Fabian
Monthly
Arbitrary file upload in the admin/profile_update.php script of Fabian Ros Library Management System 2.0 permits remote authenticated attackers to upload files without type or extension restrictions, potentially leading to remote code execution. Exploit code is publicly available, though EPSS exploitation probability is low (0.08%) and no active exploitation has been reported. The vulnerability is considered critical due to the ease of exploitation combined with the possibility of full system compromise.
Unrestricted file upload in Library Management System 2.0 allows authenticated remote attackers to upload arbitrary files via the photo parameter in /admin/student_edit_photo.php, potentially leading to remote code execution. The vulnerability is publicly disclosed with proof-of-concept exploits available. No active exploitation has been reported through CISA KEV.
SQL injection in Chat System 1.0 allows remote attackers to manipulate database queries via the 'msg' parameter of /user/send_message.php. Publicly available exploit code exists, but no active exploitation has been confirmed. The application is a low-footprint, unsupported project, limiting real-world exposure.
SQL injection in code-projects Chat System 1.0 allows remote attackers to execute arbitrary SQL commands via the ID parameter in /user/addmember.php. Public exploit code is available, but EPSS indicates low exploitation probability and no active exploitation has been confirmed.
SQL injection in Chat System 1.0 through the ID parameter of /user/fetch_member.php allows remote authenticated attackers with low privileges to extract or manipulate limited data from the application's database. Public exploit code is available, but no active exploitation has been reported and the EPSS probability is very low.
SQL injection in code-projects Chat System 1.0 allows authenticated remote attackers to manipulate backend database queries via the ID parameter of /user/fetch_chat.php. Public exploit code is available, and the vulnerability is rated critically by the reporter, but the CVSS 4.0 base impact is limited (low confidentiality, integrity, and availability) and EP
SQL injection in Food Distributor Site 1.0 allows remote attackers to manipulate the Username parameter on the admin login page to execute arbitrary SQL commands. Exploit code is publicly available, though EPSS indicates very low probability of exploitation (0.06%) and it is not listed in CISA KEV. An attacker could bypass authentication or extract sensitive data from the database.
Unrestricted file upload in code-projects E-Commerce Site 1.0 allows authenticated attackers to upload arbitrary PHP files via the photo parameter in /admin/users_photo.php, potentially leading to remote code execution on the server. Public exploit code is available, increasing immediate risk for instances where the admin panel is exposed.
SQL injection in Responsive Blog Site 1.0 allows remote attackers with low-level privileges to manipulate database queries via the 'ID' parameter in category.php, potentially leading to data leakage or modification. Public exploit code is available, though no active exploitation has been confirmed by CISA. The limited impact and low EPSS score (0.06%) reduce its real-world urgency.
SQL injection in code-projects Responsive Blog Site 1.0 allows authenticated remote attackers to manipulate the 'ID' parameter in /single.php to interfere with database queries, leading to data leakage or manipulation. A proof-of-concept exploit is publicly available, but no active exploitation has been reported (EPSS 0.06%).
Path traversal in code-projects Simple Forum 1.0 allows authenticated attackers to read arbitrary files via the filename parameter of /forum_downloadfile.php. Exploit code is publicly available, but no active exploitation has been confirmed (not in CISA KEV). CVSS 4.0 base score is 2.1 (Low), reflecting limited impact on confidentiality only.
Remote SQL injection in code-projects Simple Forum 1.0 allows authenticated low-privilege attackers to read, modify, or delete database contents via the File parameter in /forum1.php. Exploit code is publicly available but no active exploitation has been reported; EPSS indicates very low exploitation probability.
Cross-site scripting in code-projects Simple Forum 1.0 allows a low-privileged remote attacker to inject arbitrary JavaScript via the /forum_edit1.php text parameter. The attack can be carried out by an authenticated user and executes when another user views the manipulated page. Public exploit code is available, but EPSS data indicates very low exploitation probability.
Unrestricted file upload in Simple Forum 1.0 allows remote authenticated attackers to upload arbitrary files via the File parameter in /forum1.php. Public exploit code is available, enabling low-privileged users to potentially place malicious scripts on the server.
SQL injection in Simple Forum 1.0 allows remote attackers to manipulate the 'iii' parameter in /forum_edit.php, potentially leading to unauthorized database access. A public proof-of-concept exploit exists, though no active exploitation has been confirmed. The vulnerability affects an open-source PHP forum application.
Remote SQL injection in Simple Forum 1.0 allows unauthenticated attackers to execute arbitrary SQL commands via the 'Name' parameter in /forum_viewfile.php. Public exploit code exists but no active exploitation is known; EPSS score is very low (0.04%) indicating limited real-world targeting despite high technical impact potential.
SQL injection in Simple Forum 1.0 allows remote attackers to execute arbitrary SQL queries via the User parameter in /register1.php. A public exploit is available on GitHub, increasing the likelihood of targeted attacks, though the EPSS score is low at 0.06% indicating limited active exploitation at present.
SQL injection in Simple Forum 1.0's signin.php allows remote attackers to manipulate the User parameter, potentially leading to unauthorized data access or modification. The vulnerability is publicly disclosed with exploit code available, though EPSS scoring indicates low immediate exploitation probability.
Unrestricted file upload in Simple Photo Gallery 1.0 allows remote attackers to upload malicious PHP files via the /upload-photo.php endpoint without authentication, enabling remote code execution on the web server. Although exploit code is publicly available, the EPSS score (0.12%) is low, and no active exploitation is reported—real-world risk appears limited by the application's niche deployment.
Authenticated SQL injection in Product Inventory System 1.0 via the ID parameter in /admin/edit_user.php allows high-privilege attackers to execute arbitrary SQL commands. A public proof-of-concept is available, but the very low EPSS score (0.06%) and absence of KEV listing indicate negligible real-world exploitation risk.
SQL injection in Product Inventory System 1.0 allows remote authenticated attackers with administrative privileges to modify database records via the ID parameter in /admin/edit_product.php. Exploit code is publicly available, but no evidence of active exploitation; the EPSS score is very low (0.06%), suggesting limited real-world risk at this time.
SQL injection in the login endpoint of code-projects Product Inventory System 1.0 allows remote attackers to manipulate the Username parameter. This can lead to authentication bypass, data leakage, or database tampering. Exploit code is publicly available, but no active exploitation campaign has been confirmed.
Stored cross-site scripting (XSS) in code-projects Food Distributor Site 1.0 allows an authenticated administrator to inject arbitrary JavaScript into site settings. The vulnerability is triggered via the site_phone, site_email, or address parameters in the /admin/save_settings.php endpoint. Public exploit code is available, but the high privilege requirement (administrator access) and low EPSS score (0.07%) limit real-world risk.
SQL injection in code-projects Food Distributor Site 1.0 allows remote attackers to bypass authentication or extract sensitive data via crafted username/password inputs at /admin/process_login.php. A public proof-of-concept exploit is available, but no active exploitation has been confirmed. Despite being classified as "critical" by the reporter, the CVSS 4.0 base score is 5.5 (Medium) with low impact across confidentiality, integrity, and availability.
CVE-2025-6578 is a critical SQL injection vulnerability in Simple Online Hotel Reservation System version 1.0 affecting the /admin/delete_account.php file through unsanitized admin_id parameter manipulation. An unauthenticated remote attacker can execute arbitrary SQL queries to read, modify, or delete database contents. The vulnerability has been publicly disclosed with proof-of-concept code available, presenting immediate exploitation risk for deployed instances.
Cross-site scripting in code-projects School Fees Payment System 1.0 allows remote attackers to inject arbitrary web script via crafted parameters in /student.php. The vulnerability requires user interaction (clicking a malicious link) and a publicly available proof-of-concept exists. EPSS score indicates very low exploitation probability, and no active exploitation has been reported.
SQL injection in code-projects Online Shopping Store 1.0 allows remote authenticated attackers to manipulate database queries via the cat_id, brand_id, keyword, proId, or pid parameters in /action.php. Public exploit code exists, but no active exploitation has been confirmed. EPSS score is low (0.14%), indicating limited exploitation likelihood.
Cross-site scripting (XSS) in code-projects School Fees Payment System 1.0 allows remote attackers to inject arbitrary web script via the 'transcation_remark' parameter in /fees.php. Public exploit code exists, but no active exploitation has been confirmed. EPSS score is low (0.06%), indicating low exploitation likelihood.
CVE-2025-6472 is a critical SQL injection vulnerability in code-projects Online Bidding System 1.0 affecting the /showprod.php file's ID parameter. An unauthenticated remote attacker can exploit this vulnerability to execute arbitrary SQL queries, potentially leading to unauthorized data access, modification, or denial of service. The vulnerability has been publicly disclosed with exploit code available, creating immediate risk for exposed instances.
CVE-2025-6471 is a critical SQL injection vulnerability in code-projects Online Bidding System version 1.0 affecting the /administrator endpoint, where the 'aduser' parameter is not properly sanitized. An unauthenticated remote attacker can exploit this to execute arbitrary SQL queries, potentially leading to unauthorized data access, modification, or deletion. Public exploit code is available and the vulnerability is actively exploitable with no authentication required.
CVE-2025-6470 is a critical SQL injection vulnerability in code-projects Online Bidding System 1.0, specifically in the /bidlog.php file's ID parameter, allowing unauthenticated remote attackers to execute arbitrary SQL queries. The vulnerability has been publicly disclosed with proof-of-concept code available, presenting immediate exploitation risk. With a CVSS score of 7.3 and network-accessible attack vector requiring no authentication, this poses significant risk to confidentiality, integrity, and availability of affected systems.
A SQL injection vulnerability in A vulnerability (CVSS 7.3). Risk factors: public PoC available.
CVE-2025-6468 is a critical SQL injection vulnerability in code-projects Online Bidding System version 1.0 affecting the /bidnow.php file's ID parameter. An unauthenticated remote attacker can exploit this vulnerability to read, modify, or delete database contents, potentially compromising confidentiality, integrity, and availability of the entire bidding system. The vulnerability has been publicly disclosed with proof-of-concept code available, significantly increasing exploitation risk in active deployments.
CVE-2025-6467 is a critical SQL injection vulnerability in code-projects Online Bidding System version 1.0 affecting the /login.php file's User parameter, allowing unauthenticated remote attackers to execute arbitrary SQL queries and potentially compromise data confidentiality, integrity, and availability. The vulnerability has been publicly disclosed with exploit code available, and while the CVSS score of 7.3 indicates high severity, the attack requires no authentication or user interaction, making it highly exploitable in real-world scenarios.
CVE-2025-6458 is a critical SQL injection vulnerability in code-projects Online Hotel Reservation System version 1.0, affecting the /admin/execedituser.php endpoint. An unauthenticated remote attacker can manipulate the 'userid' parameter to execute arbitrary SQL queries, potentially leading to unauthorized data access, modification, or deletion. The vulnerability has been publicly disclosed with exploit code available, making it actively exploitable in the wild.
CVE-2025-6457 is a critical SQL injection vulnerability in code-projects Online Hotel Reservation System 1.0 affecting the /reservation/demo.php file, where the 'Start' parameter is unsanitized and directly used in database queries. An unauthenticated remote attacker can exploit this vulnerability to read, modify, or delete sensitive database content including guest information, reservations, and payment data. The vulnerability has been publicly disclosed with exploit code available, though specific EPSS probability and KEV/CISA inclusion status cannot be determined from provided data.
CVE-2025-6456 is a critical SQL injection vulnerability in code-projects Online Hotel Reservation System 1.0, specifically in the /reservation/order.php file's 'Start' parameter. An unauthenticated remote attacker can manipulate this parameter to execute arbitrary SQL queries, potentially leading to unauthorized data access, modification, or deletion of the hotel reservation database. Public exploit code is available, and the vulnerability is actively exploitable.
CVE-2025-6455 is a SQL injection vulnerability in code-projects Online Hotel Reservation System version 1.0, specifically in the /messageexec.php file where the 'Name' parameter is insufficiently sanitized. An unauthenticated remote attacker can exploit this to execute arbitrary SQL commands, potentially leading to unauthorized data access, modification, or deletion. The vulnerability has been publicly disclosed with exploit code available, indicating active exploitation risk.
CVE-2025-6451 is a critical SQL injection vulnerability in code-projects Simple Online Hotel Reservation System version 1.0, affecting the /admin/delete_pending.php file where the transaction_id parameter is unsanitized. An unauthenticated remote attacker can exploit this to execute arbitrary SQL queries, potentially leading to data exfiltration, modification, or deletion of the hotel reservation database. Public exploit disclosure and active threat indicators suggest this vulnerability warrants immediate patching.
CVE-2025-6450 is a critical SQL injection vulnerability in code-projects Simple Online Hotel Reservation System version 1.0, affecting the /admin/confirm_reserve.php endpoint where the transaction_id parameter is inadequately sanitized. An unauthenticated remote attacker can exploit this vulnerability to execute arbitrary SQL commands, potentially leading to unauthorized data access, modification, or deletion of the hotel reservation database. Public exploit code is available and the vulnerability meets criteria for active exploitation risk.
CVE-2025-6449 is a critical SQL injection vulnerability in Simple Online Hotel Reservation System v1.0 affecting the /admin/checkout_query.php endpoint. An unauthenticated remote attacker can manipulate the 'transaction_id' parameter to execute arbitrary SQL queries, potentially leading to unauthorized data access, modification, or system disruption. The vulnerability has been publicly disclosed with exploits available, and the CVSS 7.3 score reflects high impact across confidentiality, integrity, and availability despite moderate attack complexity.
CVE-2025-6448 is a critical SQL injection vulnerability in code-projects Simple Online Hotel Reservation System 1.0 affecting the /admin/delete_room.php endpoint. An unauthenticated remote attacker can manipulate the room_id parameter to execute arbitrary SQL queries, potentially resulting in unauthorized data access, modification, or deletion. The vulnerability has been publicly disclosed with working exploits available, making active exploitation likely.
CVE-2025-6447 is a critical SQL injection vulnerability in the Simple Online Hotel Reservation System version 1.0, specifically in the /admin/index.php file's Username parameter. An unauthenticated remote attacker can exploit this vulnerability to execute arbitrary SQL queries, potentially leading to unauthorized data access, modification, or system disruption. The exploit has been publicly disclosed with proof-of-concept code available, significantly increasing the risk of active exploitation.
A critical SQL injection vulnerability exists in code-projects Client Details System version 1.0, specifically in the /clientdetails/admin/index.php file where the Username parameter is improperly validated. An unauthenticated remote attacker can exploit this vulnerability to execute arbitrary SQL commands, potentially leading to unauthorized data access, modification, or deletion. The vulnerability has public exploit code available and demonstrates moderate real-world risk despite the critical classification, with a CVSS score of 7.3 indicating concrete but not maximum severity.
A critical SQL injection vulnerability exists in code-projects Simple Online Hotel Reservation System version 1.0, specifically in the /admin/add_account.php file where the 'name' or 'admin_id' parameters are not properly sanitized. An unauthenticated remote attacker can exploit this vulnerability to execute arbitrary SQL commands, potentially leading to unauthorized data access, modification, or deletion of the hotel reservation database. Public exploit code is available and the vulnerability is actively being disclosed, increasing exploitation risk in the wild.
A critical SQL injection vulnerability exists in code-projects Simple Online Hotel Reservation System version 1.0, specifically in the /admin/add_room.php file where the 'room_type' parameter is insufficiently sanitized. An unauthenticated remote attacker can exploit this vulnerability to execute arbitrary SQL commands, potentially leading to unauthorized data access, modification, or deletion of hotel reservation system data. A proof-of-concept exploit has been publicly disclosed, increasing real-world exploitation risk.
CVE-2025-6419 is a critical SQL injection vulnerability in code-projects Simple Online Hotel Reservation System 1.0 affecting the /admin/edit_room.php endpoint, where the 'room_type' parameter is improperly sanitized, allowing unauthenticated remote attackers to execute arbitrary SQL commands. The vulnerability has a CVSS score of 7.3 with public proof-of-concept code available, indicating active exploitation risk and widespread discoverability.
CVE-2025-6418 is a critical SQL injection vulnerability in Simple Online Hotel Reservation System 1.0 affecting the /admin/edit_query_account.php endpoint, where the 'Name' parameter is improperly sanitized, allowing remote attackers to execute arbitrary SQL queries without authentication. The vulnerability has been publicly disclosed with exploit code availability, making it a high-priority threat for organizations running this system in production; attackers can manipulate database queries to extract sensitive data, modify records, or potentially escalate privileges.
CVE-2025-6403 is a critical SQL injection vulnerability in code-projects School Fees Payment System version 1.0, specifically in the /student.php file's ID parameter. An unauthenticated remote attacker can exploit this to execute arbitrary SQL queries, potentially leading to unauthorized data access, modification, or deletion of student and payment records. The vulnerability has been publicly disclosed with working exploits available, and while the CVSS score of 7.3 indicates medium-to-high severity, the SQL injection vector combined with public PoC availability presents significant real-world risk for deployed instances.
A SQL injection vulnerability in A vulnerability (CVSS 7.3). Risk factors: public PoC available.
CVE-2025-6355 is a critical SQL injection vulnerability in SourceCodester Online Hotel Reservation System version 1.0, specifically in the /admin/execeditroom.php file where the 'userid' parameter is improperly sanitized. An unauthenticated remote attacker can exploit this vulnerability to inject arbitrary SQL commands, potentially leading to unauthorized data access, modification, or denial of service. Public disclosure and proof-of-concept availability significantly elevate real-world exploitation risk.
Cross-site scripting (XSS) in Responsive Blog 1.0 allows an authenticated attacker to inject arbitrary JavaScript via the keyword parameter in /search.php. A public exploit exists, but no active exploitation has been reported and EPSS risk is low (0.06%).
A security vulnerability in A vulnerability classified as problematic (CVSS 5.3). Risk factors: public PoC available.
Cross-site scripting (XSS) in Responsive Blog 1.0/1.12.4/3.3.4 via the admin pageViewMembers.php allows authenticated attackers with high privileges to inject malicious scripts. A public exploit exists, but EPSS score is low (0.04%) and no active exploitation in CISA KEV.
Cross-site request forgery in code-projects School Fees Payment System 1.0 allows an attacker to perform unauthorized actions on behalf of an authenticated user. A publicly available exploit exists, but no active exploitation has been reported. The EPSS score is low (0.09%), indicating low exploitation likelihood.
Cross-site scripting (XSS) in code-projects School Fees Payment System 1.0 allows an authenticated attacker to inject arbitrary web scripts via the Branch/Address/Detail parameters in /branch.php. A public exploit exists, but no active exploitation has been reported. The EPSS score is low (0.05%), indicating low exploitation likelihood.
CVE-2025-6296 is a critical SQL injection vulnerability in code-projects Hostel Management System version 1.0, specifically in the /empty_rooms.php file's search_box parameter. An unauthenticated remote attacker can exploit this to execute arbitrary SQL queries, potentially achieving unauthorized data access, modification, or deletion. The vulnerability has been publicly disclosed with exploits available, making active exploitation highly probable in real-world deployments.
A SQL injection vulnerability in A vulnerability (CVSS 7.3). Risk factors: public PoC available.
CVE-2025-6294 is a critical SQL injection vulnerability in code-projects Hostel Management System version 1.0, specifically in the /contact.php file's hostel_name parameter. An unauthenticated remote attacker can exploit this without user interaction to execute arbitrary SQL queries, potentially leading to unauthorized data access, modification, or deletion. The vulnerability has been publicly disclosed with exploit code available, and while CVSS 7.3 indicates moderate-to-high severity with confidentiality, integrity, and availability impact, the simplicity of exploitation (network-accessible, no privileges required, low complexity) makes this a practical threat requiring immediate patching.
CVE-2025-6293 is a critical SQL injection vulnerability in code-projects Hostel Management System v1.0 affecting the /contact_manager.php endpoint, where the student_roll_no parameter is inadequately sanitized, allowing unauthenticated remote attackers to execute arbitrary SQL queries and potentially exfiltrate, modify, or delete database records. Public exploit disclosure and active exploitation signals indicate this is a high-priority threat requiring immediate remediation.
A remote code execution vulnerability (CVSS 7.3). Risk factors: public PoC available.
Critical SQL injection vulnerability in code-projects Hostel Management System version 1.0, specifically in the /allocate_room.php file's 'search_box' parameter. An unauthenticated remote attacker can exploit this vulnerability to execute arbitrary SQL queries, potentially leading to unauthorized data access, modification, and system disruption. The vulnerability has been publicly disclosed with proof-of-concept code available, making it actively exploitable in the wild.
SQL injection in code-projects Restaurant Order System 1.0 allows remote authenticated attackers to manipulate database queries via the ID parameter in /table.php. A public exploit exists, but no active exploitation has been confirmed. EPSS score is low (0.09%), indicating limited exploitation likelihood.
Critical improper authentication vulnerability in code-projects School Fees Payment System version 1.0 that allows unauthenticated remote attackers to bypass authentication controls and gain unauthorized access to the system. The vulnerability has been publicly disclosed with proof-of-concept exploitation details available, making it an active threat with high likelihood of real-world exploitation against educational institutions and payment processing systems.
Critical SQL injection vulnerability in code-projects School Fees Payment System version 1.0, specifically in the /branch.php file's ID parameter, allowing remote unauthenticated attackers to execute arbitrary SQL commands. The vulnerability has been publicly disclosed with proof-of-concept exploitation available, and while the CVSS score is 7.3 (High), the unauthenticated network-accessible attack vector combined with confirmed public exploit disclosure indicates active exploitation risk. This affects all deployments of the vulnerable version without patches applied.
Critical SQL injection vulnerability in code-projects School Fees Payment System version 1.0, specifically in the /datatable.php file where the sSortDir_0 parameter is improperly sanitized. An unauthenticated remote attacker can exploit this to execute arbitrary SQL queries, potentially compromising confidentiality, integrity, and availability of the underlying database. The vulnerability has been publicly disclosed with exploit code available, indicating active exploitation risk.
SQL injection in code-projects School Fees Payment System 1.0 allows remote authenticated attackers to execute arbitrary SQL commands via the name_startsWith parameter in /ajx.php. A public exploit is available, but no active exploitation has been reported. EPSS score is low (0.09%), indicating limited exploitation likelihood.
SQL injection in code-projects Chat System 1.0 allows remote authenticated attackers to manipulate the cid parameter in /user/confirm_password.php, potentially leading to data leakage or modification. A public exploit exists, but no active exploitation has been confirmed.
Critical SQL injection vulnerability in code-projects Real Estate Property Management System version 1.0, specifically in the /Admin/EditCity.php endpoint. An unauthenticated remote attacker can exploit this vulnerability to execute arbitrary SQL commands, potentially leading to unauthorized data access, modification, or deletion. The exploit has been publicly disclosed with proof-of-concept code available, and the vulnerability is likely being actively exploited in the wild.
Critical SQL injection vulnerability in code-projects Real Estate Property Management System 1.0, specifically in the /Admin/InsertCity.php file's cmbState parameter. An unauthenticated remote attacker can exploit this vulnerability to execute arbitrary SQL commands, potentially leading to unauthorized data access, modification, or deletion. The vulnerability has been publicly disclosed with exploit code available, making active exploitation likely.
A SQL injection vulnerability (CVSS 7.3). Risk factors: public PoC available.
Critical SQL injection vulnerability in code-projects Real Estate Property Management System version 1.0 affecting the /Admin/InsertCategory.php endpoint. An unauthenticated remote attacker can manipulate the txtCategoryName parameter to execute arbitrary SQL commands, potentially compromising database confidentiality, integrity, and availability. The vulnerability has been publicly disclosed with exploit code available, making active exploitation a significant risk.
Critical SQL injection vulnerability in code-projects Real Estate Property Management System version 1.0, specifically in the /Admin/NewsReport.php file where the 'txtFrom' parameter is improperly sanitized. An unauthenticated remote attacker can exploit this vulnerability to execute arbitrary SQL queries, potentially leading to unauthorized data access, modification, or denial of service. The vulnerability has been publicly disclosed with exploit code available, increasing real-world exploitation risk.
Critical SQL injection vulnerability in code-projects Real Estate Property Management System version 1.0, specifically in the /Admin/Property.php file where the 'cmbCat' parameter is inadequately sanitized. An unauthenticated remote attacker can exploit this vulnerability to execute arbitrary SQL queries, potentially leading to unauthorized data access, modification, or deletion of the property management database. The exploit has been publicly disclosed with proof-of-concept code available, significantly elevating real-world exploitation risk.
Critical SQL injection vulnerability in code-projects Real Estate Property Management System version 1.0, specifically in the /Admin/User.php file's txtUserName parameter. An unauthenticated remote attacker can exploit this to execute arbitrary SQL commands, potentially compromising data confidentiality, integrity, and availability. Public exploit disclosure and active exploitation risk make this a high-priority remediation target.
A vulnerability was found in code-projects Police Station Management System 1.0. Rated medium severity (CVSS 4.8), this vulnerability is low attack complexity. Public exploit code available and no vendor patch available.
A vulnerability was found in code-projects Tourism Management System 1.0 and classified as critical. Rated medium severity (CVSS 4.8), this vulnerability is low attack complexity. Public exploit code available and no vendor patch available.
A vulnerability has been found in code-projects Tourism Management System 1.0 and classified as critical. Rated medium severity (CVSS 4.8), this vulnerability is low attack complexity. Public exploit code available and no vendor patch available.
A vulnerability, which was classified as problematic, was found in code-projects Employee Record System 1.0. Rated medium severity (CVSS 5.1), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
A vulnerability, which was classified as problematic, has been found in code-projects Employee Record System 1.0. Rated medium severity (CVSS 5.1), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
A vulnerability classified as critical was found in code-projects Employee Record System 1.0. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
A vulnerability, which was classified as critical, was found in code-projects Album Management System 1.0. Rated medium severity (CVSS 4.8), this vulnerability is low attack complexity. Public exploit code available and no vendor patch available.
A vulnerability classified as critical was found in code-projects Simple Hospital Management System 1.0. Rated medium severity (CVSS 4.8), this vulnerability is low attack complexity. Public exploit code available and no vendor patch available.
A vulnerability classified as critical has been found in code-projects Simple Bus Reservation System 1.0. Rated medium severity (CVSS 4.8), this vulnerability is low attack complexity. Public exploit code available and no vendor patch available.
A vulnerability was found in code-projects Simple College Management System 1.0. Rated medium severity (CVSS 4.8), this vulnerability is low attack complexity. Public exploit code available and no vendor patch available.
A vulnerability was found in code-projects Departmental Store Management System 1.0. Rated medium severity (CVSS 4.8), this vulnerability is low attack complexity. Public exploit code available and no vendor patch available.
A vulnerability, which was classified as critical, has been found in code-projects Jewelery Store Management system 1.0. Rated medium severity (CVSS 4.8), this vulnerability is low attack complexity. No vendor patch available.
A vulnerability was found in code-projects Nero Social Networking Site 1.0. Rated medium severity (CVSS 6.9), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
A vulnerability, which was classified as critical, was found in code-projects Online Bus Reservation System 1.0. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
A vulnerability, which was classified as critical, has been found in code-projects Online Bus Reservation System 1.0. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
Arbitrary file upload in the admin/profile_update.php script of Fabian Ros Library Management System 2.0 permits remote authenticated attackers to upload files without type or extension restrictions, potentially leading to remote code execution. Exploit code is publicly available, though EPSS exploitation probability is low (0.08%) and no active exploitation has been reported. The vulnerability is considered critical due to the ease of exploitation combined with the possibility of full system compromise.
Unrestricted file upload in Library Management System 2.0 allows authenticated remote attackers to upload arbitrary files via the photo parameter in /admin/student_edit_photo.php, potentially leading to remote code execution. The vulnerability is publicly disclosed with proof-of-concept exploits available. No active exploitation has been reported through CISA KEV.
SQL injection in Chat System 1.0 allows remote attackers to manipulate database queries via the 'msg' parameter of /user/send_message.php. Publicly available exploit code exists, but no active exploitation has been confirmed. The application is a low-footprint, unsupported project, limiting real-world exposure.
SQL injection in code-projects Chat System 1.0 allows remote attackers to execute arbitrary SQL commands via the ID parameter in /user/addmember.php. Public exploit code is available, but EPSS indicates low exploitation probability and no active exploitation has been confirmed.
SQL injection in Chat System 1.0 through the ID parameter of /user/fetch_member.php allows remote authenticated attackers with low privileges to extract or manipulate limited data from the application's database. Public exploit code is available, but no active exploitation has been reported and the EPSS probability is very low.
SQL injection in code-projects Chat System 1.0 allows authenticated remote attackers to manipulate backend database queries via the ID parameter of /user/fetch_chat.php. Public exploit code is available, and the vulnerability is rated critically by the reporter, but the CVSS 4.0 base impact is limited (low confidentiality, integrity, and availability) and EP
SQL injection in Food Distributor Site 1.0 allows remote attackers to manipulate the Username parameter on the admin login page to execute arbitrary SQL commands. Exploit code is publicly available, though EPSS indicates very low probability of exploitation (0.06%) and it is not listed in CISA KEV. An attacker could bypass authentication or extract sensitive data from the database.
Unrestricted file upload in code-projects E-Commerce Site 1.0 allows authenticated attackers to upload arbitrary PHP files via the photo parameter in /admin/users_photo.php, potentially leading to remote code execution on the server. Public exploit code is available, increasing immediate risk for instances where the admin panel is exposed.
SQL injection in Responsive Blog Site 1.0 allows remote attackers with low-level privileges to manipulate database queries via the 'ID' parameter in category.php, potentially leading to data leakage or modification. Public exploit code is available, though no active exploitation has been confirmed by CISA. The limited impact and low EPSS score (0.06%) reduce its real-world urgency.
SQL injection in code-projects Responsive Blog Site 1.0 allows authenticated remote attackers to manipulate the 'ID' parameter in /single.php to interfere with database queries, leading to data leakage or manipulation. A proof-of-concept exploit is publicly available, but no active exploitation has been reported (EPSS 0.06%).
Path traversal in code-projects Simple Forum 1.0 allows authenticated attackers to read arbitrary files via the filename parameter of /forum_downloadfile.php. Exploit code is publicly available, but no active exploitation has been confirmed (not in CISA KEV). CVSS 4.0 base score is 2.1 (Low), reflecting limited impact on confidentiality only.
Remote SQL injection in code-projects Simple Forum 1.0 allows authenticated low-privilege attackers to read, modify, or delete database contents via the File parameter in /forum1.php. Exploit code is publicly available but no active exploitation has been reported; EPSS indicates very low exploitation probability.
Cross-site scripting in code-projects Simple Forum 1.0 allows a low-privileged remote attacker to inject arbitrary JavaScript via the /forum_edit1.php text parameter. The attack can be carried out by an authenticated user and executes when another user views the manipulated page. Public exploit code is available, but EPSS data indicates very low exploitation probability.
Unrestricted file upload in Simple Forum 1.0 allows remote authenticated attackers to upload arbitrary files via the File parameter in /forum1.php. Public exploit code is available, enabling low-privileged users to potentially place malicious scripts on the server.
SQL injection in Simple Forum 1.0 allows remote attackers to manipulate the 'iii' parameter in /forum_edit.php, potentially leading to unauthorized database access. A public proof-of-concept exploit exists, though no active exploitation has been confirmed. The vulnerability affects an open-source PHP forum application.
Remote SQL injection in Simple Forum 1.0 allows unauthenticated attackers to execute arbitrary SQL commands via the 'Name' parameter in /forum_viewfile.php. Public exploit code exists but no active exploitation is known; EPSS score is very low (0.04%) indicating limited real-world targeting despite high technical impact potential.
SQL injection in Simple Forum 1.0 allows remote attackers to execute arbitrary SQL queries via the User parameter in /register1.php. A public exploit is available on GitHub, increasing the likelihood of targeted attacks, though the EPSS score is low at 0.06% indicating limited active exploitation at present.
SQL injection in Simple Forum 1.0's signin.php allows remote attackers to manipulate the User parameter, potentially leading to unauthorized data access or modification. The vulnerability is publicly disclosed with exploit code available, though EPSS scoring indicates low immediate exploitation probability.
Unrestricted file upload in Simple Photo Gallery 1.0 allows remote attackers to upload malicious PHP files via the /upload-photo.php endpoint without authentication, enabling remote code execution on the web server. Although exploit code is publicly available, the EPSS score (0.12%) is low, and no active exploitation is reported—real-world risk appears limited by the application's niche deployment.
Authenticated SQL injection in Product Inventory System 1.0 via the ID parameter in /admin/edit_user.php allows high-privilege attackers to execute arbitrary SQL commands. A public proof-of-concept is available, but the very low EPSS score (0.06%) and absence of KEV listing indicate negligible real-world exploitation risk.
SQL injection in Product Inventory System 1.0 allows remote authenticated attackers with administrative privileges to modify database records via the ID parameter in /admin/edit_product.php. Exploit code is publicly available, but no evidence of active exploitation; the EPSS score is very low (0.06%), suggesting limited real-world risk at this time.
SQL injection in the login endpoint of code-projects Product Inventory System 1.0 allows remote attackers to manipulate the Username parameter. This can lead to authentication bypass, data leakage, or database tampering. Exploit code is publicly available, but no active exploitation campaign has been confirmed.
Stored cross-site scripting (XSS) in code-projects Food Distributor Site 1.0 allows an authenticated administrator to inject arbitrary JavaScript into site settings. The vulnerability is triggered via the site_phone, site_email, or address parameters in the /admin/save_settings.php endpoint. Public exploit code is available, but the high privilege requirement (administrator access) and low EPSS score (0.07%) limit real-world risk.
SQL injection in code-projects Food Distributor Site 1.0 allows remote attackers to bypass authentication or extract sensitive data via crafted username/password inputs at /admin/process_login.php. A public proof-of-concept exploit is available, but no active exploitation has been confirmed. Despite being classified as "critical" by the reporter, the CVSS 4.0 base score is 5.5 (Medium) with low impact across confidentiality, integrity, and availability.
CVE-2025-6578 is a critical SQL injection vulnerability in Simple Online Hotel Reservation System version 1.0 affecting the /admin/delete_account.php file through unsanitized admin_id parameter manipulation. An unauthenticated remote attacker can execute arbitrary SQL queries to read, modify, or delete database contents. The vulnerability has been publicly disclosed with proof-of-concept code available, presenting immediate exploitation risk for deployed instances.
Cross-site scripting in code-projects School Fees Payment System 1.0 allows remote attackers to inject arbitrary web script via crafted parameters in /student.php. The vulnerability requires user interaction (clicking a malicious link) and a publicly available proof-of-concept exists. EPSS score indicates very low exploitation probability, and no active exploitation has been reported.
SQL injection in code-projects Online Shopping Store 1.0 allows remote authenticated attackers to manipulate database queries via the cat_id, brand_id, keyword, proId, or pid parameters in /action.php. Public exploit code exists, but no active exploitation has been confirmed. EPSS score is low (0.14%), indicating limited exploitation likelihood.
Cross-site scripting (XSS) in code-projects School Fees Payment System 1.0 allows remote attackers to inject arbitrary web script via the 'transcation_remark' parameter in /fees.php. Public exploit code exists, but no active exploitation has been confirmed. EPSS score is low (0.06%), indicating low exploitation likelihood.
CVE-2025-6472 is a critical SQL injection vulnerability in code-projects Online Bidding System 1.0 affecting the /showprod.php file's ID parameter. An unauthenticated remote attacker can exploit this vulnerability to execute arbitrary SQL queries, potentially leading to unauthorized data access, modification, or denial of service. The vulnerability has been publicly disclosed with exploit code available, creating immediate risk for exposed instances.
CVE-2025-6471 is a critical SQL injection vulnerability in code-projects Online Bidding System version 1.0 affecting the /administrator endpoint, where the 'aduser' parameter is not properly sanitized. An unauthenticated remote attacker can exploit this to execute arbitrary SQL queries, potentially leading to unauthorized data access, modification, or deletion. Public exploit code is available and the vulnerability is actively exploitable with no authentication required.
CVE-2025-6470 is a critical SQL injection vulnerability in code-projects Online Bidding System 1.0, specifically in the /bidlog.php file's ID parameter, allowing unauthenticated remote attackers to execute arbitrary SQL queries. The vulnerability has been publicly disclosed with proof-of-concept code available, presenting immediate exploitation risk. With a CVSS score of 7.3 and network-accessible attack vector requiring no authentication, this poses significant risk to confidentiality, integrity, and availability of affected systems.
A SQL injection vulnerability in A vulnerability (CVSS 7.3). Risk factors: public PoC available.
CVE-2025-6468 is a critical SQL injection vulnerability in code-projects Online Bidding System version 1.0 affecting the /bidnow.php file's ID parameter. An unauthenticated remote attacker can exploit this vulnerability to read, modify, or delete database contents, potentially compromising confidentiality, integrity, and availability of the entire bidding system. The vulnerability has been publicly disclosed with proof-of-concept code available, significantly increasing exploitation risk in active deployments.
CVE-2025-6467 is a critical SQL injection vulnerability in code-projects Online Bidding System version 1.0 affecting the /login.php file's User parameter, allowing unauthenticated remote attackers to execute arbitrary SQL queries and potentially compromise data confidentiality, integrity, and availability. The vulnerability has been publicly disclosed with exploit code available, and while the CVSS score of 7.3 indicates high severity, the attack requires no authentication or user interaction, making it highly exploitable in real-world scenarios.
CVE-2025-6458 is a critical SQL injection vulnerability in code-projects Online Hotel Reservation System version 1.0, affecting the /admin/execedituser.php endpoint. An unauthenticated remote attacker can manipulate the 'userid' parameter to execute arbitrary SQL queries, potentially leading to unauthorized data access, modification, or deletion. The vulnerability has been publicly disclosed with exploit code available, making it actively exploitable in the wild.
CVE-2025-6457 is a critical SQL injection vulnerability in code-projects Online Hotel Reservation System 1.0 affecting the /reservation/demo.php file, where the 'Start' parameter is unsanitized and directly used in database queries. An unauthenticated remote attacker can exploit this vulnerability to read, modify, or delete sensitive database content including guest information, reservations, and payment data. The vulnerability has been publicly disclosed with exploit code available, though specific EPSS probability and KEV/CISA inclusion status cannot be determined from provided data.
CVE-2025-6456 is a critical SQL injection vulnerability in code-projects Online Hotel Reservation System 1.0, specifically in the /reservation/order.php file's 'Start' parameter. An unauthenticated remote attacker can manipulate this parameter to execute arbitrary SQL queries, potentially leading to unauthorized data access, modification, or deletion of the hotel reservation database. Public exploit code is available, and the vulnerability is actively exploitable.
CVE-2025-6455 is a SQL injection vulnerability in code-projects Online Hotel Reservation System version 1.0, specifically in the /messageexec.php file where the 'Name' parameter is insufficiently sanitized. An unauthenticated remote attacker can exploit this to execute arbitrary SQL commands, potentially leading to unauthorized data access, modification, or deletion. The vulnerability has been publicly disclosed with exploit code available, indicating active exploitation risk.
CVE-2025-6451 is a critical SQL injection vulnerability in code-projects Simple Online Hotel Reservation System version 1.0, affecting the /admin/delete_pending.php file where the transaction_id parameter is unsanitized. An unauthenticated remote attacker can exploit this to execute arbitrary SQL queries, potentially leading to data exfiltration, modification, or deletion of the hotel reservation database. Public exploit disclosure and active threat indicators suggest this vulnerability warrants immediate patching.
CVE-2025-6450 is a critical SQL injection vulnerability in code-projects Simple Online Hotel Reservation System version 1.0, affecting the /admin/confirm_reserve.php endpoint where the transaction_id parameter is inadequately sanitized. An unauthenticated remote attacker can exploit this vulnerability to execute arbitrary SQL commands, potentially leading to unauthorized data access, modification, or deletion of the hotel reservation database. Public exploit code is available and the vulnerability meets criteria for active exploitation risk.
CVE-2025-6449 is a critical SQL injection vulnerability in Simple Online Hotel Reservation System v1.0 affecting the /admin/checkout_query.php endpoint. An unauthenticated remote attacker can manipulate the 'transaction_id' parameter to execute arbitrary SQL queries, potentially leading to unauthorized data access, modification, or system disruption. The vulnerability has been publicly disclosed with exploits available, and the CVSS 7.3 score reflects high impact across confidentiality, integrity, and availability despite moderate attack complexity.
CVE-2025-6448 is a critical SQL injection vulnerability in code-projects Simple Online Hotel Reservation System 1.0 affecting the /admin/delete_room.php endpoint. An unauthenticated remote attacker can manipulate the room_id parameter to execute arbitrary SQL queries, potentially resulting in unauthorized data access, modification, or deletion. The vulnerability has been publicly disclosed with working exploits available, making active exploitation likely.
CVE-2025-6447 is a critical SQL injection vulnerability in the Simple Online Hotel Reservation System version 1.0, specifically in the /admin/index.php file's Username parameter. An unauthenticated remote attacker can exploit this vulnerability to execute arbitrary SQL queries, potentially leading to unauthorized data access, modification, or system disruption. The exploit has been publicly disclosed with proof-of-concept code available, significantly increasing the risk of active exploitation.
A critical SQL injection vulnerability exists in code-projects Client Details System version 1.0, specifically in the /clientdetails/admin/index.php file where the Username parameter is improperly validated. An unauthenticated remote attacker can exploit this vulnerability to execute arbitrary SQL commands, potentially leading to unauthorized data access, modification, or deletion. The vulnerability has public exploit code available and demonstrates moderate real-world risk despite the critical classification, with a CVSS score of 7.3 indicating concrete but not maximum severity.
A critical SQL injection vulnerability exists in code-projects Simple Online Hotel Reservation System version 1.0, specifically in the /admin/add_account.php file where the 'name' or 'admin_id' parameters are not properly sanitized. An unauthenticated remote attacker can exploit this vulnerability to execute arbitrary SQL commands, potentially leading to unauthorized data access, modification, or deletion of the hotel reservation database. Public exploit code is available and the vulnerability is actively being disclosed, increasing exploitation risk in the wild.
A critical SQL injection vulnerability exists in code-projects Simple Online Hotel Reservation System version 1.0, specifically in the /admin/add_room.php file where the 'room_type' parameter is insufficiently sanitized. An unauthenticated remote attacker can exploit this vulnerability to execute arbitrary SQL commands, potentially leading to unauthorized data access, modification, or deletion of hotel reservation system data. A proof-of-concept exploit has been publicly disclosed, increasing real-world exploitation risk.
CVE-2025-6419 is a critical SQL injection vulnerability in code-projects Simple Online Hotel Reservation System 1.0 affecting the /admin/edit_room.php endpoint, where the 'room_type' parameter is improperly sanitized, allowing unauthenticated remote attackers to execute arbitrary SQL commands. The vulnerability has a CVSS score of 7.3 with public proof-of-concept code available, indicating active exploitation risk and widespread discoverability.
CVE-2025-6418 is a critical SQL injection vulnerability in Simple Online Hotel Reservation System 1.0 affecting the /admin/edit_query_account.php endpoint, where the 'Name' parameter is improperly sanitized, allowing remote attackers to execute arbitrary SQL queries without authentication. The vulnerability has been publicly disclosed with exploit code availability, making it a high-priority threat for organizations running this system in production; attackers can manipulate database queries to extract sensitive data, modify records, or potentially escalate privileges.
CVE-2025-6403 is a critical SQL injection vulnerability in code-projects School Fees Payment System version 1.0, specifically in the /student.php file's ID parameter. An unauthenticated remote attacker can exploit this to execute arbitrary SQL queries, potentially leading to unauthorized data access, modification, or deletion of student and payment records. The vulnerability has been publicly disclosed with working exploits available, and while the CVSS score of 7.3 indicates medium-to-high severity, the SQL injection vector combined with public PoC availability presents significant real-world risk for deployed instances.
A SQL injection vulnerability in A vulnerability (CVSS 7.3). Risk factors: public PoC available.
CVE-2025-6355 is a critical SQL injection vulnerability in SourceCodester Online Hotel Reservation System version 1.0, specifically in the /admin/execeditroom.php file where the 'userid' parameter is improperly sanitized. An unauthenticated remote attacker can exploit this vulnerability to inject arbitrary SQL commands, potentially leading to unauthorized data access, modification, or denial of service. Public disclosure and proof-of-concept availability significantly elevate real-world exploitation risk.
Cross-site scripting (XSS) in Responsive Blog 1.0 allows an authenticated attacker to inject arbitrary JavaScript via the keyword parameter in /search.php. A public exploit exists, but no active exploitation has been reported and EPSS risk is low (0.06%).
A security vulnerability in A vulnerability classified as problematic (CVSS 5.3). Risk factors: public PoC available.
Cross-site scripting (XSS) in Responsive Blog 1.0/1.12.4/3.3.4 via the admin pageViewMembers.php allows authenticated attackers with high privileges to inject malicious scripts. A public exploit exists, but EPSS score is low (0.04%) and no active exploitation in CISA KEV.
Cross-site request forgery in code-projects School Fees Payment System 1.0 allows an attacker to perform unauthorized actions on behalf of an authenticated user. A publicly available exploit exists, but no active exploitation has been reported. The EPSS score is low (0.09%), indicating low exploitation likelihood.
Cross-site scripting (XSS) in code-projects School Fees Payment System 1.0 allows an authenticated attacker to inject arbitrary web scripts via the Branch/Address/Detail parameters in /branch.php. A public exploit exists, but no active exploitation has been reported. The EPSS score is low (0.05%), indicating low exploitation likelihood.
CVE-2025-6296 is a critical SQL injection vulnerability in code-projects Hostel Management System version 1.0, specifically in the /empty_rooms.php file's search_box parameter. An unauthenticated remote attacker can exploit this to execute arbitrary SQL queries, potentially achieving unauthorized data access, modification, or deletion. The vulnerability has been publicly disclosed with exploits available, making active exploitation highly probable in real-world deployments.
A SQL injection vulnerability in A vulnerability (CVSS 7.3). Risk factors: public PoC available.
CVE-2025-6294 is a critical SQL injection vulnerability in code-projects Hostel Management System version 1.0, specifically in the /contact.php file's hostel_name parameter. An unauthenticated remote attacker can exploit this without user interaction to execute arbitrary SQL queries, potentially leading to unauthorized data access, modification, or deletion. The vulnerability has been publicly disclosed with exploit code available, and while CVSS 7.3 indicates moderate-to-high severity with confidentiality, integrity, and availability impact, the simplicity of exploitation (network-accessible, no privileges required, low complexity) makes this a practical threat requiring immediate patching.
CVE-2025-6293 is a critical SQL injection vulnerability in code-projects Hostel Management System v1.0 affecting the /contact_manager.php endpoint, where the student_roll_no parameter is inadequately sanitized, allowing unauthenticated remote attackers to execute arbitrary SQL queries and potentially exfiltrate, modify, or delete database records. Public exploit disclosure and active exploitation signals indicate this is a high-priority threat requiring immediate remediation.
A remote code execution vulnerability (CVSS 7.3). Risk factors: public PoC available.
Critical SQL injection vulnerability in code-projects Hostel Management System version 1.0, specifically in the /allocate_room.php file's 'search_box' parameter. An unauthenticated remote attacker can exploit this vulnerability to execute arbitrary SQL queries, potentially leading to unauthorized data access, modification, and system disruption. The vulnerability has been publicly disclosed with proof-of-concept code available, making it actively exploitable in the wild.
SQL injection in code-projects Restaurant Order System 1.0 allows remote authenticated attackers to manipulate database queries via the ID parameter in /table.php. A public exploit exists, but no active exploitation has been confirmed. EPSS score is low (0.09%), indicating limited exploitation likelihood.
Critical improper authentication vulnerability in code-projects School Fees Payment System version 1.0 that allows unauthenticated remote attackers to bypass authentication controls and gain unauthorized access to the system. The vulnerability has been publicly disclosed with proof-of-concept exploitation details available, making it an active threat with high likelihood of real-world exploitation against educational institutions and payment processing systems.
Critical SQL injection vulnerability in code-projects School Fees Payment System version 1.0, specifically in the /branch.php file's ID parameter, allowing remote unauthenticated attackers to execute arbitrary SQL commands. The vulnerability has been publicly disclosed with proof-of-concept exploitation available, and while the CVSS score is 7.3 (High), the unauthenticated network-accessible attack vector combined with confirmed public exploit disclosure indicates active exploitation risk. This affects all deployments of the vulnerable version without patches applied.
Critical SQL injection vulnerability in code-projects School Fees Payment System version 1.0, specifically in the /datatable.php file where the sSortDir_0 parameter is improperly sanitized. An unauthenticated remote attacker can exploit this to execute arbitrary SQL queries, potentially compromising confidentiality, integrity, and availability of the underlying database. The vulnerability has been publicly disclosed with exploit code available, indicating active exploitation risk.
SQL injection in code-projects School Fees Payment System 1.0 allows remote authenticated attackers to execute arbitrary SQL commands via the name_startsWith parameter in /ajx.php. A public exploit is available, but no active exploitation has been reported. EPSS score is low (0.09%), indicating limited exploitation likelihood.
SQL injection in code-projects Chat System 1.0 allows remote authenticated attackers to manipulate the cid parameter in /user/confirm_password.php, potentially leading to data leakage or modification. A public exploit exists, but no active exploitation has been confirmed.
Critical SQL injection vulnerability in code-projects Real Estate Property Management System version 1.0, specifically in the /Admin/EditCity.php endpoint. An unauthenticated remote attacker can exploit this vulnerability to execute arbitrary SQL commands, potentially leading to unauthorized data access, modification, or deletion. The exploit has been publicly disclosed with proof-of-concept code available, and the vulnerability is likely being actively exploited in the wild.
Critical SQL injection vulnerability in code-projects Real Estate Property Management System 1.0, specifically in the /Admin/InsertCity.php file's cmbState parameter. An unauthenticated remote attacker can exploit this vulnerability to execute arbitrary SQL commands, potentially leading to unauthorized data access, modification, or deletion. The vulnerability has been publicly disclosed with exploit code available, making active exploitation likely.
A SQL injection vulnerability (CVSS 7.3). Risk factors: public PoC available.
Critical SQL injection vulnerability in code-projects Real Estate Property Management System version 1.0 affecting the /Admin/InsertCategory.php endpoint. An unauthenticated remote attacker can manipulate the txtCategoryName parameter to execute arbitrary SQL commands, potentially compromising database confidentiality, integrity, and availability. The vulnerability has been publicly disclosed with exploit code available, making active exploitation a significant risk.
Critical SQL injection vulnerability in code-projects Real Estate Property Management System version 1.0, specifically in the /Admin/NewsReport.php file where the 'txtFrom' parameter is improperly sanitized. An unauthenticated remote attacker can exploit this vulnerability to execute arbitrary SQL queries, potentially leading to unauthorized data access, modification, or denial of service. The vulnerability has been publicly disclosed with exploit code available, increasing real-world exploitation risk.
Critical SQL injection vulnerability in code-projects Real Estate Property Management System version 1.0, specifically in the /Admin/Property.php file where the 'cmbCat' parameter is inadequately sanitized. An unauthenticated remote attacker can exploit this vulnerability to execute arbitrary SQL queries, potentially leading to unauthorized data access, modification, or deletion of the property management database. The exploit has been publicly disclosed with proof-of-concept code available, significantly elevating real-world exploitation risk.
Critical SQL injection vulnerability in code-projects Real Estate Property Management System version 1.0, specifically in the /Admin/User.php file's txtUserName parameter. An unauthenticated remote attacker can exploit this to execute arbitrary SQL commands, potentially compromising data confidentiality, integrity, and availability. Public exploit disclosure and active exploitation risk make this a high-priority remediation target.
A vulnerability was found in code-projects Police Station Management System 1.0. Rated medium severity (CVSS 4.8), this vulnerability is low attack complexity. Public exploit code available and no vendor patch available.
A vulnerability was found in code-projects Tourism Management System 1.0 and classified as critical. Rated medium severity (CVSS 4.8), this vulnerability is low attack complexity. Public exploit code available and no vendor patch available.
A vulnerability has been found in code-projects Tourism Management System 1.0 and classified as critical. Rated medium severity (CVSS 4.8), this vulnerability is low attack complexity. Public exploit code available and no vendor patch available.
A vulnerability, which was classified as problematic, was found in code-projects Employee Record System 1.0. Rated medium severity (CVSS 5.1), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
A vulnerability, which was classified as problematic, has been found in code-projects Employee Record System 1.0. Rated medium severity (CVSS 5.1), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
A vulnerability classified as critical was found in code-projects Employee Record System 1.0. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
A vulnerability, which was classified as critical, was found in code-projects Album Management System 1.0. Rated medium severity (CVSS 4.8), this vulnerability is low attack complexity. Public exploit code available and no vendor patch available.
A vulnerability classified as critical was found in code-projects Simple Hospital Management System 1.0. Rated medium severity (CVSS 4.8), this vulnerability is low attack complexity. Public exploit code available and no vendor patch available.
A vulnerability classified as critical has been found in code-projects Simple Bus Reservation System 1.0. Rated medium severity (CVSS 4.8), this vulnerability is low attack complexity. Public exploit code available and no vendor patch available.
A vulnerability was found in code-projects Simple College Management System 1.0. Rated medium severity (CVSS 4.8), this vulnerability is low attack complexity. Public exploit code available and no vendor patch available.
A vulnerability was found in code-projects Departmental Store Management System 1.0. Rated medium severity (CVSS 4.8), this vulnerability is low attack complexity. Public exploit code available and no vendor patch available.
A vulnerability, which was classified as critical, has been found in code-projects Jewelery Store Management system 1.0. Rated medium severity (CVSS 4.8), this vulnerability is low attack complexity. No vendor patch available.
A vulnerability was found in code-projects Nero Social Networking Site 1.0. Rated medium severity (CVSS 6.9), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
A vulnerability, which was classified as critical, was found in code-projects Online Bus Reservation System 1.0. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
A vulnerability, which was classified as critical, has been found in code-projects Online Bus Reservation System 1.0. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.