Itsourcecode
Monthly
SQL injection in itsourcecode Sales and Inventory System 1.0 allows remote authenticated attackers with low-privilege accounts to manipulate the ID argument passed to mysqli_query() in /pages/us_searchfrm.php, enabling database enumeration, data exfiltration, and potential data modification. A public exploit has been published on GitHub, corroborated by VulDB reporting. The CVSS 4.0 vector (PR:L, E:P) confirms authentication is required but that exploit code is in circulation, lowering the bar for opportunistic abuse.
SQL injection in itsourcecode Sales and Inventory System 1.0 allows authenticated remote attackers to manipulate database queries through the `ID` parameter of `/pages/cust_edit1.php`. Exploitation requires low-privilege authentication and can result in unauthorized data read, modification, and limited availability impact against the underlying database. A public proof-of-concept exploit has been disclosed via GitHub, lowering the bar for opportunistic exploitation of any deployed instance.
SQL injection in itsourcecode Sales and Inventory System 1.0 allows authenticated remote attackers to manipulate database queries by injecting arbitrary SQL via the `ID` parameter in `/pages/pro_searchfrm.php`. The CVSS 4.0 vector (PR:L) confirms that low-privilege authenticated access is required, limiting the exposure compared to fully unauthenticated SQLi. A publicly available proof-of-concept exists on GitHub (referenced as an issue in the yunfan668/cve repository), though no active exploitation has been confirmed by CISA KEV. The affected product is a free PHP educational source-code project distributed by itsourcecode.com, constraining real-world impact to deployments of this niche academic software.
SQL injection in itsourcecode Sales and Inventory System 1.0 allows authenticated remote attackers to manipulate the unsanitized `ID` parameter in `/pages/us_edit1.php`, enabling unauthorized database reads, data modification, and potential privilege escalation within the application. A public proof-of-concept exploit has been disclosed on GitHub, confirming the issue is both reproducible and accessible to low-skilled attackers. No vendor patch has been identified; the product is a PHP-based educational/demo application with limited enterprise deployment footprint.
SQL injection in itsourcecode Sales and Inventory System 1.0 exposes the /pages/settings_edit.php endpoint to database manipulation via the unsanitized ID parameter. Authenticated attackers with low-privilege access can read, modify, or partially disrupt database contents. A public proof-of-concept has been disclosed on GitHub, materially lowering the exploitation skill threshold for any system running this application.
SQL injection in itsourcecode School Management System 1.0 allows unauthenticated remote attackers to manipulate the email parameter in User_Login.php, injecting arbitrary SQL into backend database queries at the pre-authentication login endpoint. With a public exploit available on GitHub, exploitation requires minimal skill and no credentials. The CVSS 4.0 vector confirms network-accessible, no-privilege exploitation with partial confidentiality, integrity, and availability impact against the underlying database.
SQL injection in itsourcecode Information System Society Membership System 1.0 exposes the database to read and write operations by authenticated remote attackers who manipulate the `student_id` parameter in `/society/check_student.php`. A public proof-of-concept exploit has been disclosed on GitHub. The CVSS 4.0 base score of 5.3 with low-impact ratings across C/I/A appears conservative for a CWE-89 flaw, which typically permits full database extraction and modification via UNION or stacked-query techniques.
SQL injection in itsourcecode Sales and Inventory System 1.0 allows authenticated remote attackers to manipulate database queries via the Username parameter in /pages/us_transac.php. The CVSS 4.0 vector (PR:L) confirms a login is required, limiting the unauthenticated attack surface, but the impact spans confidentiality, integrity, and availability of the underlying database. A public proof-of-concept exploit has been disclosed via a GitHub issue, raising the likelihood of opportunistic exploitation against any exposed instance.
SQL injection in itsourcecode Sales and Inventory System 1.0 exposes the `/pages/sup_transac.php` endpoint to database manipulation via the unsanitized `companyname` parameter. Authenticated remote attackers can inject arbitrary SQL, achieving partial read and write access to the underlying database. A public proof-of-concept exploit exists per GitHub issue reference; no CISA KEV listing has been observed.
SQL injection in itsourcecode Sales and Inventory System 1.0 allows authenticated remote attackers to manipulate database queries via the Name parameter in /pages/pro_transac.php?action=add. The vulnerability stems from unsanitized user input passed directly to SQL queries in a PHP backend, enabling data extraction, modification, or denial of service against the underlying database. A public exploit has been disclosed on GitHub, lowering the bar for exploitation.
SQL injection in itsourcecode Sales and Inventory System 1.0 allows low-privileged remote attackers to manipulate database queries via the firstname parameter in the /pages/cust_transac.php?action=add endpoint, potentially enabling unauthorized data exfiltration, modification, or deletion. The CVSS 4.0 vector confirms authentication is required (PR:L), restricting exploitation to users with at least low-privilege credentials. A public exploit is available on GitHub, lowering the practical barrier for authenticated attackers, though no confirmed active exploitation (CISA KEV) has been identified.
SQL injection in itsourcecode Sales and Inventory System 1.0 allows authenticated remote attackers to manipulate the ID parameter in /pages/us_del.php?type=user to execute arbitrary SQL statements against the backend database. The CVSS 4.0 vector (PR:L) confirms that low-privilege authenticated access is required, limiting the attack surface to logged-in users. A public proof-of-concept exploit has been disclosed on GitHub, elevating practical risk despite the moderate base score of 5.3.
SQL injection in itsourcecode Sales and Inventory System 1.0 allows low-privileged remote attackers to manipulate the `ID` parameter in `/pages/trans_view.php`, enabling arbitrary database read and write operations. The vulnerability is CWE-89 (Improper Neutralization of Special Elements in SQL Commands), affecting version 1.0 with no version range ambiguity per the CPE wildcard. A public exploit has been released and is available for use in attacks, raising the practical risk above the moderate CVSS 4.0 score of 5.3 suggests.
SQL injection in itsourcecode Sales and Inventory System 1.0 allows a remote authenticated low-privileged user to manipulate the ID parameter in /pages/pro_del.php to read, modify, or partially disrupt the underlying database. The vulnerability is exploitable over the network with low complexity and carries a publicly available proof-of-concept. No vendor patch has been identified; the software is a free educational PHP project distributed by itsourcecode.com, limiting real-world production exposure.
SQL injection in itsourcecode Sales and Inventory System 1.0 allows authenticated remote attackers to manipulate the unsanitized `ID` parameter in `/pages/inv_del.php`, enabling database enumeration, data extraction, and record modification. The application is an educational PHP project from itsourcecode.com with minimal production exposure, and a public proof-of-concept exploit has been published on GitHub. No vendor-released patch has been identified at time of analysis.
Unrestricted file upload in itsourcecode Online Medicine Delivery System 1.0 allows unauthenticated remote attackers to upload arbitrary files - including PHP webshells - through the image parameter of the Order Management Controller endpoint. The vulnerable function doInsert in /rider/orders/controller.php?action=add performs no validation of uploaded file types, enabling direct server-side code execution. A public exploit demonstrating RCE via this file upload path has been released on GitHub and is actively circulating.
Reflected cross-site scripting in itsourcecode Online Medicine Delivery System 1.0 allows an authenticated remote attacker to inject and execute arbitrary JavaScript in a victim's browser by manipulating the `location` parameter of the `/index.php?q=orderdetails` endpoint. The attacker must induce a logged-in user to follow a crafted URL, at which point the unsanitized parameter value is reflected directly into the page response. A public proof-of-concept writeup on GitHub confirms exploitability; no KEV designation applies.
SQL injection in itsourcecode Online Medicine Delivery System 1.0 allows remote authenticated customers to manipulate the backend database via the `proid` parameter in the `addwishlist` function at `/customer/controller.php?action=addwish`. Any valid customer-level session can submit a crafted POST request to extract or modify database contents, including potentially customer PII, credentials, and order records. No KEV listing exists; CVSS 4.0 scores this 5.3 (Medium), reflecting the authentication barrier (PR:L) and limited per-component impact ratings.
SQL injection in itsourcecode Online Medicine Delivery System 1.0 allows remote attackers to manipulate the ID argument passed to Order::pupdate in the rider order-confirmation endpoint, enabling arbitrary database queries. The vulnerable parameter is processed without sanitization at /rider/orders/controller.php?action=edit&actions=confirm. A public proof-of-concept has been disclosed on GitHub; no KEV listing and no vendor patch are available at time of analysis.
SQL injection in itsourcecode Online Medicine Delivery System 1.0 exposes unauthenticated attackers to direct database manipulation via the Password Recovery Interface. The `Customer::find_phone` function in `/passwordrecover.php` accepts the `phonenumber` parameter without sanitization, allowing arbitrary SQL to be injected into backend queries. A public proof-of-concept exploit has been disclosed on GitHub; the vulnerability is not currently listed in CISA KEV, but the low complexity and zero-authentication requirement make opportunistic exploitation trivial.
SQL injection in itsourcecode Online Medicine Delivery System 1.0 allows unauthenticated remote attackers to manipulate backend database queries via the Category parameter in the Product Category Filter Interface at /index.php?q=product. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) confirms exploitation requires no privileges or user interaction, and a public proof-of-concept is available on GitHub (E:P), materially lowering the exploitation barrier. Impact is rated Low across confidentiality, integrity, and availability, suggesting constrained database access rather than full system compromise; no CISA KEV listing has been identified.
SQL injection in itsourcecode Online Medicine Delivery System 1.0 exposes the Product Search Interface to remote unauthenticated database manipulation via the Search argument handled by the `loadResultList` function at `/index.php?q=product`. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) confirms no authentication, no complexity, and no user interaction are required. Publicly available exploit code exists, documented on GitHub via VulDB submission, though this product has not been added to the CISA KEV catalog and no widespread exploitation has been confirmed.
SQL injection in itsourcecode Online Medicine Delivery System 1.0 exposes database contents to remote unauthenticated attackers through the `ID` parameter in the `loadResultList` function on the Product Detail Page. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) confirms exploitation requires no credentials, no special configuration, and no user interaction. A proof-of-concept exploit has been publicly disclosed on GitHub, materially lowering the bar for opportunistic attackers beyond what the moderate score alone implies.
SQL injection in itsourcecode Online Medicine Delivery System 1.0 allows unauthenticated remote attackers to manipulate the U_USERNAME parameter in the Customer::cusAuthentication function at /login.php, enabling authentication bypass and potential database extraction. A public proof-of-concept exploit is available on GitHub, confirmed by the CVSS 4.0 E:P (proof-of-concept) modifier and a linked exploit write-up. No patch has been identified; this is a small PHP application likely used in academic or learning environments with limited production exposure.
SQL injection in itsourcecode Online Medicine Delivery System 1.0 allows unauthenticated remote attackers to manipulate database queries through the emp_email parameter on the rider login endpoint. The Employee::employeeAuthentication function at /rider/login.php incorporates unsanitized email input directly into SQL queries, enabling authentication bypass and potential data extraction. A public proof-of-concept exploit has been released with no vendor patch available, making any deployed instance immediately exploitable by low-skill attackers.
SQL injection in itsourcecode Sales and Inventory System 1.0 allows remote authenticated attackers to manipulate database queries via the unsanitized `ID` parameter in `/pages/inv_edit.php`. Exploitation requires a valid application account (PR:L per CVSS 4.0 vector), and a public proof-of-concept is available on GitHub, lowering the exploitation bar for any user with credentials. The vulnerability is not currently listed in CISA KEV, and the CVSS 4.0 score of 5.3 (Medium) reflects the authentication prerequisite limiting broader impact.
SQL injection in itsourcecode Sales and Inventory System 1.0 exposes the /pages/sup_searchfrm.php endpoint to database manipulation via the unsanitized ID parameter. Low-privileged authenticated attackers can remotely exploit this classic CWE-89 flaw to read, modify, or potentially delete backend database records. A public proof-of-concept exploit has been disclosed via GitHub; no active exploitation or CISA KEV listing has been identified at time of analysis.
SQL injection in itsourcecode Sales and Inventory System 1.0 exposes the `/pages/cust_searchfrm.php` customer search endpoint to database manipulation via an unsanitized `ID` parameter. Authenticated remote attackers with low-privilege access can alter backend SQL queries to read, modify, or delete customer and inventory records. A public proof-of-concept exploit is available, lowering the bar for targeted attacks despite the absence of a CISA KEV listing.
SQL injection in itsourcecode Sales and Inventory System 1.0 allows authenticated remote attackers to manipulate database queries via the ID parameter in /pages/pro_edit.php. The vulnerability stems from unsanitized user input passed directly to SQL queries (CWE-89), enabling read and limited write access to the underlying database. A public proof-of-concept exploit has been disclosed on GitHub; no active exploitation by KEV standards is confirmed at this time.
SQL injection in itsourcecode Sales and Inventory System 1.0 exposes the `/pages/emp_searchfrm.php` endpoint to authenticated remote attackers who can manipulate database queries by injecting malicious SQL through the unsanitized `ID` parameter. Low-privileged users with valid credentials can read, modify, or corrupt application database contents. A public proof-of-concept exploit has been published via GitHub, making active exploitation a credible near-term risk for any internet-exposed instance.
SQL injection in itsourcecode Sales and Inventory System 1.0 allows low-privileged remote attackers to manipulate database queries via the unsanitized 'ID' parameter in /pages/emp_del.php. The CVSS 4.0 vector (PR:L, E:P) confirms exploitation requires a low-privileged authenticated session but no special configuration beyond basic access. A public proof-of-concept exploit has been released, raising the practical risk above what the moderate CVSS score alone suggests; however, this vulnerability is not currently listed in CISA KEV.
Unauthenticated remote access to the CRUD operation handler in itsourcecode Payroll System 1.0 allows any network-accessible attacker to create, read, update, or delete payroll records without credentials. The root cause is CWE-306 - the ajax.php endpoint processes the 'action' parameter and executes database operations without verifying caller identity. A public proof-of-concept exploit is available on GitHub, making exploitation trivially accessible to low-skill attackers against any internet-exposed deployment.
SQL injection in itsourcecode Sales and Inventory System 1.0 exposes the /pages/cust_del.php endpoint to database manipulation via an unsanitized ID parameter. Authenticated remote attackers holding low-privilege accounts can craft malicious SQL to read, modify, or delete customer and inventory records. A publicly available proof-of-concept exploit exists on GitHub, though the vulnerability is not listed in CISA KEV and carries a CVSS 4.0 score of 2.1 reflecting limited impact.
Unauthenticated SQL injection in itsourcecode Online Clinic Management System 1.0 exposes the Admin Login endpoint (success/login.php) to remote exploitation via the Username parameter. Any network-reachable attacker can manipulate SQL queries without credentials or user interaction, enabling authentication bypass and arbitrary database read/write. A public exploit POC has been disclosed on GitHub (microwaveabi/vul issue #63), substantially lowering the barrier to exploitation; no CISA KEV listing has been confirmed at time of analysis.
SQL injection in itsourcecode Real Estate Management System 1.0 exposes the search.php endpoint to remote unauthenticated database manipulation via the search, delivery_type, search_price, and property_type parameters. A public proof-of-concept exploit has been published on GitHub (issue #5, microwaveabi/vul), making this trivially accessible to low-skill attackers. CVSS 4.0 rates this 6.9 with low-level impact across confidentiality, integrity, and availability on the vulnerable system; no active exploitation by CISA KEV has been confirmed at time of analysis.
Unrestricted file upload in itsourcecode Payroll System 1.0 exposes the application to potential remote code execution through the save_settings function in admin_class.php, where the img parameter accepts files without validating type or content. The CVSS 4.0 vector indicates network-accessible exploitation with no privileges required (PR:N), meaning an attacker can submit a crafted multipart request to upload a PHP webshell directly. A public proof-of-concept exploit exists per the GitHub reference and VulDB reporting; this is not confirmed in CISA KEV, but the low barrier to exploitation combined with POC availability elevates real-world risk beyond the 6.9 score implies.
SQL injection in itsourcecode Library Management System 1.0 allows remote authenticated attackers to manipulate database queries via the ID parameter in editbooks.php. The vulnerability is classified as CWE-89 (Improper Neutralization of Special Elements used in an SQL Command) and affects the book editing function, potentially exposing or corrupting the underlying database. A public proof-of-concept exploit exists, raising the operational risk for any unpatched deployment.
SQL injection in itsourcecode Sales and Inventory System 1.0 exposes the customer edit endpoint to database manipulation by authenticated network attackers who can control the ID parameter in /pages/cust_edit.php. The CVSS 4.0 base score of 2.1 reflects limited impact across confidentiality, integrity, and availability, though a public proof-of-concept exploit exists on GitHub. No active exploitation by CISA KEV has been confirmed; the low score and limited deployment footprint constrain real-world priority despite the public exploit.
SQL injection in itsourcecode Sales and Inventory System 1.0 exposes the login endpoint to unauthenticated remote exploitation via the unsanitized `User` parameter in `/pages/processlogin.php`. Attackers can manipulate backend SQL queries without any prior authentication, enabling authentication bypass or database data extraction. A public proof-of-concept has been disclosed on GitHub, and the unauthenticated network attack vector (CVSS 4.0 PR:N, AV:N with E:P) makes any internet-exposed deployment immediately actionable - no public exploit identified as confirmed actively exploited (not in CISA KEV) at time of analysis.
SQL injection in itsourcecode Hospital Management System Project in PHP 1.0 allows low-privilege authenticated remote attackers to manipulate database queries via the `delid` parameter in `/viewservicetype.php`. Publicly available exploit code exists, reported and disclosed through VulDB. Successful exploitation yields partial confidentiality, integrity, and availability impact against the application database, with no lateral scope change to external systems confirmed.
SQL injection in itsourcecode Hospital Management System 1.0 allows authenticated remote attackers to manipulate the `delid` parameter in `/viewappointmentapproved.php` to execute arbitrary SQL commands against the backend database. A publicly available proof-of-concept exploit exists on GitHub, elevating the practical risk beyond the moderate CVSS score. No active CISA KEV listing has been confirmed, but the low attack complexity and network-accessible vector make opportunistic exploitation feasible against any exposed instance with valid credentials.
SQL injection in itsourcecode Hospital Management System 1.0 exposes the /viewbilling.php endpoint to database manipulation via the unsanitized delid parameter, exploitable by any low-privileged authenticated user over the network. A publicly available proof-of-concept has been disclosed on GitHub, lowering the barrier to exploitation significantly. Impact is bounded to partial confidentiality, integrity, and availability loss against the application database, with no confirmed scope change to adjacent systems.
SQL injection in itsourcecode Hospital Management System 1.0 allows low-privileged remote attackers to manipulate the `delid` parameter in `/viewdepartment.php`, enabling arbitrary SQL query execution against the backend database. The CVSS 4.0 score of 5.3 reflects limited but confirmed confidentiality, integrity, and availability impact. A proof-of-concept exploit is publicly available on GitHub, materially lowering the barrier to exploitation; however, no active exploitation has been confirmed via CISA KEV.
SQL injection in itsourcecode Hospital Management System 1.0 exposes patient and operational database contents to remote authenticated attackers via the `delid` parameter in `/viewroom.php`. The vulnerability carries a CVSS 4.0 score of 5.3 with a network attack vector and low complexity, and a public proof-of-concept exploit has been disclosed on GitHub. No CISA KEV listing exists, but the combination of a live exploit and sensitive healthcare data context elevates practical urgency beyond what the moderate score alone suggests.
SQL injection in itsourcecode Hospital Management System 1.0 exposes the /viewprescriptionrecord.php endpoint to authenticated remote attackers who can manipulate the `delid` parameter to execute arbitrary SQL commands against the underlying database. Publicly available exploit code exists on GitHub, confirmed by the CVSS 4.0 E:P modifier, though no CISA KEV listing indicates active widespread exploitation at time of analysis. Given the healthcare context, the combination of public exploit availability and sensitive patient data makes this a higher-priority remediation than the low CVSS 4.0 score of 2.1 alone suggests.
SQL injection in itsourcecode Hospital Management System 1.0 allows authenticated remote attackers to manipulate database queries via the `delid` parameter in /viewpaymentreport.php. A publicly available proof-of-concept exploit exists on GitHub, lowering the barrier to exploitation for any reachable instance. The CVSS 4.0 vector confirms low-privilege authentication is required (PR:L), and impact is rated partial across confidentiality, integrity, and availability - though SQL injection primitives can often be escalated beyond initial scoring to achieve broader data extraction.
SQL injection in itsourcecode Hospital Management System 1.0 exposes patient management functionality to low-privileged authenticated attackers who can manipulate the `delid` parameter in /viewpatient.php to alter or extract database records. Successful exploitation allows unauthorized read, modification, or deletion of patient data, carrying significant regulatory and privacy consequences in healthcare environments. A proof-of-concept exploit has been publicly disclosed via GitHub, materially lowering the bar for opportunistic attacks against unpatched instances; the vulnerability is not currently listed in the CISA KEV catalog.
SQL injection in itsourcecode Hospital Management System 1.0 exposes the `/vieworder.php` endpoint to database manipulation via the unvalidated `delid` parameter, exploitable by authenticated remote attackers. A publicly available exploit has been disclosed on GitHub, raising the realistic likelihood of opportunistic exploitation against unpatched deployments. No CISA KEV listing is present, but the healthcare-sector context and public POC make this a meaningful remediation priority for any operator running this software.
SQL injection in itsourcecode Hospital Management System 1.0 exposes the `/viewmedicine.php` endpoint to database manipulation via the unsanitized `delid` parameter, allowing remote low-privileged attackers to read, alter, or delete hospital database contents including patient and medication records. A public proof-of-concept exploit is confirmed available on GitHub, lowering the bar for exploitation significantly. No vendor-released patch exists, making manual code remediation or decommissioning the only available mitigations.
SQL injection in itsourcecode Hospital Management System 1.0 allows authenticated remote attackers to execute arbitrary SQL queries via the delid parameter in viewdoctortimings.php. A low-privileged user account is required to exploit the flaw, after which an attacker can extract, modify, or potentially delete sensitive data from the underlying database - including patient records and physician scheduling data. A public proof-of-concept exploit has been published on GitHub, materially lowering the barrier for opportunistic exploitation.
SQL injection in itsourcecode Hospital Management System 1.0 exposes authenticated attackers to database manipulation via the `delid` parameter in `/viewdoctorconsultancycharge.php`. The vulnerability is PHP-based, requires only low-privilege authentication, and carries a public proof-of-concept exploit documented on GitHub. No active exploitation has been confirmed via CISA KEV, and the CVSS 4.0 score of 2.1 reflects constrained impact, though the sensitivity of healthcare data elevates organizational risk beyond the raw score.
SQL injection in itsourcecode Hospital Management System 1.0 exposes the `/viewdoctor.php` endpoint to database manipulation via the unsanitized `delid` parameter, allowing authenticated remote attackers to read, modify, or potentially delete records including patient and physician data. No active exploitation is confirmed in the CISA KEV catalog, but a public proof-of-concept exploit exists on GitHub, materially lowering the skill threshold for attacks. The CVSS 4.0 score of 5.3 with PR:L reflects a constrained but realistic threat to healthcare deployments with lax access controls.
SQL injection in itsourcecode Hospital Management System 1.0 allows authenticated remote attackers to manipulate database queries via the `editid` parameter in /servicetype.php. The vulnerability is a classic CWE-89 unsanitized input passed directly to a SQL query, enabling read and write access to the underlying database. A public proof-of-concept exploit exists (GitHub issue linked in references), raising the practical risk above the low CVSS 4.0 base score of 2.1 - though exploitation is not confirmed in CISA KEV and real-world deployment of this product is limited.
SQL injection in itsourcecode Hospital Management System 1.0 exposes the `/prescription.php` endpoint to database manipulation via the unsanitized `editid` parameter, exploitable by remote authenticated users. A public proof-of-concept exploit is available on GitHub, lowering the skill barrier for exploitation. No CISA KEV listing is present; the CVSS 4.0 score of 2.1 reflects low impact across all dimensions, likely constrained by the database user's privileges or the limited data scope accessible through this endpoint.
SQL injection in itsourcecode Hospital Management System 1.0 allows remote authenticated attackers to manipulate database queries via the `editid` parameter in `/prescriptionorder.php`. The CVSS 4.0 vector (PR:L) confirms low-privilege authenticated access is required, limiting opportunistic exploitation but not targeted abuse by authorized users or compromised accounts. A publicly available proof-of-concept exploit exists on GitHub, lowering the barrier for exploitation. No patch has been identified; no public exploit identified at time of analysis in CISA KEV.
SQL injection in itsourcecode Hospital Management System 1.0 exposes the `/prescriptionorderreport.php` endpoint to database manipulation via the unsanitized `delid` parameter, exploitable by remote authenticated attackers. A publicly available proof-of-concept (GitHub ltranquility/submit_vuln issue #10) confirms exploitability; the CVSS 4.0 E:P metric corroborates this. No CISA KEV listing exists, and real-world impact is bounded by the low-privilege authentication prerequisite and the niche deployment footprint of this educational PHP codebase.
Cross-site scripting in itsourcecode Courier Management System 1.0 allows remote, unauthenticated attackers to inject arbitrary client-side scripts via the `page` parameter of /index.php, requiring only that a victim user follow a crafted link. A publicly available proof-of-concept exploit exists, lowering the bar for abuse. No patch has been identified at time of analysis; no CISA KEV listing, but the public PoC and low attack complexity make this actionable for defenders protecting user sessions.
SQL injection in itsourcecode Hospital Management System 1.0 exposes authenticated users' ability to manipulate backend database queries via the `delid` parameter in `/prescriptionrecord.php`. Any instance accessible over the network is at risk of unauthorized data extraction or record manipulation - a significant concern given the sensitive patient and prescription data typically stored in such systems. Public exploit code is available on GitHub, and no vendor-released patch has been identified at time of analysis; exploitation is not confirmed in CISA KEV but the low attack complexity and public POC reduce the barrier to abuse.
SQL injection in itsourcecode Hospital Management System 1.0 allows authenticated remote attackers to manipulate database queries via the `delid` parameter of `/prescriptionorderdetail.php`. An authenticated low-privilege user can extract, alter, or delete sensitive patient and prescription records stored in the backend database. A public exploit proof-of-concept is available on GitHub (E:P per CVSS 4.0), lowering the barrier to exploitation; however, no CISA KEV listing has been identified, and the overall impact is bounded to low-level confidentiality, integrity, and availability effects.
SQL injection in itsourcecode Electronic Judging System 1.0 exposes the admin panel endpoint /intrams/admin/add_judges.php to database manipulation via the unsanitized `fname` parameter. Authenticated remote attackers can craft malicious input to read, alter, or potentially enumerate backend database contents. A publicly available proof-of-concept exploit exists on GitHub, though the vulnerability is not listed in CISA KEV and carries a CVSS 4.0 base score of 2.1 (Low), reflecting the authenticated access prerequisite and limited-scope CIA impact.
SQL injection in itsourcecode Hospital Management System 1.0 exposes patient prescription data to remote authenticated attackers via the `delid` parameter in `/patviewprescription.php`. Low-privilege access is sufficient to exploit this CWE-89 flaw, enabling database read, write, and partial disruption. No public KEV listing exists, but a proof-of-concept exploit is publicly available on GitHub, materially lowering the barrier to exploitation beyond what the CVSS 4.0 score of 5.3 alone implies.
SQL injection in itsourcecode Hospital Management System 1.0 exposes the `/paymentdischarge.php` endpoint to database manipulation via the unsanitized `patientid` parameter. Low-privileged authenticated attackers can exploit this remotely with no user interaction required, achieving limited read, write, and availability impact against the underlying database. No public KEV listing, but a proof-of-concept exploit is publicly disclosed on GitHub, meaningfully lowering the bar for opportunistic exploitation in any internet-exposed deployment.
SQL injection in itsourcecode Hospital Management System 1.0 exposes the /payment.php endpoint to database manipulation via an unsanitized `patientid` parameter, exploitable by any authenticated low-privilege user over the network. The CVSS 4.0 vector (PR:L, AV:N) confirms remote exploitation is feasible with only a basic account, and partial confidentiality, integrity, and availability impact is expected against the underlying database. Publicly available exploit code exists on GitHub, materially lowering the skill threshold for exploitation despite the moderate 5.3 CVSS score.
SQL injection in itsourcecode Hospital Management System 1.0 allows remote attackers with low-level privileges to manipulate the `loginid` parameter in `/patientlogin.php`, enabling unauthorized database read, modification, or deletion operations. The vulnerability scores 5.3 on CVSS 4.0 and is compounded by a publicly available proof-of-concept exploit published on GitHub, materially lowering the barrier to opportunistic attack. No CISA KEV listing has been identified, but the public POC and low attack complexity make any internet-exposed deployment an actionable target.
SQL injection in itsourcecode Hospital Management System 1.0 allows authenticated remote attackers to manipulate the `editid` parameter in `/patientorder.php`, potentially exposing or modifying patient order records and underlying database contents. The CVSS 4.0 vector (PR:L, E:P) confirms low-privilege authentication is required and that a public exploit has been disclosed via GitHub. While the base impact metrics are rated Low across confidentiality, integrity, and availability, the sensitivity of healthcare data in scope and the trivially available proof-of-concept raise practical risk above what the numeric score alone suggests.
SQL injection in itsourcecode Online Hotel Management System 1.0 exposes the admin login endpoint to remote unauthenticated exploitation via an unsanitized `email` parameter in `/admin/login.php`. A public proof-of-concept is available on GitHub (reflected in the CVSS 4.0 E:P metric), meaning exploitation requires minimal technical skill and is accessible to opportunistic attackers. No CISA KEV listing has been identified, but the zero-authentication barrier combined with available exploit code makes this a practical risk for any internet-exposed deployment.
SQL injection in itsourcecode Hospital Management System 1.0 exposes patient and appointment data to remote attackers holding low-privilege credentials via the `patiente` parameter in `/patientappointment.php`. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N) confirms network-reachable exploitation with no attack complexity, and the E:P modifier reflects a publicly disclosed proof-of-concept on GitHub. While not yet listed in CISA KEV, the combination of a live PoC, a healthcare data context, and trivial exploitation conditions makes this a credible risk for any organization running this application.
SQL injection in itsourcecode Hospital Management System 1.0 exposes patient records to partial disclosure and modification via the `editid` parameter in `/patient.php`. The CVSS 4.0 vector (PR:L) confirms exploitation requires a low-privilege authenticated session, limiting the immediate attack surface to users who can log in. A public proof-of-concept exploit exists (E:P), elevating practical risk above the base score of 5.3, though no CISA KEV listing confirms active exploitation at time of analysis.
SQL injection in itsourcecode Hospital Management System 1.0 allows low-privileged authenticated remote attackers to manipulate database queries via the `editid` parameter in `/medicine.php`. The attack achieves partial confidentiality, integrity, and availability impact against the underlying database. A public proof-of-concept exploit has been published (tracked via GitHub issue), lowering the barrier for exploitation; however, no active exploitation has been confirmed by CISA KEV at time of analysis.
SQL injection in itsourcecode Hospital Management System 1.0 exposes authenticated patient users to database-level attacks via the `/patientchangepassword.php` endpoint. The `newpassword` parameter is passed unsanitized into SQL queries, allowing an authenticated attacker to manipulate backend database operations - potentially reading, modifying, or deleting patient records. A public proof-of-concept exploit exists (GitHub issue linked from VulDB report), though no active exploitation has been confirmed by CISA KEV. The CVSS 4.0 score of 2.1 reflects the limited real-world severity due to the authentication prerequisite and constrained impact scope.
SQL injection in itsourcecode Hospital Management System 1.0 exposes the `/patientdetail.php` endpoint to database manipulation via the unsanitized `editid` parameter, reachable by any low-privileged authenticated user over the network. A public proof-of-concept exploit is available (referenced via GitHub issue), lowering the skill barrier for exploitation against any deployed instance. The CVSS 4.0 score of 2.1 reflects low per-impact ratings across confidentiality, integrity, and availability, but SQL injection vulnerabilities routinely exceed their scored impact bounds when database accounts carry excess privileges - no public exploitation has been confirmed in CISA KEV.
SQL injection in itsourcecode Hospital Management System 1.0 exposes the billing endpoint /insertbillingrecord.php to database manipulation by low-privileged remote attackers via the unsanitized patientid parameter. A public exploit has been disclosed on GitHub, lowering the barrier to exploitation significantly despite a low CVSS 4.0 base score of 2.1. No CISA KEV listing exists, but the combination of a publicly available proof-of-concept and access to potentially sensitive patient health and billing records elevates real-world concern beyond what the numeric score alone conveys.
SQL injection in itsourcecode Baptism Information Management System 1.0 exposes database contents to remote unauthenticated attackers via the ID parameter in /editBaptism.php. A publicly available proof-of-concept exploit exists on GitHub, enabling data exfiltration or modification without any credentials or user interaction. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N/E:P) confirms low-complexity remote exploitation with no special conditions required, and no vendor-released patch has been identified.
SQL injection in itsourcecode Baptism Information Management System 1.0 exposes the `/delbaptism.php` endpoint to remote database manipulation via an unsanitized `ID` parameter. The CVSS 4.0 vector (AV:N/AC:L/PR:N/UI:N) confirms this requires no authentication or user interaction against any network-accessible instance. A public proof-of-concept exploit exists on GitHub, making this immediately weaponizable against any exposed deployment, though the application is not listed in CISA KEV and its niche footprint substantially limits aggregate exposure.
SQL injection in itsourcecode Hospital Management System 1.0 exposes the `/doctortimings.php` endpoint to database manipulation via the unsanitized `editid` parameter, allowing a remote low-privilege authenticated attacker to read, modify, or partially disrupt backend database contents. The CVSS 4.0 vector (PR:L) confirms that some form of application authentication is required, limiting opportunistic mass exploitation, but a publicly available proof-of-concept exploit on GitHub materially lowers the barrier for targeted attacks. No patch has been released; the vulnerability is not listed in the CISA KEV catalog, but the sensitivity of healthcare data in scope makes it a meaningful risk for any production deployment.
SQL injection in itsourcecode Hospital Management System 1.0 exposes the `/doctorprofile.php` endpoint to remote exploitation via the `doctorname` parameter, allowing an authenticated attacker to execute arbitrary SQL commands against the backend database. Affected systems risk unauthorized access to, modification of, or partial disruption of sensitive medical and staff records stored within the application. A public proof-of-concept exploit has been disclosed on GitHub (CVSS 4.0 E:P), significantly lowering the technical barrier for exploitation despite the moderate base score; no CISA KEV listing is present at time of analysis.
SQL injection in itsourcecode Hospital Management System 1.0 exposes the backend database to authenticated remote attackers through the `newpassword` parameter of `/doctorchangepassword.php`. An attacker holding low-privilege credentials - such as a doctor account - can craft malicious SQL payloads to read, modify, or potentially delete database records. A public exploit exists per the CVSS 4.0 E:P modifier and a referenced GitHub issue; no active exploitation has been confirmed by CISA KEV.
SQL injection in itsourcecode Hospital Management System 1.0 exposes the `/departmentDoctor.php` endpoint to database manipulation via the unsanitized `deptid` parameter, allowing a remote low-privileged attacker to read, modify, or corrupt backend database records. The CVSS 4.0 vector (PR:L) confirms that a valid application account is required, limiting opportunistic exploitation. A public proof-of-concept exploit is available on GitHub (linked from VulDB), and no vendor patch has been identified at time of analysis, making compensating controls the only available remediation path.
SQL injection in itsourcecode Hospital Management System 1.0 exposes the /department.php endpoint to database manipulation via the unsanitized `editid` parameter, allowing a remote low-privileged authenticated attacker to read, modify, or delete hospital database contents. The CVSS 4.0 vector (PR:L) confirms a valid user account is required, constraining but not eliminating risk for internet-exposed instances. A public exploit has been released on GitHub, materially increasing the likelihood of opportunistic abuse against deployed instances.
SQL injection in itsourcecode Hospital Management System 1.0 exposes the Appointment Handler endpoint `/appointmentdetail.php` to remote database manipulation via the unsanitized `editid` parameter. The CVSS 4.0 vector (PR:L, E:P) confirms low-privilege authentication is required and a public proof-of-concept exploit is available on GitHub, materially lowering the bar for exploitation. While not listed in CISA KEV, the combination of network reachability, trivial exploitation complexity, and live PoC code makes this a concrete risk for any organization running this codebase in production.
SQL injection in itsourcecode Hospital Management System 1.0 exposes the `/appointmentapproval.php` Appointment Handler endpoint to database manipulation via the `editid` parameter, allowing low-privileged remote attackers to read, modify, or delete backend data. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N) confirms network-exploitability with minimal attack complexity once credentials are obtained, and a public proof-of-concept has been disclosed on GitHub, substantially lowering the attacker skill threshold. No active exploitation is confirmed by CISA KEV, but the medical context of the affected system - which likely stores sensitive patient and appointment records - amplifies the potential impact of even a limited SQL injection.
SQL injection in itsourcecode Hospital Management System 1.0 exposes the appointment management endpoint to remote database manipulation via the unsanitized `editid` parameter in `/appointment.php`. Authenticated low-privileged users can craft malicious SQL payloads to read, modify, or corrupt appointment and patient records in the underlying database. A publicly available proof-of-concept exploit exists (GitHub issue linked in references); no CISA KEV listing at time of analysis.
SQL injection in itsourcecode Hospital Management System 1.0 exposes the `/ajaxmedicine.php` endpoint to database manipulation via the unsanitized `medicineid` parameter, exploitable by any low-privilege authenticated user over the network. A public proof-of-concept has been published on GitHub, materially lowering the barrier to exploitation. No active exploitation has been confirmed by CISA KEV, but the combination of public exploit code, a medical data context, and low attack complexity makes this a credible risk for any organization running this software.
SQL injection in itsourcecode Hospital Management System 1.0 exposes authenticated administrators to database manipulation via the `loginid` parameter in `/adminprofile.php`. The CVSS 4.0 vector (PR:H) confirms exploitation is constrained to authenticated high-privilege sessions, limiting mass exploitation risk despite network accessibility. A public proof-of-concept exploit has been disclosed on GitHub, lowering the technical barrier for targeted abuse by insiders or credential-compromised actors.
SQL injection in itsourcecode Hospital Management System 1.0 exposes patient database records to authenticated remote attackers via the unsanitized `admissiontme` parameter in `/addpatient.php`. A publicly available proof-of-concept (published on GitHub) lowers the exploitation barrier, though the CVSS 4.0 score of 2.1 reflects constrained impact - limited to partial data read/write with no scope change to subsequent systems. No active exploitation has been confirmed (not in CISA KEV), but the healthcare context amplifies regulatory significance even for low-severity data exposure.
SQL injection in itsourcecode Hospital Management System 1.0 allows remote low-privileged attackers to manipulate backend database queries via the 'Date' parameter in /adminaccount.php. The vulnerability is PHP-based (CWE-89) and publicly exploitable code exists via a GitHub submission linked through VulDB. Despite remote reachability, the CVSS 4.0 score of 2.1 reflects constrained real-world impact: low privileges are required, and the scope is fully contained with only low-level confidentiality, integrity, and availability consequences. No public patch has been identified at time of analysis.
Cross-site scripting in itsourcecode Hospital Management System 1.0 allows remote unauthenticated attackers to inject arbitrary JavaScript via the unsanitized `patientid` parameter in `/billing.php`, executing in the context of a victim user's browser session upon interaction with a crafted URL. A publicly available proof-of-concept exploit exists, referenced in GitHub issue #13 of the ltranquility/vuln_submit repository, lowering the barrier for opportunistic exploitation. This CVE is not listed in the CISA KEV catalog; the CVSS 4.0 score of 2.1 reflects limited impact scope - low integrity effect only, no confidentiality or availability loss - constrained further by the passive user interaction requirement.
SQL injection in itsourcecode Fees Management System 1.0 exposes the `/receipt.php` endpoint to database manipulation by authenticated remote attackers via the `ef_id` parameter. The CVSS temporal metric E:P confirms a publicly available exploit, disclosed via a GitHub issue, meaning exploitation is accessible to low-skilled attackers. No CISA KEV listing is present, but the combination of public POC, network-reachable attack vector, and low attack complexity makes this a credible threat for any internet-facing deployment of this PHP application.
Reflected cross-site scripting in itsourcecode Fees Management System 1.0 allows remote unauthenticated attackers to inject arbitrary JavaScript into a victim's browser session by manipulating the 'page' parameter in /navbar.php. The attack requires user interaction - a victim must follow a crafted URL - limiting mass exploitation, but publicly available exploit code (referenced via a GitHub issue) lowers the barrier for targeted phishing campaigns. No CISA KEV listing; EPSS data was not provided, though the combination of no authentication requirement and public POC warrants prompt attention for exposed deployments.
SQL injection in itsourcecode Fees Management System 1.0 allows authenticated remote attackers with low privileges to manipulate database queries via the `ID` parameter in `/manage_user.php`. The CVSS vector (AV:N/AC:L/PR:L/UI:N) confirms network-accessible exploitation requiring only a low-privilege account, with confidentiality, integrity, and availability all partially impacted. A public proof-of-concept exploit is available (E:P in CVSS temporal metrics, corroborated by a GitHub issue), though no active exploitation has been confirmed via CISA KEV. No vendor-released patch has been identified at time of analysis.
SQL injection in itsourcecode Sales and Inventory System 1.0 allows remote authenticated attackers with low-privilege accounts to manipulate the ID argument passed to mysqli_query() in /pages/us_searchfrm.php, enabling database enumeration, data exfiltration, and potential data modification. A public exploit has been published on GitHub, corroborated by VulDB reporting. The CVSS 4.0 vector (PR:L, E:P) confirms authentication is required but that exploit code is in circulation, lowering the bar for opportunistic abuse.
SQL injection in itsourcecode Sales and Inventory System 1.0 allows authenticated remote attackers to manipulate database queries through the `ID` parameter of `/pages/cust_edit1.php`. Exploitation requires low-privilege authentication and can result in unauthorized data read, modification, and limited availability impact against the underlying database. A public proof-of-concept exploit has been disclosed via GitHub, lowering the bar for opportunistic exploitation of any deployed instance.
SQL injection in itsourcecode Sales and Inventory System 1.0 allows authenticated remote attackers to manipulate database queries by injecting arbitrary SQL via the `ID` parameter in `/pages/pro_searchfrm.php`. The CVSS 4.0 vector (PR:L) confirms that low-privilege authenticated access is required, limiting the exposure compared to fully unauthenticated SQLi. A publicly available proof-of-concept exists on GitHub (referenced as an issue in the yunfan668/cve repository), though no active exploitation has been confirmed by CISA KEV. The affected product is a free PHP educational source-code project distributed by itsourcecode.com, constraining real-world impact to deployments of this niche academic software.
SQL injection in itsourcecode Sales and Inventory System 1.0 allows authenticated remote attackers to manipulate the unsanitized `ID` parameter in `/pages/us_edit1.php`, enabling unauthorized database reads, data modification, and potential privilege escalation within the application. A public proof-of-concept exploit has been disclosed on GitHub, confirming the issue is both reproducible and accessible to low-skilled attackers. No vendor patch has been identified; the product is a PHP-based educational/demo application with limited enterprise deployment footprint.
SQL injection in itsourcecode Sales and Inventory System 1.0 exposes the /pages/settings_edit.php endpoint to database manipulation via the unsanitized ID parameter. Authenticated attackers with low-privilege access can read, modify, or partially disrupt database contents. A public proof-of-concept has been disclosed on GitHub, materially lowering the exploitation skill threshold for any system running this application.
SQL injection in itsourcecode School Management System 1.0 allows unauthenticated remote attackers to manipulate the email parameter in User_Login.php, injecting arbitrary SQL into backend database queries at the pre-authentication login endpoint. With a public exploit available on GitHub, exploitation requires minimal skill and no credentials. The CVSS 4.0 vector confirms network-accessible, no-privilege exploitation with partial confidentiality, integrity, and availability impact against the underlying database.
SQL injection in itsourcecode Information System Society Membership System 1.0 exposes the database to read and write operations by authenticated remote attackers who manipulate the `student_id` parameter in `/society/check_student.php`. A public proof-of-concept exploit has been disclosed on GitHub. The CVSS 4.0 base score of 5.3 with low-impact ratings across C/I/A appears conservative for a CWE-89 flaw, which typically permits full database extraction and modification via UNION or stacked-query techniques.
SQL injection in itsourcecode Sales and Inventory System 1.0 allows authenticated remote attackers to manipulate database queries via the Username parameter in /pages/us_transac.php. The CVSS 4.0 vector (PR:L) confirms a login is required, limiting the unauthenticated attack surface, but the impact spans confidentiality, integrity, and availability of the underlying database. A public proof-of-concept exploit has been disclosed via a GitHub issue, raising the likelihood of opportunistic exploitation against any exposed instance.
SQL injection in itsourcecode Sales and Inventory System 1.0 exposes the `/pages/sup_transac.php` endpoint to database manipulation via the unsanitized `companyname` parameter. Authenticated remote attackers can inject arbitrary SQL, achieving partial read and write access to the underlying database. A public proof-of-concept exploit exists per GitHub issue reference; no CISA KEV listing has been observed.
SQL injection in itsourcecode Sales and Inventory System 1.0 allows authenticated remote attackers to manipulate database queries via the Name parameter in /pages/pro_transac.php?action=add. The vulnerability stems from unsanitized user input passed directly to SQL queries in a PHP backend, enabling data extraction, modification, or denial of service against the underlying database. A public exploit has been disclosed on GitHub, lowering the bar for exploitation.
SQL injection in itsourcecode Sales and Inventory System 1.0 allows low-privileged remote attackers to manipulate database queries via the firstname parameter in the /pages/cust_transac.php?action=add endpoint, potentially enabling unauthorized data exfiltration, modification, or deletion. The CVSS 4.0 vector confirms authentication is required (PR:L), restricting exploitation to users with at least low-privilege credentials. A public exploit is available on GitHub, lowering the practical barrier for authenticated attackers, though no confirmed active exploitation (CISA KEV) has been identified.
SQL injection in itsourcecode Sales and Inventory System 1.0 allows authenticated remote attackers to manipulate the ID parameter in /pages/us_del.php?type=user to execute arbitrary SQL statements against the backend database. The CVSS 4.0 vector (PR:L) confirms that low-privilege authenticated access is required, limiting the attack surface to logged-in users. A public proof-of-concept exploit has been disclosed on GitHub, elevating practical risk despite the moderate base score of 5.3.
SQL injection in itsourcecode Sales and Inventory System 1.0 allows low-privileged remote attackers to manipulate the `ID` parameter in `/pages/trans_view.php`, enabling arbitrary database read and write operations. The vulnerability is CWE-89 (Improper Neutralization of Special Elements in SQL Commands), affecting version 1.0 with no version range ambiguity per the CPE wildcard. A public exploit has been released and is available for use in attacks, raising the practical risk above the moderate CVSS 4.0 score of 5.3 suggests.
SQL injection in itsourcecode Sales and Inventory System 1.0 allows a remote authenticated low-privileged user to manipulate the ID parameter in /pages/pro_del.php to read, modify, or partially disrupt the underlying database. The vulnerability is exploitable over the network with low complexity and carries a publicly available proof-of-concept. No vendor patch has been identified; the software is a free educational PHP project distributed by itsourcecode.com, limiting real-world production exposure.
SQL injection in itsourcecode Sales and Inventory System 1.0 allows authenticated remote attackers to manipulate the unsanitized `ID` parameter in `/pages/inv_del.php`, enabling database enumeration, data extraction, and record modification. The application is an educational PHP project from itsourcecode.com with minimal production exposure, and a public proof-of-concept exploit has been published on GitHub. No vendor-released patch has been identified at time of analysis.
Unrestricted file upload in itsourcecode Online Medicine Delivery System 1.0 allows unauthenticated remote attackers to upload arbitrary files - including PHP webshells - through the image parameter of the Order Management Controller endpoint. The vulnerable function doInsert in /rider/orders/controller.php?action=add performs no validation of uploaded file types, enabling direct server-side code execution. A public exploit demonstrating RCE via this file upload path has been released on GitHub and is actively circulating.
Reflected cross-site scripting in itsourcecode Online Medicine Delivery System 1.0 allows an authenticated remote attacker to inject and execute arbitrary JavaScript in a victim's browser by manipulating the `location` parameter of the `/index.php?q=orderdetails` endpoint. The attacker must induce a logged-in user to follow a crafted URL, at which point the unsanitized parameter value is reflected directly into the page response. A public proof-of-concept writeup on GitHub confirms exploitability; no KEV designation applies.
SQL injection in itsourcecode Online Medicine Delivery System 1.0 allows remote authenticated customers to manipulate the backend database via the `proid` parameter in the `addwishlist` function at `/customer/controller.php?action=addwish`. Any valid customer-level session can submit a crafted POST request to extract or modify database contents, including potentially customer PII, credentials, and order records. No KEV listing exists; CVSS 4.0 scores this 5.3 (Medium), reflecting the authentication barrier (PR:L) and limited per-component impact ratings.
SQL injection in itsourcecode Online Medicine Delivery System 1.0 allows remote attackers to manipulate the ID argument passed to Order::pupdate in the rider order-confirmation endpoint, enabling arbitrary database queries. The vulnerable parameter is processed without sanitization at /rider/orders/controller.php?action=edit&actions=confirm. A public proof-of-concept has been disclosed on GitHub; no KEV listing and no vendor patch are available at time of analysis.
SQL injection in itsourcecode Online Medicine Delivery System 1.0 exposes unauthenticated attackers to direct database manipulation via the Password Recovery Interface. The `Customer::find_phone` function in `/passwordrecover.php` accepts the `phonenumber` parameter without sanitization, allowing arbitrary SQL to be injected into backend queries. A public proof-of-concept exploit has been disclosed on GitHub; the vulnerability is not currently listed in CISA KEV, but the low complexity and zero-authentication requirement make opportunistic exploitation trivial.
SQL injection in itsourcecode Online Medicine Delivery System 1.0 allows unauthenticated remote attackers to manipulate backend database queries via the Category parameter in the Product Category Filter Interface at /index.php?q=product. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) confirms exploitation requires no privileges or user interaction, and a public proof-of-concept is available on GitHub (E:P), materially lowering the exploitation barrier. Impact is rated Low across confidentiality, integrity, and availability, suggesting constrained database access rather than full system compromise; no CISA KEV listing has been identified.
SQL injection in itsourcecode Online Medicine Delivery System 1.0 exposes the Product Search Interface to remote unauthenticated database manipulation via the Search argument handled by the `loadResultList` function at `/index.php?q=product`. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) confirms no authentication, no complexity, and no user interaction are required. Publicly available exploit code exists, documented on GitHub via VulDB submission, though this product has not been added to the CISA KEV catalog and no widespread exploitation has been confirmed.
SQL injection in itsourcecode Online Medicine Delivery System 1.0 exposes database contents to remote unauthenticated attackers through the `ID` parameter in the `loadResultList` function on the Product Detail Page. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) confirms exploitation requires no credentials, no special configuration, and no user interaction. A proof-of-concept exploit has been publicly disclosed on GitHub, materially lowering the bar for opportunistic attackers beyond what the moderate score alone implies.
SQL injection in itsourcecode Online Medicine Delivery System 1.0 allows unauthenticated remote attackers to manipulate the U_USERNAME parameter in the Customer::cusAuthentication function at /login.php, enabling authentication bypass and potential database extraction. A public proof-of-concept exploit is available on GitHub, confirmed by the CVSS 4.0 E:P (proof-of-concept) modifier and a linked exploit write-up. No patch has been identified; this is a small PHP application likely used in academic or learning environments with limited production exposure.
SQL injection in itsourcecode Online Medicine Delivery System 1.0 allows unauthenticated remote attackers to manipulate database queries through the emp_email parameter on the rider login endpoint. The Employee::employeeAuthentication function at /rider/login.php incorporates unsanitized email input directly into SQL queries, enabling authentication bypass and potential data extraction. A public proof-of-concept exploit has been released with no vendor patch available, making any deployed instance immediately exploitable by low-skill attackers.
SQL injection in itsourcecode Sales and Inventory System 1.0 allows remote authenticated attackers to manipulate database queries via the unsanitized `ID` parameter in `/pages/inv_edit.php`. Exploitation requires a valid application account (PR:L per CVSS 4.0 vector), and a public proof-of-concept is available on GitHub, lowering the exploitation bar for any user with credentials. The vulnerability is not currently listed in CISA KEV, and the CVSS 4.0 score of 5.3 (Medium) reflects the authentication prerequisite limiting broader impact.
SQL injection in itsourcecode Sales and Inventory System 1.0 exposes the /pages/sup_searchfrm.php endpoint to database manipulation via the unsanitized ID parameter. Low-privileged authenticated attackers can remotely exploit this classic CWE-89 flaw to read, modify, or potentially delete backend database records. A public proof-of-concept exploit has been disclosed via GitHub; no active exploitation or CISA KEV listing has been identified at time of analysis.
SQL injection in itsourcecode Sales and Inventory System 1.0 exposes the `/pages/cust_searchfrm.php` customer search endpoint to database manipulation via an unsanitized `ID` parameter. Authenticated remote attackers with low-privilege access can alter backend SQL queries to read, modify, or delete customer and inventory records. A public proof-of-concept exploit is available, lowering the bar for targeted attacks despite the absence of a CISA KEV listing.
SQL injection in itsourcecode Sales and Inventory System 1.0 allows authenticated remote attackers to manipulate database queries via the ID parameter in /pages/pro_edit.php. The vulnerability stems from unsanitized user input passed directly to SQL queries (CWE-89), enabling read and limited write access to the underlying database. A public proof-of-concept exploit has been disclosed on GitHub; no active exploitation by KEV standards is confirmed at this time.
SQL injection in itsourcecode Sales and Inventory System 1.0 exposes the `/pages/emp_searchfrm.php` endpoint to authenticated remote attackers who can manipulate database queries by injecting malicious SQL through the unsanitized `ID` parameter. Low-privileged users with valid credentials can read, modify, or corrupt application database contents. A public proof-of-concept exploit has been published via GitHub, making active exploitation a credible near-term risk for any internet-exposed instance.
SQL injection in itsourcecode Sales and Inventory System 1.0 allows low-privileged remote attackers to manipulate database queries via the unsanitized 'ID' parameter in /pages/emp_del.php. The CVSS 4.0 vector (PR:L, E:P) confirms exploitation requires a low-privileged authenticated session but no special configuration beyond basic access. A public proof-of-concept exploit has been released, raising the practical risk above what the moderate CVSS score alone suggests; however, this vulnerability is not currently listed in CISA KEV.
Unauthenticated remote access to the CRUD operation handler in itsourcecode Payroll System 1.0 allows any network-accessible attacker to create, read, update, or delete payroll records without credentials. The root cause is CWE-306 - the ajax.php endpoint processes the 'action' parameter and executes database operations without verifying caller identity. A public proof-of-concept exploit is available on GitHub, making exploitation trivially accessible to low-skill attackers against any internet-exposed deployment.
SQL injection in itsourcecode Sales and Inventory System 1.0 exposes the /pages/cust_del.php endpoint to database manipulation via an unsanitized ID parameter. Authenticated remote attackers holding low-privilege accounts can craft malicious SQL to read, modify, or delete customer and inventory records. A publicly available proof-of-concept exploit exists on GitHub, though the vulnerability is not listed in CISA KEV and carries a CVSS 4.0 score of 2.1 reflecting limited impact.
Unauthenticated SQL injection in itsourcecode Online Clinic Management System 1.0 exposes the Admin Login endpoint (success/login.php) to remote exploitation via the Username parameter. Any network-reachable attacker can manipulate SQL queries without credentials or user interaction, enabling authentication bypass and arbitrary database read/write. A public exploit POC has been disclosed on GitHub (microwaveabi/vul issue #63), substantially lowering the barrier to exploitation; no CISA KEV listing has been confirmed at time of analysis.
SQL injection in itsourcecode Real Estate Management System 1.0 exposes the search.php endpoint to remote unauthenticated database manipulation via the search, delivery_type, search_price, and property_type parameters. A public proof-of-concept exploit has been published on GitHub (issue #5, microwaveabi/vul), making this trivially accessible to low-skill attackers. CVSS 4.0 rates this 6.9 with low-level impact across confidentiality, integrity, and availability on the vulnerable system; no active exploitation by CISA KEV has been confirmed at time of analysis.
Unrestricted file upload in itsourcecode Payroll System 1.0 exposes the application to potential remote code execution through the save_settings function in admin_class.php, where the img parameter accepts files without validating type or content. The CVSS 4.0 vector indicates network-accessible exploitation with no privileges required (PR:N), meaning an attacker can submit a crafted multipart request to upload a PHP webshell directly. A public proof-of-concept exploit exists per the GitHub reference and VulDB reporting; this is not confirmed in CISA KEV, but the low barrier to exploitation combined with POC availability elevates real-world risk beyond the 6.9 score implies.
SQL injection in itsourcecode Library Management System 1.0 allows remote authenticated attackers to manipulate database queries via the ID parameter in editbooks.php. The vulnerability is classified as CWE-89 (Improper Neutralization of Special Elements used in an SQL Command) and affects the book editing function, potentially exposing or corrupting the underlying database. A public proof-of-concept exploit exists, raising the operational risk for any unpatched deployment.
SQL injection in itsourcecode Sales and Inventory System 1.0 exposes the customer edit endpoint to database manipulation by authenticated network attackers who can control the ID parameter in /pages/cust_edit.php. The CVSS 4.0 base score of 2.1 reflects limited impact across confidentiality, integrity, and availability, though a public proof-of-concept exploit exists on GitHub. No active exploitation by CISA KEV has been confirmed; the low score and limited deployment footprint constrain real-world priority despite the public exploit.
SQL injection in itsourcecode Sales and Inventory System 1.0 exposes the login endpoint to unauthenticated remote exploitation via the unsanitized `User` parameter in `/pages/processlogin.php`. Attackers can manipulate backend SQL queries without any prior authentication, enabling authentication bypass or database data extraction. A public proof-of-concept has been disclosed on GitHub, and the unauthenticated network attack vector (CVSS 4.0 PR:N, AV:N with E:P) makes any internet-exposed deployment immediately actionable - no public exploit identified as confirmed actively exploited (not in CISA KEV) at time of analysis.
SQL injection in itsourcecode Hospital Management System Project in PHP 1.0 allows low-privilege authenticated remote attackers to manipulate database queries via the `delid` parameter in `/viewservicetype.php`. Publicly available exploit code exists, reported and disclosed through VulDB. Successful exploitation yields partial confidentiality, integrity, and availability impact against the application database, with no lateral scope change to external systems confirmed.
SQL injection in itsourcecode Hospital Management System 1.0 allows authenticated remote attackers to manipulate the `delid` parameter in `/viewappointmentapproved.php` to execute arbitrary SQL commands against the backend database. A publicly available proof-of-concept exploit exists on GitHub, elevating the practical risk beyond the moderate CVSS score. No active CISA KEV listing has been confirmed, but the low attack complexity and network-accessible vector make opportunistic exploitation feasible against any exposed instance with valid credentials.
SQL injection in itsourcecode Hospital Management System 1.0 exposes the /viewbilling.php endpoint to database manipulation via the unsanitized delid parameter, exploitable by any low-privileged authenticated user over the network. A publicly available proof-of-concept has been disclosed on GitHub, lowering the barrier to exploitation significantly. Impact is bounded to partial confidentiality, integrity, and availability loss against the application database, with no confirmed scope change to adjacent systems.
SQL injection in itsourcecode Hospital Management System 1.0 allows low-privileged remote attackers to manipulate the `delid` parameter in `/viewdepartment.php`, enabling arbitrary SQL query execution against the backend database. The CVSS 4.0 score of 5.3 reflects limited but confirmed confidentiality, integrity, and availability impact. A proof-of-concept exploit is publicly available on GitHub, materially lowering the barrier to exploitation; however, no active exploitation has been confirmed via CISA KEV.
SQL injection in itsourcecode Hospital Management System 1.0 exposes patient and operational database contents to remote authenticated attackers via the `delid` parameter in `/viewroom.php`. The vulnerability carries a CVSS 4.0 score of 5.3 with a network attack vector and low complexity, and a public proof-of-concept exploit has been disclosed on GitHub. No CISA KEV listing exists, but the combination of a live exploit and sensitive healthcare data context elevates practical urgency beyond what the moderate score alone suggests.
SQL injection in itsourcecode Hospital Management System 1.0 exposes the /viewprescriptionrecord.php endpoint to authenticated remote attackers who can manipulate the `delid` parameter to execute arbitrary SQL commands against the underlying database. Publicly available exploit code exists on GitHub, confirmed by the CVSS 4.0 E:P modifier, though no CISA KEV listing indicates active widespread exploitation at time of analysis. Given the healthcare context, the combination of public exploit availability and sensitive patient data makes this a higher-priority remediation than the low CVSS 4.0 score of 2.1 alone suggests.
SQL injection in itsourcecode Hospital Management System 1.0 allows authenticated remote attackers to manipulate database queries via the `delid` parameter in /viewpaymentreport.php. A publicly available proof-of-concept exploit exists on GitHub, lowering the barrier to exploitation for any reachable instance. The CVSS 4.0 vector confirms low-privilege authentication is required (PR:L), and impact is rated partial across confidentiality, integrity, and availability - though SQL injection primitives can often be escalated beyond initial scoring to achieve broader data extraction.
SQL injection in itsourcecode Hospital Management System 1.0 exposes patient management functionality to low-privileged authenticated attackers who can manipulate the `delid` parameter in /viewpatient.php to alter or extract database records. Successful exploitation allows unauthorized read, modification, or deletion of patient data, carrying significant regulatory and privacy consequences in healthcare environments. A proof-of-concept exploit has been publicly disclosed via GitHub, materially lowering the bar for opportunistic attacks against unpatched instances; the vulnerability is not currently listed in the CISA KEV catalog.
SQL injection in itsourcecode Hospital Management System 1.0 exposes the `/vieworder.php` endpoint to database manipulation via the unvalidated `delid` parameter, exploitable by authenticated remote attackers. A publicly available exploit has been disclosed on GitHub, raising the realistic likelihood of opportunistic exploitation against unpatched deployments. No CISA KEV listing is present, but the healthcare-sector context and public POC make this a meaningful remediation priority for any operator running this software.
SQL injection in itsourcecode Hospital Management System 1.0 exposes the `/viewmedicine.php` endpoint to database manipulation via the unsanitized `delid` parameter, allowing remote low-privileged attackers to read, alter, or delete hospital database contents including patient and medication records. A public proof-of-concept exploit is confirmed available on GitHub, lowering the bar for exploitation significantly. No vendor-released patch exists, making manual code remediation or decommissioning the only available mitigations.
SQL injection in itsourcecode Hospital Management System 1.0 allows authenticated remote attackers to execute arbitrary SQL queries via the delid parameter in viewdoctortimings.php. A low-privileged user account is required to exploit the flaw, after which an attacker can extract, modify, or potentially delete sensitive data from the underlying database - including patient records and physician scheduling data. A public proof-of-concept exploit has been published on GitHub, materially lowering the barrier for opportunistic exploitation.
SQL injection in itsourcecode Hospital Management System 1.0 exposes authenticated attackers to database manipulation via the `delid` parameter in `/viewdoctorconsultancycharge.php`. The vulnerability is PHP-based, requires only low-privilege authentication, and carries a public proof-of-concept exploit documented on GitHub. No active exploitation has been confirmed via CISA KEV, and the CVSS 4.0 score of 2.1 reflects constrained impact, though the sensitivity of healthcare data elevates organizational risk beyond the raw score.
SQL injection in itsourcecode Hospital Management System 1.0 exposes the `/viewdoctor.php` endpoint to database manipulation via the unsanitized `delid` parameter, allowing authenticated remote attackers to read, modify, or potentially delete records including patient and physician data. No active exploitation is confirmed in the CISA KEV catalog, but a public proof-of-concept exploit exists on GitHub, materially lowering the skill threshold for attacks. The CVSS 4.0 score of 5.3 with PR:L reflects a constrained but realistic threat to healthcare deployments with lax access controls.
SQL injection in itsourcecode Hospital Management System 1.0 allows authenticated remote attackers to manipulate database queries via the `editid` parameter in /servicetype.php. The vulnerability is a classic CWE-89 unsanitized input passed directly to a SQL query, enabling read and write access to the underlying database. A public proof-of-concept exploit exists (GitHub issue linked in references), raising the practical risk above the low CVSS 4.0 base score of 2.1 - though exploitation is not confirmed in CISA KEV and real-world deployment of this product is limited.
SQL injection in itsourcecode Hospital Management System 1.0 exposes the `/prescription.php` endpoint to database manipulation via the unsanitized `editid` parameter, exploitable by remote authenticated users. A public proof-of-concept exploit is available on GitHub, lowering the skill barrier for exploitation. No CISA KEV listing is present; the CVSS 4.0 score of 2.1 reflects low impact across all dimensions, likely constrained by the database user's privileges or the limited data scope accessible through this endpoint.
SQL injection in itsourcecode Hospital Management System 1.0 allows remote authenticated attackers to manipulate database queries via the `editid` parameter in `/prescriptionorder.php`. The CVSS 4.0 vector (PR:L) confirms low-privilege authenticated access is required, limiting opportunistic exploitation but not targeted abuse by authorized users or compromised accounts. A publicly available proof-of-concept exploit exists on GitHub, lowering the barrier for exploitation. No patch has been identified; no public exploit identified at time of analysis in CISA KEV.
SQL injection in itsourcecode Hospital Management System 1.0 exposes the `/prescriptionorderreport.php` endpoint to database manipulation via the unsanitized `delid` parameter, exploitable by remote authenticated attackers. A publicly available proof-of-concept (GitHub ltranquility/submit_vuln issue #10) confirms exploitability; the CVSS 4.0 E:P metric corroborates this. No CISA KEV listing exists, and real-world impact is bounded by the low-privilege authentication prerequisite and the niche deployment footprint of this educational PHP codebase.
Cross-site scripting in itsourcecode Courier Management System 1.0 allows remote, unauthenticated attackers to inject arbitrary client-side scripts via the `page` parameter of /index.php, requiring only that a victim user follow a crafted link. A publicly available proof-of-concept exploit exists, lowering the bar for abuse. No patch has been identified at time of analysis; no CISA KEV listing, but the public PoC and low attack complexity make this actionable for defenders protecting user sessions.
SQL injection in itsourcecode Hospital Management System 1.0 exposes authenticated users' ability to manipulate backend database queries via the `delid` parameter in `/prescriptionrecord.php`. Any instance accessible over the network is at risk of unauthorized data extraction or record manipulation - a significant concern given the sensitive patient and prescription data typically stored in such systems. Public exploit code is available on GitHub, and no vendor-released patch has been identified at time of analysis; exploitation is not confirmed in CISA KEV but the low attack complexity and public POC reduce the barrier to abuse.
SQL injection in itsourcecode Hospital Management System 1.0 allows authenticated remote attackers to manipulate database queries via the `delid` parameter of `/prescriptionorderdetail.php`. An authenticated low-privilege user can extract, alter, or delete sensitive patient and prescription records stored in the backend database. A public exploit proof-of-concept is available on GitHub (E:P per CVSS 4.0), lowering the barrier to exploitation; however, no CISA KEV listing has been identified, and the overall impact is bounded to low-level confidentiality, integrity, and availability effects.
SQL injection in itsourcecode Electronic Judging System 1.0 exposes the admin panel endpoint /intrams/admin/add_judges.php to database manipulation via the unsanitized `fname` parameter. Authenticated remote attackers can craft malicious input to read, alter, or potentially enumerate backend database contents. A publicly available proof-of-concept exploit exists on GitHub, though the vulnerability is not listed in CISA KEV and carries a CVSS 4.0 base score of 2.1 (Low), reflecting the authenticated access prerequisite and limited-scope CIA impact.
SQL injection in itsourcecode Hospital Management System 1.0 exposes patient prescription data to remote authenticated attackers via the `delid` parameter in `/patviewprescription.php`. Low-privilege access is sufficient to exploit this CWE-89 flaw, enabling database read, write, and partial disruption. No public KEV listing exists, but a proof-of-concept exploit is publicly available on GitHub, materially lowering the barrier to exploitation beyond what the CVSS 4.0 score of 5.3 alone implies.
SQL injection in itsourcecode Hospital Management System 1.0 exposes the `/paymentdischarge.php` endpoint to database manipulation via the unsanitized `patientid` parameter. Low-privileged authenticated attackers can exploit this remotely with no user interaction required, achieving limited read, write, and availability impact against the underlying database. No public KEV listing, but a proof-of-concept exploit is publicly disclosed on GitHub, meaningfully lowering the bar for opportunistic exploitation in any internet-exposed deployment.
SQL injection in itsourcecode Hospital Management System 1.0 exposes the /payment.php endpoint to database manipulation via an unsanitized `patientid` parameter, exploitable by any authenticated low-privilege user over the network. The CVSS 4.0 vector (PR:L, AV:N) confirms remote exploitation is feasible with only a basic account, and partial confidentiality, integrity, and availability impact is expected against the underlying database. Publicly available exploit code exists on GitHub, materially lowering the skill threshold for exploitation despite the moderate 5.3 CVSS score.
SQL injection in itsourcecode Hospital Management System 1.0 allows remote attackers with low-level privileges to manipulate the `loginid` parameter in `/patientlogin.php`, enabling unauthorized database read, modification, or deletion operations. The vulnerability scores 5.3 on CVSS 4.0 and is compounded by a publicly available proof-of-concept exploit published on GitHub, materially lowering the barrier to opportunistic attack. No CISA KEV listing has been identified, but the public POC and low attack complexity make any internet-exposed deployment an actionable target.
SQL injection in itsourcecode Hospital Management System 1.0 allows authenticated remote attackers to manipulate the `editid` parameter in `/patientorder.php`, potentially exposing or modifying patient order records and underlying database contents. The CVSS 4.0 vector (PR:L, E:P) confirms low-privilege authentication is required and that a public exploit has been disclosed via GitHub. While the base impact metrics are rated Low across confidentiality, integrity, and availability, the sensitivity of healthcare data in scope and the trivially available proof-of-concept raise practical risk above what the numeric score alone suggests.
SQL injection in itsourcecode Online Hotel Management System 1.0 exposes the admin login endpoint to remote unauthenticated exploitation via an unsanitized `email` parameter in `/admin/login.php`. A public proof-of-concept is available on GitHub (reflected in the CVSS 4.0 E:P metric), meaning exploitation requires minimal technical skill and is accessible to opportunistic attackers. No CISA KEV listing has been identified, but the zero-authentication barrier combined with available exploit code makes this a practical risk for any internet-exposed deployment.
SQL injection in itsourcecode Hospital Management System 1.0 exposes patient and appointment data to remote attackers holding low-privilege credentials via the `patiente` parameter in `/patientappointment.php`. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N) confirms network-reachable exploitation with no attack complexity, and the E:P modifier reflects a publicly disclosed proof-of-concept on GitHub. While not yet listed in CISA KEV, the combination of a live PoC, a healthcare data context, and trivial exploitation conditions makes this a credible risk for any organization running this application.
SQL injection in itsourcecode Hospital Management System 1.0 exposes patient records to partial disclosure and modification via the `editid` parameter in `/patient.php`. The CVSS 4.0 vector (PR:L) confirms exploitation requires a low-privilege authenticated session, limiting the immediate attack surface to users who can log in. A public proof-of-concept exploit exists (E:P), elevating practical risk above the base score of 5.3, though no CISA KEV listing confirms active exploitation at time of analysis.
SQL injection in itsourcecode Hospital Management System 1.0 allows low-privileged authenticated remote attackers to manipulate database queries via the `editid` parameter in `/medicine.php`. The attack achieves partial confidentiality, integrity, and availability impact against the underlying database. A public proof-of-concept exploit has been published (tracked via GitHub issue), lowering the barrier for exploitation; however, no active exploitation has been confirmed by CISA KEV at time of analysis.
SQL injection in itsourcecode Hospital Management System 1.0 exposes authenticated patient users to database-level attacks via the `/patientchangepassword.php` endpoint. The `newpassword` parameter is passed unsanitized into SQL queries, allowing an authenticated attacker to manipulate backend database operations - potentially reading, modifying, or deleting patient records. A public proof-of-concept exploit exists (GitHub issue linked from VulDB report), though no active exploitation has been confirmed by CISA KEV. The CVSS 4.0 score of 2.1 reflects the limited real-world severity due to the authentication prerequisite and constrained impact scope.
SQL injection in itsourcecode Hospital Management System 1.0 exposes the `/patientdetail.php` endpoint to database manipulation via the unsanitized `editid` parameter, reachable by any low-privileged authenticated user over the network. A public proof-of-concept exploit is available (referenced via GitHub issue), lowering the skill barrier for exploitation against any deployed instance. The CVSS 4.0 score of 2.1 reflects low per-impact ratings across confidentiality, integrity, and availability, but SQL injection vulnerabilities routinely exceed their scored impact bounds when database accounts carry excess privileges - no public exploitation has been confirmed in CISA KEV.
SQL injection in itsourcecode Hospital Management System 1.0 exposes the billing endpoint /insertbillingrecord.php to database manipulation by low-privileged remote attackers via the unsanitized patientid parameter. A public exploit has been disclosed on GitHub, lowering the barrier to exploitation significantly despite a low CVSS 4.0 base score of 2.1. No CISA KEV listing exists, but the combination of a publicly available proof-of-concept and access to potentially sensitive patient health and billing records elevates real-world concern beyond what the numeric score alone conveys.
SQL injection in itsourcecode Baptism Information Management System 1.0 exposes database contents to remote unauthenticated attackers via the ID parameter in /editBaptism.php. A publicly available proof-of-concept exploit exists on GitHub, enabling data exfiltration or modification without any credentials or user interaction. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N/E:P) confirms low-complexity remote exploitation with no special conditions required, and no vendor-released patch has been identified.
SQL injection in itsourcecode Baptism Information Management System 1.0 exposes the `/delbaptism.php` endpoint to remote database manipulation via an unsanitized `ID` parameter. The CVSS 4.0 vector (AV:N/AC:L/PR:N/UI:N) confirms this requires no authentication or user interaction against any network-accessible instance. A public proof-of-concept exploit exists on GitHub, making this immediately weaponizable against any exposed deployment, though the application is not listed in CISA KEV and its niche footprint substantially limits aggregate exposure.
SQL injection in itsourcecode Hospital Management System 1.0 exposes the `/doctortimings.php` endpoint to database manipulation via the unsanitized `editid` parameter, allowing a remote low-privilege authenticated attacker to read, modify, or partially disrupt backend database contents. The CVSS 4.0 vector (PR:L) confirms that some form of application authentication is required, limiting opportunistic mass exploitation, but a publicly available proof-of-concept exploit on GitHub materially lowers the barrier for targeted attacks. No patch has been released; the vulnerability is not listed in the CISA KEV catalog, but the sensitivity of healthcare data in scope makes it a meaningful risk for any production deployment.
SQL injection in itsourcecode Hospital Management System 1.0 exposes the `/doctorprofile.php` endpoint to remote exploitation via the `doctorname` parameter, allowing an authenticated attacker to execute arbitrary SQL commands against the backend database. Affected systems risk unauthorized access to, modification of, or partial disruption of sensitive medical and staff records stored within the application. A public proof-of-concept exploit has been disclosed on GitHub (CVSS 4.0 E:P), significantly lowering the technical barrier for exploitation despite the moderate base score; no CISA KEV listing is present at time of analysis.
SQL injection in itsourcecode Hospital Management System 1.0 exposes the backend database to authenticated remote attackers through the `newpassword` parameter of `/doctorchangepassword.php`. An attacker holding low-privilege credentials - such as a doctor account - can craft malicious SQL payloads to read, modify, or potentially delete database records. A public exploit exists per the CVSS 4.0 E:P modifier and a referenced GitHub issue; no active exploitation has been confirmed by CISA KEV.
SQL injection in itsourcecode Hospital Management System 1.0 exposes the `/departmentDoctor.php` endpoint to database manipulation via the unsanitized `deptid` parameter, allowing a remote low-privileged attacker to read, modify, or corrupt backend database records. The CVSS 4.0 vector (PR:L) confirms that a valid application account is required, limiting opportunistic exploitation. A public proof-of-concept exploit is available on GitHub (linked from VulDB), and no vendor patch has been identified at time of analysis, making compensating controls the only available remediation path.
SQL injection in itsourcecode Hospital Management System 1.0 exposes the /department.php endpoint to database manipulation via the unsanitized `editid` parameter, allowing a remote low-privileged authenticated attacker to read, modify, or delete hospital database contents. The CVSS 4.0 vector (PR:L) confirms a valid user account is required, constraining but not eliminating risk for internet-exposed instances. A public exploit has been released on GitHub, materially increasing the likelihood of opportunistic abuse against deployed instances.
SQL injection in itsourcecode Hospital Management System 1.0 exposes the Appointment Handler endpoint `/appointmentdetail.php` to remote database manipulation via the unsanitized `editid` parameter. The CVSS 4.0 vector (PR:L, E:P) confirms low-privilege authentication is required and a public proof-of-concept exploit is available on GitHub, materially lowering the bar for exploitation. While not listed in CISA KEV, the combination of network reachability, trivial exploitation complexity, and live PoC code makes this a concrete risk for any organization running this codebase in production.
SQL injection in itsourcecode Hospital Management System 1.0 exposes the `/appointmentapproval.php` Appointment Handler endpoint to database manipulation via the `editid` parameter, allowing low-privileged remote attackers to read, modify, or delete backend data. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N) confirms network-exploitability with minimal attack complexity once credentials are obtained, and a public proof-of-concept has been disclosed on GitHub, substantially lowering the attacker skill threshold. No active exploitation is confirmed by CISA KEV, but the medical context of the affected system - which likely stores sensitive patient and appointment records - amplifies the potential impact of even a limited SQL injection.
SQL injection in itsourcecode Hospital Management System 1.0 exposes the appointment management endpoint to remote database manipulation via the unsanitized `editid` parameter in `/appointment.php`. Authenticated low-privileged users can craft malicious SQL payloads to read, modify, or corrupt appointment and patient records in the underlying database. A publicly available proof-of-concept exploit exists (GitHub issue linked in references); no CISA KEV listing at time of analysis.
SQL injection in itsourcecode Hospital Management System 1.0 exposes the `/ajaxmedicine.php` endpoint to database manipulation via the unsanitized `medicineid` parameter, exploitable by any low-privilege authenticated user over the network. A public proof-of-concept has been published on GitHub, materially lowering the barrier to exploitation. No active exploitation has been confirmed by CISA KEV, but the combination of public exploit code, a medical data context, and low attack complexity makes this a credible risk for any organization running this software.
SQL injection in itsourcecode Hospital Management System 1.0 exposes authenticated administrators to database manipulation via the `loginid` parameter in `/adminprofile.php`. The CVSS 4.0 vector (PR:H) confirms exploitation is constrained to authenticated high-privilege sessions, limiting mass exploitation risk despite network accessibility. A public proof-of-concept exploit has been disclosed on GitHub, lowering the technical barrier for targeted abuse by insiders or credential-compromised actors.
SQL injection in itsourcecode Hospital Management System 1.0 exposes patient database records to authenticated remote attackers via the unsanitized `admissiontme` parameter in `/addpatient.php`. A publicly available proof-of-concept (published on GitHub) lowers the exploitation barrier, though the CVSS 4.0 score of 2.1 reflects constrained impact - limited to partial data read/write with no scope change to subsequent systems. No active exploitation has been confirmed (not in CISA KEV), but the healthcare context amplifies regulatory significance even for low-severity data exposure.
SQL injection in itsourcecode Hospital Management System 1.0 allows remote low-privileged attackers to manipulate backend database queries via the 'Date' parameter in /adminaccount.php. The vulnerability is PHP-based (CWE-89) and publicly exploitable code exists via a GitHub submission linked through VulDB. Despite remote reachability, the CVSS 4.0 score of 2.1 reflects constrained real-world impact: low privileges are required, and the scope is fully contained with only low-level confidentiality, integrity, and availability consequences. No public patch has been identified at time of analysis.
Cross-site scripting in itsourcecode Hospital Management System 1.0 allows remote unauthenticated attackers to inject arbitrary JavaScript via the unsanitized `patientid` parameter in `/billing.php`, executing in the context of a victim user's browser session upon interaction with a crafted URL. A publicly available proof-of-concept exploit exists, referenced in GitHub issue #13 of the ltranquility/vuln_submit repository, lowering the barrier for opportunistic exploitation. This CVE is not listed in the CISA KEV catalog; the CVSS 4.0 score of 2.1 reflects limited impact scope - low integrity effect only, no confidentiality or availability loss - constrained further by the passive user interaction requirement.
SQL injection in itsourcecode Fees Management System 1.0 exposes the `/receipt.php` endpoint to database manipulation by authenticated remote attackers via the `ef_id` parameter. The CVSS temporal metric E:P confirms a publicly available exploit, disclosed via a GitHub issue, meaning exploitation is accessible to low-skilled attackers. No CISA KEV listing is present, but the combination of public POC, network-reachable attack vector, and low attack complexity makes this a credible threat for any internet-facing deployment of this PHP application.
Reflected cross-site scripting in itsourcecode Fees Management System 1.0 allows remote unauthenticated attackers to inject arbitrary JavaScript into a victim's browser session by manipulating the 'page' parameter in /navbar.php. The attack requires user interaction - a victim must follow a crafted URL - limiting mass exploitation, but publicly available exploit code (referenced via a GitHub issue) lowers the barrier for targeted phishing campaigns. No CISA KEV listing; EPSS data was not provided, though the combination of no authentication requirement and public POC warrants prompt attention for exposed deployments.
SQL injection in itsourcecode Fees Management System 1.0 allows authenticated remote attackers with low privileges to manipulate database queries via the `ID` parameter in `/manage_user.php`. The CVSS vector (AV:N/AC:L/PR:L/UI:N) confirms network-accessible exploitation requiring only a low-privilege account, with confidentiality, integrity, and availability all partially impacted. A public proof-of-concept exploit is available (E:P in CVSS temporal metrics, corroborated by a GitHub issue), though no active exploitation has been confirmed via CISA KEV. No vendor-released patch has been identified at time of analysis.