameter in edit_personnel.php. Exploit code is publicly available, but no active exploitation has been confirmed.
A vulnerability was determined in code-projects Library System 1.0. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
A vulnerability was found in code-projects Library System 1.0. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
A vulnerability has been found in code-projects Library System 1.0. Rated medium severity (CVSS 6.9), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
SQL injection in code-projects Food Ordering System 1.0 allows high-privileged remote attackers to manipulate the itemPrice parameter in /admin/menu.php, leading to limited data exposure and modification. The vulnerability requires administrative authentication and has publicly available exploit code, but carries low real-world exploitation risk due to administrative privilege requirement and minimal technical impact (CVSS 2.0, EPSS 0.03%).
SQL injection in code-projects Food Ordering System 1.0 allows remote attackers with high-level administrative privileges to execute arbitrary SQL commands via the itemID parameter in /admin/deleteitem.php. Despite public exploit availability, real-world risk is minimal due to requirement for authenticated administrator access and low CVSS impact scope (CVSS 2.0, EPSS 0.03%). The vulnerability affects only the administrative interface and does not escalate privileges or compromise confidentiality at scale.
Privilege escalation in code-projects Simple Car Rental System 1.0 lets an authenticated low-privilege user forge a high-privilege (administrator) session and invoke sensitive operations reserved for privileged accounts. The flaw is a broken access-control / authentication-bypass issue (CWE-284) with a publicly available exploit, though it is not listed in CISA KEV and carries a low EPSS probability (0.38%, 30th percentile), indicating limited real-world exploitation to date. Any user able to authenticate at a basic level can effectively take over administrative functionality.
Unrestricted file upload in code-projects Student Crud Operation 3.3 and earlier allows remote unauthenticated attackers to upload arbitrary files via the add.php endpoint. This can lead to remote code execution by uploading a malicious PHP script. A public proof-of-concept exploit is available, but no active exploitation has been reported in the wild (not listed in CISA KEV).
SQL injection in code-projects Student Crud Operation 3.3 via the `ID` parameter of `delete.php` allows remote unauthenticated attackers to perform mass deletion of records, impacting data integrity and service availability. Public exploit code is available, but the vulnerability carries very low exploitation probability (EPSS 0.03%) and is not listed in CISA KEV. This is a niche application with minimal real-world footprint.
A weakness has been identified in code-projects POS Pharmacy System 1.0. Rated medium severity (CVSS 4.8), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
A security flaw has been discovered in code-projects Human Resource Integrated System 1.0. Rated medium severity (CVSS 6.9), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
A vulnerability was identified in code-projects Human Resource Integrated System 1.0.php. Rated medium severity (CVSS 6.9), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
A vulnerability was determined in code-projects Human Resource Integrated System 1.0. Rated medium severity (CVSS 6.9), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
A vulnerability was found in code-projects Human Resource Integrated System 1.0. Rated medium severity (CVSS 6.9), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
A vulnerability has been found in PHPGurukul Hospital Management System 4.0. Rated medium severity (CVSS 6.9), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
A vulnerability was identified in PHPGurukul Hospital Management System 4.0. Rated medium severity (CVSS 6.9), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
A vulnerability, which was classified as critical, has been found in code-projects Simple Art Gallery 1.0. Rated medium severity (CVSS 6.9), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
SQL injection in code-projects Vehicle Management 1.0 exposes the `/filter.php` endpoint to remote, unauthenticated database manipulation via the unsanitized `from` parameter. The CVSS 4.0 vector (AV:N/AC:L/PR:N/UI:N) confirms no authentication or user interaction is required, and a public proof-of-concept exploit is disclosed on GitHub. Despite the trivial exploitation conditions, EPSS at 0.07% (20th percentile) and absence from the CISA KEV catalog indicate no observed widespread exploitation at time of analysis.
SQL injection in code-projects Vehicle Management 1.0 allows unauthenticated remote attackers to manipulate the `vehicle` parameter in `/filter1.php` to execute arbitrary SQL against the backend database. A public exploit was disclosed on GitHub, and the CVSS 4.0 E:P supplemental metric confirms publicly available exploit code, though EPSS remains low at 0.07% (20th percentile), reflecting the obscure deployment footprint of this educational PHP project. No CISA KEV listing is present, indicating no confirmed widespread active exploitation at time of analysis.
SQL injection in code-projects Vehicle Management 1.0 allows unauthenticated remote attackers to manipulate backend database queries via the unsanitized `from` parameter in /filter2.php. A publicly available proof-of-concept exploit is documented on GitHub, making exploitation trivial against any network-exposed instance. No active exploitation is confirmed in CISA KEV, and the EPSS score of 0.07% (20th percentile) reflects the product's niche deployment footprint rather than low severity - the underlying flaw class is serious but real-world exposure is narrow.
SQL injection in code-projects Vehicle Management 1.0 exposes the `/updatebal.php` endpoint to remote, unauthenticated database manipulation via the unsanitized `company` parameter. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) confirms no authentication or user interaction is required, and a public proof-of-concept is available on GitHub. Despite the reporter's 'critical' classification, the CVSS 4.0 score of 5.5 with limited CIA impact ratings and an EPSS of 0.07% (20th percentile) indicate low observed exploitation activity; real-world risk is further constrained by the product's narrow deployment footprint as a PHP demo/student project.
SQL injection in code-projects Vehicle Management 1.0 allows remote unauthenticated attackers to manipulate the `vehicle` parameter in /addvehicle.php to execute arbitrary SQL against the backend database. The flaw is network-accessible with no authentication required (PR:N, AV:N per CVSS 4.0 vector) and a public proof-of-concept has been disclosed on GitHub. Despite the public exploit and no-auth attack path, EPSS sits at just 0.07% (20th percentile) and this product is absent from CISA KEV, consistent with the application's extremely limited real-world deployment footprint.
SQL injection in code-projects Vehicle Management 1.0 exposes the `/addcompany.php` endpoint to unauthenticated remote attackers who can manipulate the `company` parameter to execute arbitrary SQL queries against the backend database. The vulnerability (CWE-74) is trivially exploitable with no authentication or user interaction required per the CVSS 4.0 vector (PR:N/UI:N/AV:N), and a proof-of-concept has been publicly disclosed on GitHub. While not listed in CISA KEV and carrying a low EPSS score of 0.07%, the public POC elevates opportunistic exploitation risk for any internet-exposed instances.
SQL injection in code-projects Vehicle Management 1.0 exposes the `/print.php` endpoint to remote unauthenticated database manipulation via the unsanitized `sno` parameter. Any attacker with network access to the application can craft malicious HTTP requests to read or modify backend database contents without authentication, as confirmed by the CVSS 4.0 PR:N metric. A public proof-of-concept exploit is available on GitHub, though the EPSS score of 0.07% (20th percentile) indicates limited automated exploitation activity at this time; no CISA KEV listing is present.
SQL injection in code-projects Exam Form Submission 1.0 exposes the application's database to remote manipulation through the credits parameter of /admin/update_s7.php. A public proof-of-concept exploit has been disclosed on GitHub, lowering the bar for exploitation. Despite a network-accessible attack vector with no confirmed authentication barrier, real-world risk is constrained by the product's extremely limited deployment footprint - it is a PHP academic demo project with negligible enterprise presence.
SQL injection in code-projects Exam Form Submission 1.0 allows remote attackers to manipulate the backend database via the `credits` parameter in `/admin/update_s5.php`. The CVSS 4.0 vector assigns PR:N, though the admin-prefixed endpoint path introduces ambiguity about authentication enforcement. A publicly available proof-of-concept exploit exists on GitHub, though EPSS sits at just 0.07% (20th percentile), reflecting limited real-world interest likely tied to the product's narrow deployment footprint. No vendor patch has been identified at time of analysis.
Stored cross-site scripting (XSS) in Simple Car Rental System 1.0 allows authenticated administrators to inject malicious scripts via the car_name parameter in /admin/add_vehicles.php, which are then executed in the browsers of other users viewing vehicle listings. The vulnerability requires high-privilege admin access and user interaction (UI:P), limiting real-world impact despite network-accessible delivery. Publicly available exploit code exists but EPSS exploitation probability is extremely low at 0.05%, suggesting the attack scenario (admin-initiated XSS against themselves or other admins) has minimal practical risk.
Cross-site request forgery in Simple Car Rental System 1.0 allows remote attackers to perform unauthorized actions on behalf of authenticated users via crafted requests, requiring user interaction. The vulnerability carries low real-world risk despite public exploit availability, with an EPSS score of 0.08% (24th percentile) indicating minimal actual exploitation probability. Authentication is not required to trigger the CSRF, but successful exploitation depends on the victim being logged in and visiting an attacker-controlled page.
SQL injection in code-projects Vehicle Management 1.0 allows remote unauthenticated attackers to manipulate the `sno` parameter in `/edit1.php`, enabling unauthorized reading, modification, or deletion of backend database contents. A public proof-of-concept is disclosed on GitHub (zgqsdx/cve/issues/1), materially lowering the exploitation barrier despite an EPSS score of 0.07% (20th percentile) that reflects the application's negligible real-world deployment footprint. This vulnerability is not listed in the CISA KEV catalog; no public exploit identified at time of analysis as actively exploited in the wild, though publicly available exploit code exists.
SQL injection in code-projects Vehicle Management 1.0 exposes unauthenticated remote attackers to arbitrary database query manipulation via the `company` parameter in /filter3.php. A public POC has been disclosed on GitHub, enabling database enumeration, credential or record exfiltration, and data modification with no authentication required. Despite the ease of exploitation, an EPSS score of 0.07% (20th percentile) and the absence of a CISA KEV listing reflect the product's negligible real-world deployment footprint - consistent with a tutorial/demo application rather than enterprise software.
SQL injection in code-projects Exam Form Submission 1.0 exposes the unauthenticated /register.php registration endpoint to database manipulation via the unsanitized USN parameter. Any network-accessible deployment is vulnerable to unauthenticated remote exploitation - no credentials or special configuration are required. A public proof-of-concept exploit is available on GitHub; however, EPSS at 0.07% (20th percentile) indicates no observed widespread automated exploitation at time of analysis, and no CISA KEV listing exists.
SQL injection in code-projects Exam Form Submission 1.0 exposes the /admin/delete_s8.php endpoint to remote exploitation via a manipulated ID parameter. The unsanitized input is passed directly into a SQL query, enabling an attacker to read, modify, or delete database records. A public proof-of-concept has been disclosed on GitHub; however, EPSS at 0.07% (20th percentile) and absence from CISA KEV indicate no widespread automated exploitation has been observed at time of analysis.
SQL injection in code-projects Exam Form Submission 1.0 exposes the `/admin/delete_s7.php` endpoint to remote database manipulation through an unsanitized `ID` parameter, enabling unauthenticated attackers to read, modify, or delete backend database content. The CVSS 4.0 vector confirms no authentication and no user interaction are required, making this trivially exploitable from the network; a public proof-of-concept has been disclosed on GitHub at https://github.com/vullis0/cve/issues/1. Despite accessible attack conditions, an EPSS score of 0.07% (20th percentile) and absence from CISA KEV indicate no confirmed widespread exploitation at time of analysis, likely reflecting the product's extremely limited deployment footprint.
Stored cross-site scripting (XSS) in code-projects Simple Laundry System 1.0 allows unauthenticated remote attackers to inject malicious scripts via the firstName parameter in /modifymember.php, which are executed in the context of other users' browsers. The vulnerability has a CVSS score of 4.3 with low impact severity but publicly available exploit code, though exploitation requires user interaction (UI:R). This represents a typical reflected or stored XSS in a parameter handler with limited immediate risk due to no confidentiality or availability impact, though it enables session hijacking and credential theft.
SQL injection in code-projects Simple Laundry System 1.0 allows unauthenticated remote attackers to manipulate the userid parameter in /delstaffinfo.php, enabling arbitrary SQL query execution with limited data confidentiality and integrity impact. Public exploit code is available, increasing real-world risk despite the moderate CVSS score of 6.9.
SQL injection in code-projects Simple Laundry System 1.0 allows unauthenticated remote attackers to manipulate the firstName parameter in /modify.php, enabling arbitrary database queries and potential data exfiltration or modification. The vulnerability affects the Parameter Handler component through CWE-74 (Improper Neutralization of Special Elements in Output Used by a Downstream Component). Publicly available exploit code exists, and the CVSS 6.9 score reflects moderate impact with low attack complexity and no authentication requirement.
Reflected cross-site scripting (XSS) in code-projects Simple Laundry System 1.0 allows unauthenticated remote attackers to inject malicious scripts via the userid parameter in /delstaffinfo.php, with public exploit code available. The vulnerability requires user interaction (clicking a crafted link) and has low confidentiality impact but can enable session hijacking, credential theft, or malware distribution.
SQL injection in code-projects Simple Gym Management System 1.0 Payment Handler allows authenticated remote attackers to manipulate Payment_id, Amount, customer_id, payment_type, and customer_name parameters to execute arbitrary SQL queries, potentially leading to unauthorized data access or modification. Publicly available exploit code exists for this vulnerability; patch status from vendor remains unconfirmed.
SQL injection in code-projects Student Membership System 1.0 admin login allows unauthenticated remote attackers to bypass authentication and access sensitive data via crafted username/password parameters at /admin/index.php. Publicly available exploit code exists (VulDB 354296, GitHub POC), enabling trivial exploitation with no attack complexity. CVSS 7.3 reflects network-accessible attack with low confidentiality/integrity/availability impact. No vendor-released patch identified at time of analysis.
SQL injection in code-projects Student Membership System 1.0 allows authenticated remote attackers to execute arbitrary SQL queries via the ID parameter in /delete_user.php, enabling unauthorized data exfiltration or manipulation. The vulnerability has CVSS score 5.3 (medium severity) with publicly available exploit code, though it requires authenticated access (PR:L) and carries low confidentiality, integrity, and availability impact per CVSS v4.0 assessment.
SQL injection in code-projects Student Membership System 1.0 allows authenticated remote attackers to execute arbitrary SQL commands via the ID parameter in /delete_member.php, resulting in limited confidentiality and integrity impact. Publicly available exploit code exists, and the vulnerability has been disclosed; however, active exploitation has not been confirmed by CISA. The attack requires valid authentication credentials but can be initiated over the network with minimal complexity.
SQL injection in code-projects Student Membership System 1.0 allows unauthenticated remote attackers to extract, modify, or delete database contents via the User Registration Handler component. The vulnerability has a CVSS score of 7.3 with network-based attack vector and low complexity, requiring no privileges or user interaction. EPSS data not available; no CISA KEV listing indicates confirmed actively exploited status is unknown. Publicly available exploit code exists per researcher disclosure on GitHub, elevating real-world risk for organizations running this application.
Reflected cross-site scripting (XSS) in code-projects Online Food Ordering System 1.0 allows unauthenticated remote attackers to inject malicious scripts via the cust_id parameter in /form/order.php, exploitable through user interaction (UI required). Publicly available exploit code exists; the vulnerability carries CVSS 4.3 (low severity) but poses reputational and user session hijacking risks typical of XSS attacks in e-commerce contexts.
Reflected cross-site scripting (XSS) in code-projects Exam Form Submission 1.0 allows authenticated remote attackers to inject malicious scripts via the sname parameter in /admin/update_fst.php, affecting user sessions with administrator privileges. The vulnerability requires user interaction (UI:R) and carries a low CVSS score of 2.4 due to the requirement for prior administrative authentication (PR:H), but publicly available exploit code exists and may be actively used. The attack vector is network-based (AV:N) with low complexity (AC:L), creating an insider threat scenario where compromised or malicious administrators can deface content or steal session tokens of other administrators.
Command injection in code-projects Chamber of Commerce Membership Management System 1.0 allows authenticated remote attackers with high privileges to execute arbitrary commands via manipulation of the mailSubject and mailMessage parameters in the admin/pageMail.php file. The vulnerability has a publicly available exploit and a moderate CVSS score of 4.7, but real-world risk is constrained by the requirement for high-privilege authenticated access.
SQL injection in code-projects Accounting System 1.0 allows unauthenticated remote attackers to execute arbitrary SQL queries via the en_id parameter in /view_work.php, potentially leading to unauthorized data access, modification, or deletion. Public exploit code is available, increasing practical exploitation risk despite the moderate CVSS score of 6.9.
SQL injection in code-projects Accounting System 1.0 allows unauthenticated remote attackers to execute arbitrary SQL commands via the cos_id parameter in /edit_costumer.php. The vulnerability has a CVSS 4.0 score of 6.9 with low impact to confidentiality, integrity, and availability. Publicly available exploit code exists, elevating real-world risk despite moderate CVSS severity.
SQL injection in code-projects Accounting System 1.0 allows unauthenticated remote attackers to extract, modify, or delete database contents via the cos_id parameter in /view_costumer.php. Publicly available exploit code exists (GitHub POC published), enabling trivial exploitation with no authentication required. CVSS 7.3 reflects high exploitability (AV:N/AC:L/PR:N) with partial impact across confidentiality, integrity, and availability. No vendor-released patch identified at time of analysis.
SQL injection in code-projects Simple Food Order System 1.0 allows unauthenticated remote attackers to extract, modify, or delete database contents via the Status parameter in all-orders.php. The vulnerability has a publicly available exploit and requires no authentication or user interaction (CVSS 7.3, AV:N/AC:L/PR:N). No vendor-released patch identified at time of analysis, representing elevated risk for installations of this PHP-based food ordering application.
SQL injection in code-projects Simple Food Order System 1.0 allows unauthenticated remote attackers to execute arbitrary SQL commands via the 'Name' parameter in register-router.php. The vulnerability permits unauthorized database access with confirmed publicly available exploit code (EPSS and CVSS both indicate medium-severity risk). Attack complexity is low with no user interaction required, enabling automated exploitation. No vendor-released patch identified at time of analysis, and exploitation requires no authentication (CVSS PR:N).
SQL injection in Simple Food Order System 1.0 allows unauthenticated remote attackers to extract, modify, or delete database contents via the Status parameter in /all-tickets.php. The vulnerability is trivially exploitable with low attack complexity and requires no user interaction. Public exploit code exists on GitHub, significantly lowering the barrier to exploitation, though no active exploitation has been confirmed by CISA KEV at time of analysis.
Stored cross-site scripting (XSS) in code-projects Online Reviewer System up to version 1.0 allows authenticated users with high privileges to inject malicious scripts via the Description parameter in /system/system/students/assessments/databank/btn_functions.php, which are then executed in the context of other users' browsers. The vulnerability requires user interaction (UI:R) and has publicly available exploit code, but poses minimal real-world risk given the high privilege requirement (PR:H) and low impact severity (CVSS 2.4).
SQL injection in code-projects Social Networking Site 1.0 allows authenticated remote attackers to execute arbitrary SQL queries via the ID parameter in delete_photos.php, potentially enabling unauthorized data access, modification, or deletion. The vulnerability affects an unknown function in the Endpoint component and has publicly available exploit code, increasing the likelihood of active abuse despite the moderate CVSS 5.3 score.
Stored cross-site scripting (XSS) in code-projects Social Networking Site 1.0 allows authenticated remote attackers to inject malicious scripts via the content parameter in the Alert Handler component (/home.php), requiring user interaction to trigger. The vulnerability carries a CVSS score of 5.1 (medium) with publicly available exploit code, though no confirmed active exploitation in the wild has been reported. Affected users can have their sessions hijacked or credentials stolen if they interact with malicious alerts crafted by authenticated attackers.
Stored cross-site scripting (XSS) in code-projects Exam Form Submission 1.0 allows authenticated remote attackers to inject malicious scripts via the sname parameter in /admin/update_s7.php, potentially compromising administrator sessions and enabling unauthorized actions. Publicly available exploit code exists for this vulnerability, though it requires high-privilege authentication to trigger. The CVSS 2.4 score reflects limited impact (information integrity only) and the requirement for authenticated access and user interaction, but the public availability of working exploit code elevates practical risk.
SQL injection in code-projects Simple Laundry System 1.0 allows unauthenticated remote attackers to extract, modify, or delete database contents via the userid parameter in /modstaffinfo.php. Publicly available exploit code exists on GitHub, significantly lowering the barrier to exploitation. The CVSS score of 7.3 reflects network accessibility without authentication requirements (PR:N), though impact is rated as Low across confidentiality, integrity, and availability.
A security vulnerability in A weakness (CVSS 5.5). Risk factors: public PoC available.
The code-projects Online Food Ordering System versions up to 1.0 contain a stored cross-site scripting (XSS) vulnerability in the /dbfood/food.php file via the cuisines parameter, allowing authenticated attackers with high privileges to inject malicious scripts that execute in users' browsers. The vulnerability carries a CVSS score of 2.4 (low severity) but has publicly available exploit code and confirmed documentation on GitHub, limiting its practical impact due to high privilege requirements and user interaction dependency. Remote exploitation is possible, but the attack requires an authenticated user with high-level administrative privileges and victim user interaction, substantially constraining real-world exploitation likelihood.
The Online Food Ordering System 1.0 by code-projects contains a reflected cross-site scripting (XSS) vulnerability in the Name parameter of /dbfood/contact.php that allows unauthenticated remote attackers to inject malicious scripts. The vulnerability has a publicly available proof-of-concept and affects all versions of the affected product line. While the CVSS score of 4.3 is moderate, the public availability of exploit code and minimal complexity of attack execution elevate practical risk for instances exposed to the internet.
SQL injection in Simple Laundry System 1.0's /checkregisitem.php parameter handler allows unauthenticated remote attackers to manipulate the Long-arm-shirtVol argument and execute arbitrary SQL queries. Public exploit code exists for this vulnerability, increasing the risk of active exploitation. No patch is currently available to remediate this issue.
A reflected cross-site scripting (XSS) vulnerability exists in code-projects Simple Laundry System version 1.0 via the firstName parameter in the /modify.php file. An attacker can inject malicious JavaScript that executes in a victim's browser when they visit a crafted link, potentially leading to session hijacking, credential theft, or malware distribution. A public proof-of-concept is available on GitHub, and exploitation requires only user interaction (clicking a malicious link), making this a practical concern despite the moderate CVSS score of 5.3.
SQL injection in the Admin Login Module of code-projects Online Food Ordering System 1.0 allows unauthenticated remote attackers to manipulate the Username parameter in /admin.php and execute arbitrary SQL queries. Public exploit code exists for this vulnerability, and no patch is currently available. Affected organizations should implement network-level controls or upgrade to a patched version once available.
SQL injection in code-projects Online Food Ordering System 1.0's Shopping Cart Module (cart.php) allows unauthenticated remote attackers to manipulate the del parameter and execute arbitrary SQL queries. Public exploit code exists for this vulnerability, and no patch is currently available. Affected PHP-based installations are at immediate risk of database compromise and data exfiltration.
SQL injection in code-projects Accounting System 1.0 allows authenticated remote attackers to execute arbitrary SQL commands via the cos_id parameter in /my_account/delete.php. Public exploit code exists for this vulnerability, enabling potential unauthorized database access and manipulation. No patch is currently available.
A stored cross-site scripting (XSS) vulnerability exists in code-projects Accounting System 1.0 within the customer management interface (/my_account/add_costumer.php), where the costumer_name parameter fails to properly sanitize user input. Attackers with low privileges and user interaction can inject malicious JavaScript that will execute in the browsers of other users viewing the affected page, potentially leading to session hijacking, credential theft, or unauthorized actions within the accounting system. A public proof-of-concept exploit is available, significantly increasing the likelihood of real-world exploitation.
SQL injection in Simple Laundry System 1.0 PHP application allows unauthenticated remote attackers to execute arbitrary database queries through the serviceId parameter in /checkcheckout.php. Public exploit code exists for this vulnerability, and no patch is currently available.
A stored cross-site scripting (XSS) vulnerability exists in code-projects Exam Form Submission version 1.0 affecting the /admin/update_s6.php file, where the sname parameter fails to properly sanitize user input. An authenticated attacker with high privileges can inject malicious JavaScript that executes in the context of other users' browsers, potentially compromising admin accounts or exfiltrating sensitive exam data. A public proof-of-concept is available on GitHub, and while the CVSS score is low at 2.4, the vulnerability requires high privileges and user interaction to exploit, limiting real-world impact.
SQL injection in Simple Laundry System 1.0's /checklogin.php parameter handler allows unauthenticated remote attackers to manipulate the Username field and execute arbitrary database queries. Public exploit code exists for this vulnerability, increasing the risk of active exploitation. No patch is currently available, leaving affected PHP installations vulnerable to data theft and unauthorized access.
SQL injection in Simple Laundry System 1.0's /checkupdatestatus.php parameter handler allows unauthenticated remote attackers to manipulate the serviceId argument and execute arbitrary SQL queries. Public exploit code exists for this vulnerability, and no patch is currently available, creating immediate risk for affected deployments.
SQL injection in Simple Laundry System 1.0 through the serviceId parameter in /viewdetail.php allows unauthenticated remote attackers to execute arbitrary SQL queries. Public exploit code exists for this vulnerability, and no patch is currently available. Attackers can exploit this to read or modify sensitive database information.
A cross-site scripting (XSS) vulnerability exists in code-projects Exam Form Submission version 1.0, specifically in the /admin/update_s3.php file where the 'sname' parameter is not properly sanitized. An authenticated attacker with high privileges can inject malicious scripts through this parameter to perform actions in the context of other users' browsers. A public proof-of-concept is available, making this vulnerability actively exploitable despite its low CVSS score of 2.4.
A Stored Cross-Site Scripting (XSS) vulnerability exists in code-projects Exam Form Submission version 1.0 affecting the /admin/update_s4.php endpoint, where the 'sname' parameter is not properly sanitized before output. An authenticated attacker with high privileges can inject malicious JavaScript that executes in the context of other users' browsers, potentially leading to session hijacking, credential theft, or administrative action abuse. A public proof-of-concept exploit is available, increasing real-world risk despite the low CVSS score of 2.4.
A Stored or Reflected Cross-Site Scripting (XSS) vulnerability exists in code-projects Exam Form Submission version 1.0, specifically in the /admin/update_s5.php file where the 'sname' parameter is not properly sanitized. An authenticated attacker with high privileges can inject malicious JavaScript code through this parameter, which will execute in the context of other users' browsers when they interact with the affected page. A public proof-of-concept exploit is available on GitHub, and the vulnerability has a low CVSS score of 2.4 due to high privilege requirements and user interaction dependency, but the public disclosure increases practical exploitation likelihood.
A stored cross-site scripting (XSS) vulnerability exists in code-projects Exam Form Submission version 1.0, affecting the /admin/update_s2.php endpoint where the 'sname' parameter is not properly sanitized. An authenticated attacker with high privileges can inject malicious JavaScript that executes in the browser of other users who view the affected page, potentially leading to session hijacking, credential theft, or administrative action manipulation. A public proof-of-concept exploit is available on GitHub, and the vulnerability carries a low CVSS score of 2.4 due to requiring high privileges and user interaction, but the published exploit status indicates active reconnaissance and potential targeted exploitation.
A Stored Cross-Site Scripting (XSS) vulnerability exists in code-projects Exam Form Submission version 1.0, affecting the /admin/update_s1.php file where the 'sname' parameter is not properly sanitized. An unauthenticated attacker can remotely inject malicious JavaScript by manipulating this parameter, which will execute in the browsers of administrators or other users who view the affected page. A public proof-of-concept exploit is available on GitHub, and the vulnerability has an EPSS score indicating probable exploitation likelihood.
SQL injection in Simple Gym Management System up to version 1.0 allows remote attackers with high privileges to manipulate the Trainer_id and fname parameters in /gym/func.php, enabling unauthorized database queries and potential data exfiltration or modification. Public exploit code exists for this vulnerability, and no patch is currently available.
SQL injection in Simple Food Ordering System 1.0 allows authenticated remote attackers to manipulate the Status parameter in all-tickets.php and execute arbitrary SQL queries. Public exploit code exists for this vulnerability, enabling attackers with valid credentials to read, modify, or delete database contents. The affected PHP application currently lacks a security patch.
The Simple Food Ordering System through version 1.0 allows unauthenticated remote attackers to access sensitive database files through improper access controls in the Database Backup Handler component. Public exploit code exists for this vulnerability, which could enable attackers to retrieve database backups containing sensitive information. Configuration changes are recommended as no patch is currently available.
SQL injection in Simple Food Order System 1.0's /routers/add-item.php endpoint allows unauthenticated remote attackers to manipulate the price parameter and execute arbitrary database queries. Public exploit code exists for this vulnerability, and no patch is currently available. The attack requires no user interaction and could lead to unauthorized data access, modification, or deletion.
SQL injection in Patient Record Management System 1.0 via the comp_id parameter in /fecalysis_not.php enables authenticated remote attackers to read, modify, or delete database contents. Public exploit code exists for this vulnerability, and no patch is currently available. The attack requires valid credentials but no user interaction.
SQL injection in the /delete_post.php endpoint of code-projects Social Networking Site 1.0 allows unauthenticated remote attackers to manipulate the ID parameter and execute arbitrary database queries. Public exploit code exists for this vulnerability, and no patch is currently available. An attacker could leverage this to read, modify, or delete sensitive data within the application's database.
SQL injection in code-projects Content Management System 1.0 via the ID parameter in /pages.php allows unauthenticated remote attackers to execute arbitrary SQL queries. Public exploit code exists for this vulnerability, and no patch is currently available. Attackers can leverage this to read, modify, or delete sensitive database information with low complexity from any network location.
Unrestricted file upload in code-projects CMS 1.0 via the image parameter in /admin/edit_posts.php allows authenticated administrators to upload arbitrary files remotely. Public exploit code exists for this vulnerability, though a patch is not yet available. The issue affects PHP-based installations and requires high-level privileges to exploit.
Content Management System versions up to 1.0 contains a vulnerability that allows attackers to sql injection (CVSS 7.3).
SQL injection in code-projects Content Management System 1.0 via the search.php parameter allows unauthenticated remote attackers to manipulate database queries and potentially extract sensitive data or modify database contents. Public exploit code exists for this vulnerability, and no patch is currently available. Affected installations should implement immediate input validation or access controls until patching is possible.
Unrestricted file upload in code-projects College Notes Uploading System 1.0 allows authenticated low-privilege attackers to upload arbitrary files via the profile image function. A publicly available exploit exists, but EPSS exploitation probability is very low (0.05%, 15th percentile). Impact is limited to file manipulation without confirmed remote code execution.
SQL injection in code-projects College Notes Uploading System 1.0 allows remote attackers to manipulate the User parameter in /login.php, potentially bypassing authentication or accessing sensitive data. A publicly available exploit exists, but there is no evidence of active exploitation and the product has a small deployment footprint.
Unrestricted file upload vulnerability in News-Buzz 1.0 (part of the code-projects/anirbandutta9 Content Management System) allows authenticated administrators to upload arbitrary files via the image parameter of /admin/editposts.php. Public exploit code exists, but the EPSS exploitation probability is very low (0.05%), and no active exploitation has been confirmed. Successful exploitation could lead to remote code execution if combined with other weaknesses.
SQL injection in code-projects Assessment Management 1.0 allows unauthenticated remote attackers to potentially read, modify, or delete database records via the userid parameter in login.php. Exploit code is publicly available, though EPSS indicates a very low probability (0.01%) of exploitation in the wild.
Unauthenticated SQL injection in Assessment Management 1.0 allows remote attackers to execute arbitrary SQL commands via the linked[] parameter in /admin/add-module.php. A public exploit is available, though real-world exploitation probability is very low (EPSS 0.01%), and no active exploitation has been confirmed.
SQL injection vulnerability in code-projects Employee Profile Management System 1.0 allows remote attackers to modify or retrieve database contents via the per_id parameter in edit_personnel.php. Exploit code is publicly available, but no active exploitation has been confirmed.
A vulnerability was determined in code-projects Library System 1.0. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
A vulnerability was found in code-projects Library System 1.0. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
A vulnerability has been found in code-projects Library System 1.0. Rated medium severity (CVSS 6.9), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
SQL injection in code-projects Food Ordering System 1.0 allows high-privileged remote attackers to manipulate the itemPrice parameter in /admin/menu.php, leading to limited data exposure and modification. The vulnerability requires administrative authentication and has publicly available exploit code, but carries low real-world exploitation risk due to administrative privilege requirement and minimal technical impact (CVSS 2.0, EPSS 0.03%).
SQL injection in code-projects Food Ordering System 1.0 allows remote attackers with high-level administrative privileges to execute arbitrary SQL commands via the itemID parameter in /admin/deleteitem.php. Despite public exploit availability, real-world risk is minimal due to requirement for authenticated administrator access and low CVSS impact scope (CVSS 2.0, EPSS 0.03%). The vulnerability affects only the administrative interface and does not escalate privileges or compromise confidentiality at scale.
Privilege escalation in code-projects Simple Car Rental System 1.0 lets an authenticated low-privilege user forge a high-privilege (administrator) session and invoke sensitive operations reserved for privileged accounts. The flaw is a broken access-control / authentication-bypass issue (CWE-284) with a publicly available exploit, though it is not listed in CISA KEV and carries a low EPSS probability (0.38%, 30th percentile), indicating limited real-world exploitation to date. Any user able to authenticate at a basic level can effectively take over administrative functionality.
Unrestricted file upload in code-projects Student Crud Operation 3.3 and earlier allows remote unauthenticated attackers to upload arbitrary files via the add.php endpoint. This can lead to remote code execution by uploading a malicious PHP script. A public proof-of-concept exploit is available, but no active exploitation has been reported in the wild (not listed in CISA KEV).
SQL injection in code-projects Student Crud Operation 3.3 via the `ID` parameter of `delete.php` allows remote unauthenticated attackers to perform mass deletion of records, impacting data integrity and service availability. Public exploit code is available, but the vulnerability carries very low exploitation probability (EPSS 0.03%) and is not listed in CISA KEV. This is a niche application with minimal real-world footprint.
A weakness has been identified in code-projects POS Pharmacy System 1.0. Rated medium severity (CVSS 4.8), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
A security flaw has been discovered in code-projects Human Resource Integrated System 1.0. Rated medium severity (CVSS 6.9), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
A vulnerability was identified in code-projects Human Resource Integrated System 1.0.php. Rated medium severity (CVSS 6.9), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
A vulnerability was determined in code-projects Human Resource Integrated System 1.0. Rated medium severity (CVSS 6.9), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
A vulnerability was found in code-projects Human Resource Integrated System 1.0. Rated medium severity (CVSS 6.9), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
A vulnerability has been found in PHPGurukul Hospital Management System 4.0. Rated medium severity (CVSS 6.9), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
A vulnerability was identified in PHPGurukul Hospital Management System 4.0. Rated medium severity (CVSS 6.9), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
A vulnerability, which was classified as critical, has been found in code-projects Simple Art Gallery 1.0. Rated medium severity (CVSS 6.9), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
SQL injection in code-projects Vehicle Management 1.0 exposes the `/filter.php` endpoint to remote, unauthenticated database manipulation via the unsanitized `from` parameter. The CVSS 4.0 vector (AV:N/AC:L/PR:N/UI:N) confirms no authentication or user interaction is required, and a public proof-of-concept exploit is disclosed on GitHub. Despite the trivial exploitation conditions, EPSS at 0.07% (20th percentile) and absence from the CISA KEV catalog indicate no observed widespread exploitation at time of analysis.
SQL injection in code-projects Vehicle Management 1.0 allows unauthenticated remote attackers to manipulate the `vehicle` parameter in `/filter1.php` to execute arbitrary SQL against the backend database. A public exploit was disclosed on GitHub, and the CVSS 4.0 E:P supplemental metric confirms publicly available exploit code, though EPSS remains low at 0.07% (20th percentile), reflecting the obscure deployment footprint of this educational PHP project. No CISA KEV listing is present, indicating no confirmed widespread active exploitation at time of analysis.
SQL injection in code-projects Vehicle Management 1.0 allows unauthenticated remote attackers to manipulate backend database queries via the unsanitized `from` parameter in /filter2.php. A publicly available proof-of-concept exploit is documented on GitHub, making exploitation trivial against any network-exposed instance. No active exploitation is confirmed in CISA KEV, and the EPSS score of 0.07% (20th percentile) reflects the product's niche deployment footprint rather than low severity - the underlying flaw class is serious but real-world exposure is narrow.
SQL injection in code-projects Vehicle Management 1.0 exposes the `/updatebal.php` endpoint to remote, unauthenticated database manipulation via the unsanitized `company` parameter. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) confirms no authentication or user interaction is required, and a public proof-of-concept is available on GitHub. Despite the reporter's 'critical' classification, the CVSS 4.0 score of 5.5 with limited CIA impact ratings and an EPSS of 0.07% (20th percentile) indicate low observed exploitation activity; real-world risk is further constrained by the product's narrow deployment footprint as a PHP demo/student project.
SQL injection in code-projects Vehicle Management 1.0 allows remote unauthenticated attackers to manipulate the `vehicle` parameter in /addvehicle.php to execute arbitrary SQL against the backend database. The flaw is network-accessible with no authentication required (PR:N, AV:N per CVSS 4.0 vector) and a public proof-of-concept has been disclosed on GitHub. Despite the public exploit and no-auth attack path, EPSS sits at just 0.07% (20th percentile) and this product is absent from CISA KEV, consistent with the application's extremely limited real-world deployment footprint.
SQL injection in code-projects Vehicle Management 1.0 exposes the `/addcompany.php` endpoint to unauthenticated remote attackers who can manipulate the `company` parameter to execute arbitrary SQL queries against the backend database. The vulnerability (CWE-74) is trivially exploitable with no authentication or user interaction required per the CVSS 4.0 vector (PR:N/UI:N/AV:N), and a proof-of-concept has been publicly disclosed on GitHub. While not listed in CISA KEV and carrying a low EPSS score of 0.07%, the public POC elevates opportunistic exploitation risk for any internet-exposed instances.
SQL injection in code-projects Vehicle Management 1.0 exposes the `/print.php` endpoint to remote unauthenticated database manipulation via the unsanitized `sno` parameter. Any attacker with network access to the application can craft malicious HTTP requests to read or modify backend database contents without authentication, as confirmed by the CVSS 4.0 PR:N metric. A public proof-of-concept exploit is available on GitHub, though the EPSS score of 0.07% (20th percentile) indicates limited automated exploitation activity at this time; no CISA KEV listing is present.
SQL injection in code-projects Exam Form Submission 1.0 exposes the application's database to remote manipulation through the credits parameter of /admin/update_s7.php. A public proof-of-concept exploit has been disclosed on GitHub, lowering the bar for exploitation. Despite a network-accessible attack vector with no confirmed authentication barrier, real-world risk is constrained by the product's extremely limited deployment footprint - it is a PHP academic demo project with negligible enterprise presence.
SQL injection in code-projects Exam Form Submission 1.0 allows remote attackers to manipulate the backend database via the `credits` parameter in `/admin/update_s5.php`. The CVSS 4.0 vector assigns PR:N, though the admin-prefixed endpoint path introduces ambiguity about authentication enforcement. A publicly available proof-of-concept exploit exists on GitHub, though EPSS sits at just 0.07% (20th percentile), reflecting limited real-world interest likely tied to the product's narrow deployment footprint. No vendor patch has been identified at time of analysis.
Stored cross-site scripting (XSS) in Simple Car Rental System 1.0 allows authenticated administrators to inject malicious scripts via the car_name parameter in /admin/add_vehicles.php, which are then executed in the browsers of other users viewing vehicle listings. The vulnerability requires high-privilege admin access and user interaction (UI:P), limiting real-world impact despite network-accessible delivery. Publicly available exploit code exists but EPSS exploitation probability is extremely low at 0.05%, suggesting the attack scenario (admin-initiated XSS against themselves or other admins) has minimal practical risk.
Cross-site request forgery in Simple Car Rental System 1.0 allows remote attackers to perform unauthorized actions on behalf of authenticated users via crafted requests, requiring user interaction. The vulnerability carries low real-world risk despite public exploit availability, with an EPSS score of 0.08% (24th percentile) indicating minimal actual exploitation probability. Authentication is not required to trigger the CSRF, but successful exploitation depends on the victim being logged in and visiting an attacker-controlled page.
SQL injection in code-projects Vehicle Management 1.0 allows remote unauthenticated attackers to manipulate the `sno` parameter in `/edit1.php`, enabling unauthorized reading, modification, or deletion of backend database contents. A public proof-of-concept is disclosed on GitHub (zgqsdx/cve/issues/1), materially lowering the exploitation barrier despite an EPSS score of 0.07% (20th percentile) that reflects the application's negligible real-world deployment footprint. This vulnerability is not listed in the CISA KEV catalog; no public exploit identified at time of analysis as actively exploited in the wild, though publicly available exploit code exists.
SQL injection in code-projects Vehicle Management 1.0 exposes unauthenticated remote attackers to arbitrary database query manipulation via the `company` parameter in /filter3.php. A public POC has been disclosed on GitHub, enabling database enumeration, credential or record exfiltration, and data modification with no authentication required. Despite the ease of exploitation, an EPSS score of 0.07% (20th percentile) and the absence of a CISA KEV listing reflect the product's negligible real-world deployment footprint - consistent with a tutorial/demo application rather than enterprise software.
SQL injection in code-projects Exam Form Submission 1.0 exposes the unauthenticated /register.php registration endpoint to database manipulation via the unsanitized USN parameter. Any network-accessible deployment is vulnerable to unauthenticated remote exploitation - no credentials or special configuration are required. A public proof-of-concept exploit is available on GitHub; however, EPSS at 0.07% (20th percentile) indicates no observed widespread automated exploitation at time of analysis, and no CISA KEV listing exists.
SQL injection in code-projects Exam Form Submission 1.0 exposes the /admin/delete_s8.php endpoint to remote exploitation via a manipulated ID parameter. The unsanitized input is passed directly into a SQL query, enabling an attacker to read, modify, or delete database records. A public proof-of-concept has been disclosed on GitHub; however, EPSS at 0.07% (20th percentile) and absence from CISA KEV indicate no widespread automated exploitation has been observed at time of analysis.
SQL injection in code-projects Exam Form Submission 1.0 exposes the `/admin/delete_s7.php` endpoint to remote database manipulation through an unsanitized `ID` parameter, enabling unauthenticated attackers to read, modify, or delete backend database content. The CVSS 4.0 vector confirms no authentication and no user interaction are required, making this trivially exploitable from the network; a public proof-of-concept has been disclosed on GitHub at https://github.com/vullis0/cve/issues/1. Despite accessible attack conditions, an EPSS score of 0.07% (20th percentile) and absence from CISA KEV indicate no confirmed widespread exploitation at time of analysis, likely reflecting the product's extremely limited deployment footprint.