Itsourcecode
Monthly
SQL injection in itsourcecode Online Cake Ordering System 1.0 lets a low-privilege authenticated remote user manipulate the ID argument of /deletetransac.php to alter database queries, with low confidentiality, integrity, and availability impact. A public PoC reference exists; it is not verified as working exploit code, and no active exploitation is confirmed. The issue is low-to-moderate and non-urgent, requiring a valid session and affecting a niche application with minimal real-world deployment.
SQL injection in itsourcecode Online Cake Ordering System 1.0 allows a low-privileged authenticated remote attacker to manipulate the ID parameter handled by /orderdetail.php and influence backend database queries, with partial confidentiality, integrity, and availability impact per the assessed vector. Publicly available exploit code exists, but no CISA KEV entry or confirmed active exploitation is indicated in the supplied data. The application is a niche open-source PHP product, so realistic exposure is limited to deployed instances reachable by authenticated users.
SQL injection in the /deleteproduct.php endpoint of itsourcecode Online Cake Ordering System 1.0 allows authenticated low-privilege users to manipulate the ID parameter and run arbitrary SQL against the application database. The issue is remotely reachable but requires a valid account (CVSS 5.3, PR:L), and publicly available exploit code exists via a GitHub issue; no CISA KEV active exploitation is confirmed. This is a moderate priority because the niche PHP project is unlikely to be internet-exposed and exploitation is gated by authentication.
Authenticated SQL injection in itsourcecode Sales-and-Inventory-System allows a low-privilege logged-in user to inject arbitrary SQL through the ID argument of the /pages/cust_searchfrm.php customer search endpoint, potentially exposing or modifying backend database records. The project ships as a rolling release, so no discrete version numbers exist; all builds up to commit 0a3c45a78aaff3601b8cf9ce8ba82ff5c345caac are affected. Publicly available exploit code exists in the form of a public GitHub issue report, but there is no CISA KEV listing and no confirmed active exploitation; the vendor was notified through that issue and has not responded, and no vendor-released patch has been identified.
Authenticated SQL injection in itsourcecode Sales-and-Inventory-System allows a low-privileged user to manipulate the ID parameter on /pages/cust_del.php and alter database queries, with limited confidentiality, integrity, and availability impact. The product is unversioned, so all deployments are potentially affected, and publicly available exploit code exists; there is no CISA KEV confirmation of active exploitation. Signals are mixed but converge on a moderate, not urgent, priority because a valid login is required and the flaw is confined to a single endpoint.
SQL injection in itsourcecode Sales-and-Inventory-System lets authenticated low-privilege attackers alter database queries via the ID parameter in /pages/cust_edit.php, compromising confidentiality, integrity, and availability at a low level. Publicly available exploit code exists through a published GitHub issue, but no CISA KEV entry confirms active exploitation; the independent assessment rates this as a moderate, not high-priority issue. The vendor uses rolling releases and has not responded, so no fixed version is available and defenses must focus on input validation and access control.
SQL injection in itsourcecode Online Cake Ordering System 1.0 allows authenticated remote attackers to manipulate the 'cancel' argument in confirm.php, potentially exposing or altering limited data. A public exploit is available, but the vulnerability requires a low-privileged session and has low impact, and the product's negligible production presence keeps real-world risk low.
SQL injection in the itsourcecode Online Cake Ordering System 1.0 lets a remote, authenticated low-privilege user subvert database queries through the ID parameter of /addtransacdetail.php, which the PHP code interpolates into a SQL statement without sanitization, producing low confidentiality, integrity, and availability impact (independent assessment: CVSS 3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L). Publicly available exploit code exists and the reported E:P metric reflects proof-of-concept maturity, but the CVE is not in CISA KEV, so active exploitation is not confirmed; the principal limiting factors are the low-privilege authentication requirement and the practically non-existent real-world deployment of this sample PHP application.
SQL injection in itsourcecode Online Admission System 1.0 lets an authenticated low-privilege user inject arbitrary SQL through the ID parameter of the admin-area script /admin/sum.php, allowing data disclosure or manipulation. Publicly available exploit code exists (referenced via the VulDB submission and a public GitHub issue), although the CVE is not listed in CISA KEV, so there is no confirmed active exploitation. With a CVSS 4.0 base score of 5.3 (E:P, PR:L) and only low confidentiality/integrity/availability impact, this is a low-to-moderate risk that should not be treated as an urgent priority despite the public exploit.
Authenticated SQL injection in itsourcecode Baptism Information Management System 1.0 allows a low-privilege, logged-in user to inject arbitrary SQL through the b_id parameter of the pbaptism.php endpoint, potentially reading, modifying, or corrupting records in the underlying database. Publicly available exploit code exists - the vulnerability was reported via VulDB and a proof-of-concept submission is linked from a public GitHub issue - and the vendor's freely distributed PHP source means the flawed query pattern is easy to locate and reproduce. Because exploitation requires a valid session (CVSS vector PR:L) and the application has an extremely small deployment base, the practical risk is low-to-moderate, consistent with the assigned CVSS 4.0 base score of 5.3.
SQL injection in itsourcecode Baptism Information Management System 1.0 allows an attacker who already holds a low-privileged session to manipulate the ID argument of ebaptism.php and inject arbitrary SQL into the backend query, potentially exposing or altering records such as baptism registrations. Publicly available exploit code exists - a proof-of-concept was published in a public GitHub issue tied to the VulDB report - but there is no confirmed active exploitation (CISA KEV). The vendor-scored CVSS 4.0 base value is 2.1 with E:P, and an independent assessment rates the real-world risk as low because exploitation requires network reach plus a low-privileged authenticated context and the product has a very small, largely non-production deployment base.
Authenticated SQL injection in itsourcecode Online Admission System 1.0 lets a user who can reach the administrative interface inject arbitrary SQL through the 'sy' (school year) parameter of /admin/schoolyear.php, allowing read and modification of backend database contents. The attack is network-reachable but requires a valid session on the admin panel (the assessed vector is CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L), so unauthenticated internet attackers cannot reach the vulnerable endpoint without first obtaining or bypassing admin credentials. Publicly available exploit code exists (a proof-of-concept has been published via the vendor-adjacent GitHub issue linked from VulDB), but there is no confirmed active exploitation (CISA KEV) and the CWE-89 flaw is assessed as low priority. EPSS data was not provided in this intelligence set.
SQL injection in itsourcecode Online Admission System Project 1.0 exposes the admin login handler at /admin/login1.php, where the User parameter is used in a database query without adequate sanitization. Remote unauthenticated attackers can submit crafted input to the login form and manipulate SQL statements, with limited confidentiality, integrity, and availability impacts per the provided CVSS 4.0 score of 6.9 and the independent CVSS 3.1 assessment. Publicly available exploit code exists, no CISA KEV active exploitation is confirmed, and the realistic exposed population is small because this is a rarely deployed sample application.
SQL injection in itsourcecode Online Admission System 1.0 allows an attacker who already holds a valid low-privilege session to manipulate the ID parameter of /admin/key.php and inject arbitrary SQL into the backend database. Exploitation is remote but gated behind authentication and access to the administrative endpoint, so it is a low-priority, low-real-risk issue per our assessment; the practical exposure is confined to insiders or attackers who have already obtained credentials. Publicly available exploit code exists, no public exploit has been confirmed as actively exploited, and no CISA KEV entry is associated with this CVE.
SQL injection in itsourcecode Online Admission System 1.0 lets an authenticated, low-privileged user manipulate the schedid argument on /new.php so that attacker-controlled input is interpreted as part of a backend SQL statement, giving limited confidentiality, integrity and availability impact with no user interaction required. The issue is remotely reachable and publicly available exploit code exists (a public GitHub issue demonstrates the vector), but CISA KEV does not list it and no vendor-released patch was identified in the available data, so this remains a moderate-severity, low-priority issue for most deployments. Exposure is bounded by the authentication prerequisite: an attacker needs a valid low-privileged session in the application, and from the reported vector the injection does not inherently yield full database or host control.
SQL injection in itsourcecode Online Admission System 1.0 lets remote attackers manipulate the ID argument processed by /admin/examinee.php and inject arbitrary SQL into the application's database queries, potentially exposing or altering stored admission records. Exploitation is assisted by publicly available exploit code (publicly available exploit code exists; VulDB submission and a public GitHub issue reference the flaw) and the CVSS 4.0 vector rates it 6.9 with E:P (proof-of-concept maturity), but there is no CISA KEV entry, so this is not confirmed actively exploited (CISA KEV). The practical limiting factor is reachability: the vulnerable script sits under /admin/, so while the provided CVSS 4.0 vector claims PR:N/UI:N, deployments that enforce an admin login would require valid or bypassed admin credentials, which our independent assessment reflects by modeling the flaw as PR:L with high confidentiality impact.
SQL injection in itsourcecode Online Admission System 1.0 allows remote attackers to read or alter database contents via the fname argument processed by register1.php. The flaw is tracked as CVE-2026-105181 (CWE-89) with a CVSS 4.0 base score of 5.3 and publicly available exploit code; there is no CISA KEV confirmation of active exploitation. The CVSS vector indicates PR:L, but because register1.php is a registration endpoint, the required privilege level is questionable and may in practice be unauthenticated - defenders should verify.
Unauthenticated SQL injection in itsourcecode Online Admission System 1.0 allows remote attackers to manipulate the 'User' login argument in /login1.php to execute arbitrary SQL queries against the underlying database. Publicly available exploit code exists, but the product is a niche educational PHP application with limited real-world deployment, and the assessed impact is Low (VC:L/VI:L/VA:L), indicating partial rather than full database compromise. Signals are mixed and lean toward low-to-moderate real-world risk despite the network-facing, unauthenticated nature of the flaw.
SQL injection in the ID parameter processed by confirm.php in itsourcecode Online Admission System Project 1.0 lets an authenticated remote user with only low privileges inject arbitrary SQL into backend queries and read or alter the underlying database. The flaw is a textbook CWE-89 case in a small open-source PHP sample/tutorial application, and the required low-privilege session (CVSS 4.0 PR:L, UI:N) plus the product's limited real-world deployment keep practical risk at LOW-to-MODERATE despite the public availability of exploit code. No CISA KEV entry indicates confirmed active exploitation, but a public proof-of-concept has been released (referenced via the VulDB report and a GitHub issue), so any internet-reachable instance should be treated as exposed. The assessed impact is limited confidentiality, integrity, and availability loss (CVSS 5.3), not full system compromise.
SQL injection in itsourcecode Pet Shop Management System 1.0 allows an authenticated, low-privilege user to manipulate the 'filter' parameter of admin_reservefilter.php and inject arbitrary SQL into the backend query, exposing or altering database contents with low impact to confidentiality, integrity and availability. The flaw is remotely reachable over the network with no user interaction, but requires a valid session on the application's administrative component, so risk is concentrated in deployments that expose the admin panel or run the product in production. Publicly available exploit code exists for this issue, though there is no confirmation of active exploitation; the practical risk is further limited by the narrow real-world deployment base of this educational PHP product.
SQL injection in the admin_reject_completed.php script of itsourcecode Pet Shop Management System 1.0 lets an attacker who can reach the administrative back-office area manipulate the ID parameter to inject arbitrary SQL against the application's database, enabling unauthorized reads and modifications of stored data. Exploitation is network-reachable but requires at least low-privileged authenticated access to the admin interface (CVSS:4.0 PR:L, no user interaction), and the accompanying CVSS 4.0 vector carries an E:P exploit-maturity flag consistent with the public disclosure of working exploit code; there is no indication of confirmed active exploitation (not in CISA KEV). The issue is real but moderate-priority: it is bounded to version 1.0 deployments whose admin scripts are exposed to the attacker, and no vendor patch has been identified at time of analysis.
Authenticated SQL injection in itsourcecode Leave Management System 1.0 allows low-privilege users to execute arbitrary SQL commands via the LEAVTID parameter in /module/leavetype/controller.php. Exploitation requires a valid session (PR:L) and publicly available exploit code exists, but the product is a free sample/hobby PHP application with negligible production deployment, making real-world exposure minimal.
SQL injection in itsourcecode Leave Management System 1.0 lets an authenticated attacker with a low-privilege session (PR:L per the CVSS vectors) read and tamper with database contents through the ID parameter of /module/department/index.php; our independent assessment rates confidentiality impact high and integrity impact low. Publicly available exploit code exists, and the attack is network-reachable with no user interaction and no non-default configuration required. Real-world risk is moderate-to-low despite the published exploit, because the vulnerable endpoint sits inside the authenticated department administration module and the product itself is a rarely deployed hobbyist PHP application.
SQL injection in itsourcecode Leave Management System 1.0 allows an authenticated user to manipulate the DEPTID argument of /module/department/controller.php and inject arbitrary SQL into the application's backend queries. Per the assessed CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N), the primary impact is high confidentiality loss with limited integrity effect, and exploitation requires a valid application session (PR:L) - no user interaction or non-default configuration is needed beyond the department module being reachable. Publicly available exploit code exists (a public proof-of-concept is referenced at github.com/VivianQYW/cve/issues/2 and the VulDB entry 407922), so the technical barrier to weaponization is low, though real-world risk is tempered by the product's very small deployment footprint; there is no indication of confirmed active exploitation (CISA KEV).
SQL injection in itsourcecode Leave Management System 1.0 allows an authenticated remote user to manipulate the ID argument in /module/leave/index.php and potentially read or modify database contents. Publicly available exploit code exists, but the attack requires a valid session and the product is a niche PHP application unlikely to be internet-exposed in production, so our assessment treats this as a low-real-priority issue despite the genuine CWE-89 flaw. No CISA KEV confirmation is provided.
SQL injection in the ID parameter of /module/employee/index.php in itsourcecode Leave Management System 1.0 allows an attacker holding a low-privilege authenticated session to read sensitive records and partially modify database contents, with no user interaction and no special configuration required. Publicly available exploit code exists, disclosed through a public GitHub issue and catalogued by VulDB, but there is no CISA KEV listing and therefore no confirmation of active exploitation. Our independent re-assessment (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N) treats the confidentiality impact as High and rates the issue more seriously than the CVSS 4.0 base score of 2.1 attached to the VulDB entry, although the practical risk is constrained by the product's extremely small real-world deployment footprint.
Reflected cross-site scripting in itsourcecode Loan Management System 1.0 allows a remote, unauthenticated attacker to inject arbitrary script through the 'page' argument processed by navbar.php, because the value is echoed back into the HTML response without output encoding. Publicly available exploit code exists (a GitHub issue referenced from the CVE record), and the CVSS 4.0 base score is only 2.1 because exploitation requires the victim to interact and the demonstrated impact is limited to integrity (VI:L) with no confidentiality or availability loss and no scope change. It is not reported as actively exploited and no CISA KEV entry is present.
SQL injection in itsourcecode Sales and Inventory System 1.0 allows an authenticated remote attacker to manipulate backend database queries via the unsanitized prodcode parameter in /pages/pro_edit1.php. A public proof-of-concept exploit exists on GitHub, lowering the barrier to exploitation for any attacker holding a low-privilege account. The CVSS 4.0 score of 2.1 reflects constrained partial database read, write, and availability impact rather than full compromise, and no active exploitation has been reported.
SQL injection in itsourcecode Sales and Inventory System 1.0 allows authenticated remote attackers to manipulate the `ID` parameter in `/pages/inv_edit1.php` to execute arbitrary SQL against the backend database. A public exploit has been disclosed via GitHub, lowering the skill barrier for opportunistic abuse. No vendor-released patch has been identified at time of analysis; the CVSS 4.0 score of 5.3 with E:P maturity reflects partial but confirmed exploitability.
SQL injection in itsourcecode Sales and Inventory System 1.0 exposes the `/pages/sup_edit1.php` endpoint to database manipulation via an unsanitized `ID` parameter, enabling a low-privileged remote attacker to read or modify arbitrary backend database contents. A publicly available exploit (POC on GitHub) confirms the technique is reproducible with minimal skill. The vulnerability is no public exploit identified in CISA KEV, but the combination of network accessibility, a published POC, and trivial exploitation mechanics elevates practical risk for any instance exposed to the network.
SQL injection in itsourcecode Sales and Inventory System 1.0 allows an authenticated remote attacker to manipulate backend database queries via the `firstname` parameter in `/pages/emp_transac.php?action=add`. A publicly available proof-of-concept exploit has been released via GitHub, confirming the attack path. The vulnerability arises from unsanitized user input being passed directly to a SQL query in a PHP-based web application, enabling data extraction or database manipulation depending on database permissions.
SQL injection in itsourcecode Sales and Inventory System 1.0 allows authenticated remote attackers to manipulate database queries via the `firstname` parameter in `/pages/cust_pos_trans.php`. The flaw is a classic CWE-89 unsanitized input issue in a PHP-based point-of-sale and inventory management application. A publicly available proof-of-concept exploit exists; no public exploit identified as actively exploited in the wild (not in CISA KEV).
SQL injection in itsourcecode Sales and Inventory System 1.0 allows remote authenticated attackers with low-privilege accounts to manipulate the ID argument passed to mysqli_query() in /pages/us_searchfrm.php, enabling database enumeration, data exfiltration, and potential data modification. A public exploit has been published on GitHub, corroborated by VulDB reporting. The CVSS 4.0 vector (PR:L, E:P) confirms authentication is required but that exploit code is in circulation, lowering the bar for opportunistic abuse.
SQL injection in itsourcecode Sales and Inventory System 1.0 allows authenticated remote attackers to manipulate database queries through the `ID` parameter of `/pages/cust_edit1.php`. Exploitation requires low-privilege authentication and can result in unauthorized data read, modification, and limited availability impact against the underlying database. A public proof-of-concept exploit has been disclosed via GitHub, lowering the bar for opportunistic exploitation of any deployed instance.
SQL injection in itsourcecode Sales and Inventory System 1.0 allows authenticated remote attackers to manipulate database queries by injecting arbitrary SQL via the `ID` parameter in `/pages/pro_searchfrm.php`. The CVSS 4.0 vector (PR:L) confirms that low-privilege authenticated access is required, limiting the exposure compared to fully unauthenticated SQLi. A publicly available proof-of-concept exists on GitHub (referenced as an issue in the yunfan668/cve repository), though no active exploitation has been confirmed by CISA KEV. The affected product is a free PHP educational source-code project distributed by itsourcecode.com, constraining real-world impact to deployments of this niche academic software.
SQL injection in itsourcecode Sales and Inventory System 1.0 allows authenticated remote attackers to manipulate the unsanitized `ID` parameter in `/pages/us_edit1.php`, enabling unauthorized database reads, data modification, and potential privilege escalation within the application. A public proof-of-concept exploit has been disclosed on GitHub, confirming the issue is both reproducible and accessible to low-skilled attackers. No vendor patch has been identified; the product is a PHP-based educational/demo application with limited enterprise deployment footprint.
SQL injection in itsourcecode Sales and Inventory System 1.0 exposes the /pages/settings_edit.php endpoint to database manipulation via the unsanitized ID parameter. Authenticated attackers with low-privilege access can read, modify, or partially disrupt database contents. A public proof-of-concept has been disclosed on GitHub, materially lowering the exploitation skill threshold for any system running this application.
SQL injection in itsourcecode School Management System 1.0 allows unauthenticated remote attackers to manipulate the email parameter in User_Login.php, injecting arbitrary SQL into backend database queries at the pre-authentication login endpoint. With a public exploit available on GitHub, exploitation requires minimal skill and no credentials. The CVSS 4.0 vector confirms network-accessible, no-privilege exploitation with partial confidentiality, integrity, and availability impact against the underlying database.
SQL injection in itsourcecode Information System Society Membership System 1.0 exposes the database to read and write operations by authenticated remote attackers who manipulate the `student_id` parameter in `/society/check_student.php`. A public proof-of-concept exploit has been disclosed on GitHub. The CVSS 4.0 base score of 5.3 with low-impact ratings across C/I/A appears conservative for a CWE-89 flaw, which typically permits full database extraction and modification via UNION or stacked-query techniques.
SQL injection in itsourcecode Sales and Inventory System 1.0 allows authenticated remote attackers to manipulate database queries via the Username parameter in /pages/us_transac.php. The CVSS 4.0 vector (PR:L) confirms a login is required, limiting the unauthenticated attack surface, but the impact spans confidentiality, integrity, and availability of the underlying database. A public proof-of-concept exploit has been disclosed via a GitHub issue, raising the likelihood of opportunistic exploitation against any exposed instance.
SQL injection in itsourcecode Sales and Inventory System 1.0 exposes the `/pages/sup_transac.php` endpoint to database manipulation via the unsanitized `companyname` parameter. Authenticated remote attackers can inject arbitrary SQL, achieving partial read and write access to the underlying database. A public proof-of-concept exploit exists per GitHub issue reference; no CISA KEV listing has been observed.
SQL injection in itsourcecode Sales and Inventory System 1.0 allows authenticated remote attackers to manipulate database queries via the Name parameter in /pages/pro_transac.php?action=add. The vulnerability stems from unsanitized user input passed directly to SQL queries in a PHP backend, enabling data extraction, modification, or denial of service against the underlying database. A public exploit has been disclosed on GitHub, lowering the bar for exploitation.
SQL injection in itsourcecode Sales and Inventory System 1.0 allows low-privileged remote attackers to manipulate database queries via the firstname parameter in the /pages/cust_transac.php?action=add endpoint, potentially enabling unauthorized data exfiltration, modification, or deletion. The CVSS 4.0 vector confirms authentication is required (PR:L), restricting exploitation to users with at least low-privilege credentials. A public exploit is available on GitHub, lowering the practical barrier for authenticated attackers, though no confirmed active exploitation (CISA KEV) has been identified.
SQL injection in itsourcecode Sales and Inventory System 1.0 allows authenticated remote attackers to manipulate the ID parameter in /pages/us_del.php?type=user to execute arbitrary SQL statements against the backend database. The CVSS 4.0 vector (PR:L) confirms that low-privilege authenticated access is required, limiting the attack surface to logged-in users. A public proof-of-concept exploit has been disclosed on GitHub, elevating practical risk despite the moderate base score of 5.3.
SQL injection in itsourcecode Sales and Inventory System 1.0 allows low-privileged remote attackers to manipulate the `ID` parameter in `/pages/trans_view.php`, enabling arbitrary database read and write operations. The vulnerability is CWE-89 (Improper Neutralization of Special Elements in SQL Commands), affecting version 1.0 with no version range ambiguity per the CPE wildcard. A public exploit has been released and is available for use in attacks, raising the practical risk above the moderate CVSS 4.0 score of 5.3 suggests.
SQL injection in itsourcecode Sales and Inventory System 1.0 allows a remote authenticated low-privileged user to manipulate the ID parameter in /pages/pro_del.php to read, modify, or partially disrupt the underlying database. The vulnerability is exploitable over the network with low complexity and carries a publicly available proof-of-concept. No vendor patch has been identified; the software is a free educational PHP project distributed by itsourcecode.com, limiting real-world production exposure.
SQL injection in itsourcecode Sales and Inventory System 1.0 allows authenticated remote attackers to manipulate the unsanitized `ID` parameter in `/pages/inv_del.php`, enabling database enumeration, data extraction, and record modification. The application is an educational PHP project from itsourcecode.com with minimal production exposure, and a public proof-of-concept exploit has been published on GitHub. No vendor-released patch has been identified at time of analysis.
Unrestricted file upload in itsourcecode Online Medicine Delivery System 1.0 allows unauthenticated remote attackers to upload arbitrary files - including PHP webshells - through the image parameter of the Order Management Controller endpoint. The vulnerable function doInsert in /rider/orders/controller.php?action=add performs no validation of uploaded file types, enabling direct server-side code execution. A public exploit demonstrating RCE via this file upload path has been released on GitHub and is actively circulating.
Reflected cross-site scripting in itsourcecode Online Medicine Delivery System 1.0 allows an authenticated remote attacker to inject and execute arbitrary JavaScript in a victim's browser by manipulating the `location` parameter of the `/index.php?q=orderdetails` endpoint. The attacker must induce a logged-in user to follow a crafted URL, at which point the unsanitized parameter value is reflected directly into the page response. A public proof-of-concept writeup on GitHub confirms exploitability; no KEV designation applies.
SQL injection in itsourcecode Online Medicine Delivery System 1.0 allows remote authenticated customers to manipulate the backend database via the `proid` parameter in the `addwishlist` function at `/customer/controller.php?action=addwish`. Any valid customer-level session can submit a crafted POST request to extract or modify database contents, including potentially customer PII, credentials, and order records. No KEV listing exists; CVSS 4.0 scores this 5.3 (Medium), reflecting the authentication barrier (PR:L) and limited per-component impact ratings.
SQL injection in itsourcecode Online Medicine Delivery System 1.0 allows remote attackers to manipulate the ID argument passed to Order::pupdate in the rider order-confirmation endpoint, enabling arbitrary database queries. The vulnerable parameter is processed without sanitization at /rider/orders/controller.php?action=edit&actions=confirm. A public proof-of-concept has been disclosed on GitHub; no KEV listing and no vendor patch are available at time of analysis.
SQL injection in itsourcecode Online Medicine Delivery System 1.0 exposes unauthenticated attackers to direct database manipulation via the Password Recovery Interface. The `Customer::find_phone` function in `/passwordrecover.php` accepts the `phonenumber` parameter without sanitization, allowing arbitrary SQL to be injected into backend queries. A public proof-of-concept exploit has been disclosed on GitHub; the vulnerability is not currently listed in CISA KEV, but the low complexity and zero-authentication requirement make opportunistic exploitation trivial.
SQL injection in itsourcecode Online Medicine Delivery System 1.0 allows unauthenticated remote attackers to manipulate backend database queries via the Category parameter in the Product Category Filter Interface at /index.php?q=product. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) confirms exploitation requires no privileges or user interaction, and a public proof-of-concept is available on GitHub (E:P), materially lowering the exploitation barrier. Impact is rated Low across confidentiality, integrity, and availability, suggesting constrained database access rather than full system compromise; no CISA KEV listing has been identified.
SQL injection in itsourcecode Online Medicine Delivery System 1.0 exposes the Product Search Interface to remote unauthenticated database manipulation via the Search argument handled by the `loadResultList` function at `/index.php?q=product`. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) confirms no authentication, no complexity, and no user interaction are required. Publicly available exploit code exists, documented on GitHub via VulDB submission, though this product has not been added to the CISA KEV catalog and no widespread exploitation has been confirmed.
SQL injection in itsourcecode Online Medicine Delivery System 1.0 exposes database contents to remote unauthenticated attackers through the `ID` parameter in the `loadResultList` function on the Product Detail Page. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) confirms exploitation requires no credentials, no special configuration, and no user interaction. A proof-of-concept exploit has been publicly disclosed on GitHub, materially lowering the bar for opportunistic attackers beyond what the moderate score alone implies.
SQL injection in itsourcecode Online Medicine Delivery System 1.0 allows unauthenticated remote attackers to manipulate the U_USERNAME parameter in the Customer::cusAuthentication function at /login.php, enabling authentication bypass and potential database extraction. A public proof-of-concept exploit is available on GitHub, confirmed by the CVSS 4.0 E:P (proof-of-concept) modifier and a linked exploit write-up. No patch has been identified; this is a small PHP application likely used in academic or learning environments with limited production exposure.
SQL injection in itsourcecode Online Medicine Delivery System 1.0 allows unauthenticated remote attackers to manipulate database queries through the emp_email parameter on the rider login endpoint. The Employee::employeeAuthentication function at /rider/login.php incorporates unsanitized email input directly into SQL queries, enabling authentication bypass and potential data extraction. A public proof-of-concept exploit has been released with no vendor patch available, making any deployed instance immediately exploitable by low-skill attackers.
SQL injection in itsourcecode Sales and Inventory System 1.0 allows remote authenticated attackers to manipulate database queries via the unsanitized `ID` parameter in `/pages/inv_edit.php`. Exploitation requires a valid application account (PR:L per CVSS 4.0 vector), and a public proof-of-concept is available on GitHub, lowering the exploitation bar for any user with credentials. The vulnerability is not currently listed in CISA KEV, and the CVSS 4.0 score of 5.3 (Medium) reflects the authentication prerequisite limiting broader impact.
SQL injection in itsourcecode Sales and Inventory System 1.0 exposes the /pages/sup_searchfrm.php endpoint to database manipulation via the unsanitized ID parameter. Low-privileged authenticated attackers can remotely exploit this classic CWE-89 flaw to read, modify, or potentially delete backend database records. A public proof-of-concept exploit has been disclosed via GitHub; no active exploitation or CISA KEV listing has been identified at time of analysis.
SQL injection in itsourcecode Sales and Inventory System 1.0 exposes the `/pages/cust_searchfrm.php` customer search endpoint to database manipulation via an unsanitized `ID` parameter. Authenticated remote attackers with low-privilege access can alter backend SQL queries to read, modify, or delete customer and inventory records. A public proof-of-concept exploit is available, lowering the bar for targeted attacks despite the absence of a CISA KEV listing.
SQL injection in itsourcecode Sales and Inventory System 1.0 allows authenticated remote attackers to manipulate database queries via the ID parameter in /pages/pro_edit.php. The vulnerability stems from unsanitized user input passed directly to SQL queries (CWE-89), enabling read and limited write access to the underlying database. A public proof-of-concept exploit has been disclosed on GitHub; no active exploitation by KEV standards is confirmed at this time.
SQL injection in itsourcecode Sales and Inventory System 1.0 exposes the `/pages/emp_searchfrm.php` endpoint to authenticated remote attackers who can manipulate database queries by injecting malicious SQL through the unsanitized `ID` parameter. Low-privileged users with valid credentials can read, modify, or corrupt application database contents. A public proof-of-concept exploit has been published via GitHub, making active exploitation a credible near-term risk for any internet-exposed instance.
SQL injection in itsourcecode Sales and Inventory System 1.0 allows low-privileged remote attackers to manipulate database queries via the unsanitized 'ID' parameter in /pages/emp_del.php. The CVSS 4.0 vector (PR:L, E:P) confirms exploitation requires a low-privileged authenticated session but no special configuration beyond basic access. A public proof-of-concept exploit has been released, raising the practical risk above what the moderate CVSS score alone suggests; however, this vulnerability is not currently listed in CISA KEV.
Unauthenticated remote access to the CRUD operation handler in itsourcecode Payroll System 1.0 allows any network-accessible attacker to create, read, update, or delete payroll records without credentials. The root cause is CWE-306 - the ajax.php endpoint processes the 'action' parameter and executes database operations without verifying caller identity. A public proof-of-concept exploit is available on GitHub, making exploitation trivially accessible to low-skill attackers against any internet-exposed deployment.
SQL injection in itsourcecode Sales and Inventory System 1.0 exposes the /pages/cust_del.php endpoint to database manipulation via an unsanitized ID parameter. Authenticated remote attackers holding low-privilege accounts can craft malicious SQL to read, modify, or delete customer and inventory records. A publicly available proof-of-concept exploit exists on GitHub, though the vulnerability is not listed in CISA KEV and carries a CVSS 4.0 score of 2.1 reflecting limited impact.
Unauthenticated SQL injection in itsourcecode Online Clinic Management System 1.0 exposes the Admin Login endpoint (success/login.php) to remote exploitation via the Username parameter. Any network-reachable attacker can manipulate SQL queries without credentials or user interaction, enabling authentication bypass and arbitrary database read/write. A public exploit POC has been disclosed on GitHub (microwaveabi/vul issue #63), substantially lowering the barrier to exploitation; no CISA KEV listing has been confirmed at time of analysis.
SQL injection in itsourcecode Real Estate Management System 1.0 exposes the search.php endpoint to remote unauthenticated database manipulation via the search, delivery_type, search_price, and property_type parameters. A public proof-of-concept exploit has been published on GitHub (issue #5, microwaveabi/vul), making this trivially accessible to low-skill attackers. CVSS 4.0 rates this 6.9 with low-level impact across confidentiality, integrity, and availability on the vulnerable system; no active exploitation by CISA KEV has been confirmed at time of analysis.
Unrestricted file upload in itsourcecode Payroll System 1.0 exposes the application to potential remote code execution through the save_settings function in admin_class.php, where the img parameter accepts files without validating type or content. The CVSS 4.0 vector indicates network-accessible exploitation with no privileges required (PR:N), meaning an attacker can submit a crafted multipart request to upload a PHP webshell directly. A public proof-of-concept exploit exists per the GitHub reference and VulDB reporting; this is not confirmed in CISA KEV, but the low barrier to exploitation combined with POC availability elevates real-world risk beyond the 6.9 score implies.
SQL injection in itsourcecode Library Management System 1.0 allows remote authenticated attackers to manipulate database queries via the ID parameter in editbooks.php. The vulnerability is classified as CWE-89 (Improper Neutralization of Special Elements used in an SQL Command) and affects the book editing function, potentially exposing or corrupting the underlying database. A public proof-of-concept exploit exists, raising the operational risk for any unpatched deployment.
SQL injection in itsourcecode Sales and Inventory System 1.0 exposes the customer edit endpoint to database manipulation by authenticated network attackers who can control the ID parameter in /pages/cust_edit.php. The CVSS 4.0 base score of 2.1 reflects limited impact across confidentiality, integrity, and availability, though a public proof-of-concept exploit exists on GitHub. No active exploitation by CISA KEV has been confirmed; the low score and limited deployment footprint constrain real-world priority despite the public exploit.
SQL injection in itsourcecode Sales and Inventory System 1.0 exposes the login endpoint to unauthenticated remote exploitation via the unsanitized `User` parameter in `/pages/processlogin.php`. Attackers can manipulate backend SQL queries without any prior authentication, enabling authentication bypass or database data extraction. A public proof-of-concept has been disclosed on GitHub, and the unauthenticated network attack vector (CVSS 4.0 PR:N, AV:N with E:P) makes any internet-exposed deployment immediately actionable - no public exploit identified as confirmed actively exploited (not in CISA KEV) at time of analysis.
SQL injection in itsourcecode Hospital Management System Project in PHP 1.0 allows low-privilege authenticated remote attackers to manipulate database queries via the `delid` parameter in `/viewservicetype.php`. Publicly available exploit code exists, reported and disclosed through VulDB. Successful exploitation yields partial confidentiality, integrity, and availability impact against the application database, with no lateral scope change to external systems confirmed.
SQL injection in itsourcecode Hospital Management System 1.0 allows authenticated remote attackers to manipulate the `delid` parameter in `/viewappointmentapproved.php` to execute arbitrary SQL commands against the backend database. A publicly available proof-of-concept exploit exists on GitHub, elevating the practical risk beyond the moderate CVSS score. No active CISA KEV listing has been confirmed, but the low attack complexity and network-accessible vector make opportunistic exploitation feasible against any exposed instance with valid credentials.
SQL injection in itsourcecode Hospital Management System 1.0 exposes the /viewbilling.php endpoint to database manipulation via the unsanitized delid parameter, exploitable by any low-privileged authenticated user over the network. A publicly available proof-of-concept has been disclosed on GitHub, lowering the barrier to exploitation significantly. Impact is bounded to partial confidentiality, integrity, and availability loss against the application database, with no confirmed scope change to adjacent systems.
SQL injection in itsourcecode Hospital Management System 1.0 allows low-privileged remote attackers to manipulate the `delid` parameter in `/viewdepartment.php`, enabling arbitrary SQL query execution against the backend database. The CVSS 4.0 score of 5.3 reflects limited but confirmed confidentiality, integrity, and availability impact. A proof-of-concept exploit is publicly available on GitHub, materially lowering the barrier to exploitation; however, no active exploitation has been confirmed via CISA KEV.
SQL injection in itsourcecode Hospital Management System 1.0 exposes patient and operational database contents to remote authenticated attackers via the `delid` parameter in `/viewroom.php`. The vulnerability carries a CVSS 4.0 score of 5.3 with a network attack vector and low complexity, and a public proof-of-concept exploit has been disclosed on GitHub. No CISA KEV listing exists, but the combination of a live exploit and sensitive healthcare data context elevates practical urgency beyond what the moderate score alone suggests.
SQL injection in itsourcecode Hospital Management System 1.0 exposes the /viewprescriptionrecord.php endpoint to authenticated remote attackers who can manipulate the `delid` parameter to execute arbitrary SQL commands against the underlying database. Publicly available exploit code exists on GitHub, confirmed by the CVSS 4.0 E:P modifier, though no CISA KEV listing indicates active widespread exploitation at time of analysis. Given the healthcare context, the combination of public exploit availability and sensitive patient data makes this a higher-priority remediation than the low CVSS 4.0 score of 2.1 alone suggests.
SQL injection in itsourcecode Hospital Management System 1.0 allows authenticated remote attackers to manipulate database queries via the `delid` parameter in /viewpaymentreport.php. A publicly available proof-of-concept exploit exists on GitHub, lowering the barrier to exploitation for any reachable instance. The CVSS 4.0 vector confirms low-privilege authentication is required (PR:L), and impact is rated partial across confidentiality, integrity, and availability - though SQL injection primitives can often be escalated beyond initial scoring to achieve broader data extraction.
SQL injection in itsourcecode Hospital Management System 1.0 exposes patient management functionality to low-privileged authenticated attackers who can manipulate the `delid` parameter in /viewpatient.php to alter or extract database records. Successful exploitation allows unauthorized read, modification, or deletion of patient data, carrying significant regulatory and privacy consequences in healthcare environments. A proof-of-concept exploit has been publicly disclosed via GitHub, materially lowering the bar for opportunistic attacks against unpatched instances; the vulnerability is not currently listed in the CISA KEV catalog.
SQL injection in itsourcecode Hospital Management System 1.0 exposes the `/vieworder.php` endpoint to database manipulation via the unvalidated `delid` parameter, exploitable by authenticated remote attackers. A publicly available exploit has been disclosed on GitHub, raising the realistic likelihood of opportunistic exploitation against unpatched deployments. No CISA KEV listing is present, but the healthcare-sector context and public POC make this a meaningful remediation priority for any operator running this software.
SQL injection in itsourcecode Hospital Management System 1.0 exposes the `/viewmedicine.php` endpoint to database manipulation via the unsanitized `delid` parameter, allowing remote low-privileged attackers to read, alter, or delete hospital database contents including patient and medication records. A public proof-of-concept exploit is confirmed available on GitHub, lowering the bar for exploitation significantly. No vendor-released patch exists, making manual code remediation or decommissioning the only available mitigations.
SQL injection in itsourcecode Hospital Management System 1.0 allows authenticated remote attackers to execute arbitrary SQL queries via the delid parameter in viewdoctortimings.php. A low-privileged user account is required to exploit the flaw, after which an attacker can extract, modify, or potentially delete sensitive data from the underlying database - including patient records and physician scheduling data. A public proof-of-concept exploit has been published on GitHub, materially lowering the barrier for opportunistic exploitation.
SQL injection in itsourcecode Hospital Management System 1.0 exposes authenticated attackers to database manipulation via the `delid` parameter in `/viewdoctorconsultancycharge.php`. The vulnerability is PHP-based, requires only low-privilege authentication, and carries a public proof-of-concept exploit documented on GitHub. No active exploitation has been confirmed via CISA KEV, and the CVSS 4.0 score of 2.1 reflects constrained impact, though the sensitivity of healthcare data elevates organizational risk beyond the raw score.
SQL injection in itsourcecode Hospital Management System 1.0 exposes the `/viewdoctor.php` endpoint to database manipulation via the unsanitized `delid` parameter, allowing authenticated remote attackers to read, modify, or potentially delete records including patient and physician data. No active exploitation is confirmed in the CISA KEV catalog, but a public proof-of-concept exploit exists on GitHub, materially lowering the skill threshold for attacks. The CVSS 4.0 score of 5.3 with PR:L reflects a constrained but realistic threat to healthcare deployments with lax access controls.
SQL injection in itsourcecode Hospital Management System 1.0 allows authenticated remote attackers to manipulate database queries via the `editid` parameter in /servicetype.php. The vulnerability is a classic CWE-89 unsanitized input passed directly to a SQL query, enabling read and write access to the underlying database. A public proof-of-concept exploit exists (GitHub issue linked in references), raising the practical risk above the low CVSS 4.0 base score of 2.1 - though exploitation is not confirmed in CISA KEV and real-world deployment of this product is limited.
SQL injection in itsourcecode Hospital Management System 1.0 exposes the `/prescription.php` endpoint to database manipulation via the unsanitized `editid` parameter, exploitable by remote authenticated users. A public proof-of-concept exploit is available on GitHub, lowering the skill barrier for exploitation. No CISA KEV listing is present; the CVSS 4.0 score of 2.1 reflects low impact across all dimensions, likely constrained by the database user's privileges or the limited data scope accessible through this endpoint.
SQL injection in itsourcecode Hospital Management System 1.0 allows remote authenticated attackers to manipulate database queries via the `editid` parameter in `/prescriptionorder.php`. The CVSS 4.0 vector (PR:L) confirms low-privilege authenticated access is required, limiting opportunistic exploitation but not targeted abuse by authorized users or compromised accounts. A publicly available proof-of-concept exploit exists on GitHub, lowering the barrier for exploitation. No patch has been identified; no public exploit identified at time of analysis in CISA KEV.
SQL injection in itsourcecode Hospital Management System 1.0 exposes the `/prescriptionorderreport.php` endpoint to database manipulation via the unsanitized `delid` parameter, exploitable by remote authenticated attackers. A publicly available proof-of-concept (GitHub ltranquility/submit_vuln issue #10) confirms exploitability; the CVSS 4.0 E:P metric corroborates this. No CISA KEV listing exists, and real-world impact is bounded by the low-privilege authentication prerequisite and the niche deployment footprint of this educational PHP codebase.
Cross-site scripting in itsourcecode Courier Management System 1.0 allows remote, unauthenticated attackers to inject arbitrary client-side scripts via the `page` parameter of /index.php, requiring only that a victim user follow a crafted link. A publicly available proof-of-concept exploit exists, lowering the bar for abuse. No patch has been identified at time of analysis; no CISA KEV listing, but the public PoC and low attack complexity make this actionable for defenders protecting user sessions.
SQL injection in itsourcecode Hospital Management System 1.0 exposes authenticated users' ability to manipulate backend database queries via the `delid` parameter in `/prescriptionrecord.php`. Any instance accessible over the network is at risk of unauthorized data extraction or record manipulation - a significant concern given the sensitive patient and prescription data typically stored in such systems. Public exploit code is available on GitHub, and no vendor-released patch has been identified at time of analysis; exploitation is not confirmed in CISA KEV but the low attack complexity and public POC reduce the barrier to abuse.
SQL injection in itsourcecode Online Cake Ordering System 1.0 lets a low-privilege authenticated remote user manipulate the ID argument of /deletetransac.php to alter database queries, with low confidentiality, integrity, and availability impact. A public PoC reference exists; it is not verified as working exploit code, and no active exploitation is confirmed. The issue is low-to-moderate and non-urgent, requiring a valid session and affecting a niche application with minimal real-world deployment.
SQL injection in itsourcecode Online Cake Ordering System 1.0 allows a low-privileged authenticated remote attacker to manipulate the ID parameter handled by /orderdetail.php and influence backend database queries, with partial confidentiality, integrity, and availability impact per the assessed vector. Publicly available exploit code exists, but no CISA KEV entry or confirmed active exploitation is indicated in the supplied data. The application is a niche open-source PHP product, so realistic exposure is limited to deployed instances reachable by authenticated users.
SQL injection in the /deleteproduct.php endpoint of itsourcecode Online Cake Ordering System 1.0 allows authenticated low-privilege users to manipulate the ID parameter and run arbitrary SQL against the application database. The issue is remotely reachable but requires a valid account (CVSS 5.3, PR:L), and publicly available exploit code exists via a GitHub issue; no CISA KEV active exploitation is confirmed. This is a moderate priority because the niche PHP project is unlikely to be internet-exposed and exploitation is gated by authentication.
Authenticated SQL injection in itsourcecode Sales-and-Inventory-System allows a low-privilege logged-in user to inject arbitrary SQL through the ID argument of the /pages/cust_searchfrm.php customer search endpoint, potentially exposing or modifying backend database records. The project ships as a rolling release, so no discrete version numbers exist; all builds up to commit 0a3c45a78aaff3601b8cf9ce8ba82ff5c345caac are affected. Publicly available exploit code exists in the form of a public GitHub issue report, but there is no CISA KEV listing and no confirmed active exploitation; the vendor was notified through that issue and has not responded, and no vendor-released patch has been identified.
Authenticated SQL injection in itsourcecode Sales-and-Inventory-System allows a low-privileged user to manipulate the ID parameter on /pages/cust_del.php and alter database queries, with limited confidentiality, integrity, and availability impact. The product is unversioned, so all deployments are potentially affected, and publicly available exploit code exists; there is no CISA KEV confirmation of active exploitation. Signals are mixed but converge on a moderate, not urgent, priority because a valid login is required and the flaw is confined to a single endpoint.
SQL injection in itsourcecode Sales-and-Inventory-System lets authenticated low-privilege attackers alter database queries via the ID parameter in /pages/cust_edit.php, compromising confidentiality, integrity, and availability at a low level. Publicly available exploit code exists through a published GitHub issue, but no CISA KEV entry confirms active exploitation; the independent assessment rates this as a moderate, not high-priority issue. The vendor uses rolling releases and has not responded, so no fixed version is available and defenses must focus on input validation and access control.
SQL injection in itsourcecode Online Cake Ordering System 1.0 allows authenticated remote attackers to manipulate the 'cancel' argument in confirm.php, potentially exposing or altering limited data. A public exploit is available, but the vulnerability requires a low-privileged session and has low impact, and the product's negligible production presence keeps real-world risk low.
SQL injection in the itsourcecode Online Cake Ordering System 1.0 lets a remote, authenticated low-privilege user subvert database queries through the ID parameter of /addtransacdetail.php, which the PHP code interpolates into a SQL statement without sanitization, producing low confidentiality, integrity, and availability impact (independent assessment: CVSS 3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L). Publicly available exploit code exists and the reported E:P metric reflects proof-of-concept maturity, but the CVE is not in CISA KEV, so active exploitation is not confirmed; the principal limiting factors are the low-privilege authentication requirement and the practically non-existent real-world deployment of this sample PHP application.
SQL injection in itsourcecode Online Admission System 1.0 lets an authenticated low-privilege user inject arbitrary SQL through the ID parameter of the admin-area script /admin/sum.php, allowing data disclosure or manipulation. Publicly available exploit code exists (referenced via the VulDB submission and a public GitHub issue), although the CVE is not listed in CISA KEV, so there is no confirmed active exploitation. With a CVSS 4.0 base score of 5.3 (E:P, PR:L) and only low confidentiality/integrity/availability impact, this is a low-to-moderate risk that should not be treated as an urgent priority despite the public exploit.
Authenticated SQL injection in itsourcecode Baptism Information Management System 1.0 allows a low-privilege, logged-in user to inject arbitrary SQL through the b_id parameter of the pbaptism.php endpoint, potentially reading, modifying, or corrupting records in the underlying database. Publicly available exploit code exists - the vulnerability was reported via VulDB and a proof-of-concept submission is linked from a public GitHub issue - and the vendor's freely distributed PHP source means the flawed query pattern is easy to locate and reproduce. Because exploitation requires a valid session (CVSS vector PR:L) and the application has an extremely small deployment base, the practical risk is low-to-moderate, consistent with the assigned CVSS 4.0 base score of 5.3.
SQL injection in itsourcecode Baptism Information Management System 1.0 allows an attacker who already holds a low-privileged session to manipulate the ID argument of ebaptism.php and inject arbitrary SQL into the backend query, potentially exposing or altering records such as baptism registrations. Publicly available exploit code exists - a proof-of-concept was published in a public GitHub issue tied to the VulDB report - but there is no confirmed active exploitation (CISA KEV). The vendor-scored CVSS 4.0 base value is 2.1 with E:P, and an independent assessment rates the real-world risk as low because exploitation requires network reach plus a low-privileged authenticated context and the product has a very small, largely non-production deployment base.
Authenticated SQL injection in itsourcecode Online Admission System 1.0 lets a user who can reach the administrative interface inject arbitrary SQL through the 'sy' (school year) parameter of /admin/schoolyear.php, allowing read and modification of backend database contents. The attack is network-reachable but requires a valid session on the admin panel (the assessed vector is CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L), so unauthenticated internet attackers cannot reach the vulnerable endpoint without first obtaining or bypassing admin credentials. Publicly available exploit code exists (a proof-of-concept has been published via the vendor-adjacent GitHub issue linked from VulDB), but there is no confirmed active exploitation (CISA KEV) and the CWE-89 flaw is assessed as low priority. EPSS data was not provided in this intelligence set.
SQL injection in itsourcecode Online Admission System Project 1.0 exposes the admin login handler at /admin/login1.php, where the User parameter is used in a database query without adequate sanitization. Remote unauthenticated attackers can submit crafted input to the login form and manipulate SQL statements, with limited confidentiality, integrity, and availability impacts per the provided CVSS 4.0 score of 6.9 and the independent CVSS 3.1 assessment. Publicly available exploit code exists, no CISA KEV active exploitation is confirmed, and the realistic exposed population is small because this is a rarely deployed sample application.
SQL injection in itsourcecode Online Admission System 1.0 allows an attacker who already holds a valid low-privilege session to manipulate the ID parameter of /admin/key.php and inject arbitrary SQL into the backend database. Exploitation is remote but gated behind authentication and access to the administrative endpoint, so it is a low-priority, low-real-risk issue per our assessment; the practical exposure is confined to insiders or attackers who have already obtained credentials. Publicly available exploit code exists, no public exploit has been confirmed as actively exploited, and no CISA KEV entry is associated with this CVE.
SQL injection in itsourcecode Online Admission System 1.0 lets an authenticated, low-privileged user manipulate the schedid argument on /new.php so that attacker-controlled input is interpreted as part of a backend SQL statement, giving limited confidentiality, integrity and availability impact with no user interaction required. The issue is remotely reachable and publicly available exploit code exists (a public GitHub issue demonstrates the vector), but CISA KEV does not list it and no vendor-released patch was identified in the available data, so this remains a moderate-severity, low-priority issue for most deployments. Exposure is bounded by the authentication prerequisite: an attacker needs a valid low-privileged session in the application, and from the reported vector the injection does not inherently yield full database or host control.
SQL injection in itsourcecode Online Admission System 1.0 lets remote attackers manipulate the ID argument processed by /admin/examinee.php and inject arbitrary SQL into the application's database queries, potentially exposing or altering stored admission records. Exploitation is assisted by publicly available exploit code (publicly available exploit code exists; VulDB submission and a public GitHub issue reference the flaw) and the CVSS 4.0 vector rates it 6.9 with E:P (proof-of-concept maturity), but there is no CISA KEV entry, so this is not confirmed actively exploited (CISA KEV). The practical limiting factor is reachability: the vulnerable script sits under /admin/, so while the provided CVSS 4.0 vector claims PR:N/UI:N, deployments that enforce an admin login would require valid or bypassed admin credentials, which our independent assessment reflects by modeling the flaw as PR:L with high confidentiality impact.
SQL injection in itsourcecode Online Admission System 1.0 allows remote attackers to read or alter database contents via the fname argument processed by register1.php. The flaw is tracked as CVE-2026-105181 (CWE-89) with a CVSS 4.0 base score of 5.3 and publicly available exploit code; there is no CISA KEV confirmation of active exploitation. The CVSS vector indicates PR:L, but because register1.php is a registration endpoint, the required privilege level is questionable and may in practice be unauthenticated - defenders should verify.
Unauthenticated SQL injection in itsourcecode Online Admission System 1.0 allows remote attackers to manipulate the 'User' login argument in /login1.php to execute arbitrary SQL queries against the underlying database. Publicly available exploit code exists, but the product is a niche educational PHP application with limited real-world deployment, and the assessed impact is Low (VC:L/VI:L/VA:L), indicating partial rather than full database compromise. Signals are mixed and lean toward low-to-moderate real-world risk despite the network-facing, unauthenticated nature of the flaw.
SQL injection in the ID parameter processed by confirm.php in itsourcecode Online Admission System Project 1.0 lets an authenticated remote user with only low privileges inject arbitrary SQL into backend queries and read or alter the underlying database. The flaw is a textbook CWE-89 case in a small open-source PHP sample/tutorial application, and the required low-privilege session (CVSS 4.0 PR:L, UI:N) plus the product's limited real-world deployment keep practical risk at LOW-to-MODERATE despite the public availability of exploit code. No CISA KEV entry indicates confirmed active exploitation, but a public proof-of-concept has been released (referenced via the VulDB report and a GitHub issue), so any internet-reachable instance should be treated as exposed. The assessed impact is limited confidentiality, integrity, and availability loss (CVSS 5.3), not full system compromise.
SQL injection in itsourcecode Pet Shop Management System 1.0 allows an authenticated, low-privilege user to manipulate the 'filter' parameter of admin_reservefilter.php and inject arbitrary SQL into the backend query, exposing or altering database contents with low impact to confidentiality, integrity and availability. The flaw is remotely reachable over the network with no user interaction, but requires a valid session on the application's administrative component, so risk is concentrated in deployments that expose the admin panel or run the product in production. Publicly available exploit code exists for this issue, though there is no confirmation of active exploitation; the practical risk is further limited by the narrow real-world deployment base of this educational PHP product.
SQL injection in the admin_reject_completed.php script of itsourcecode Pet Shop Management System 1.0 lets an attacker who can reach the administrative back-office area manipulate the ID parameter to inject arbitrary SQL against the application's database, enabling unauthorized reads and modifications of stored data. Exploitation is network-reachable but requires at least low-privileged authenticated access to the admin interface (CVSS:4.0 PR:L, no user interaction), and the accompanying CVSS 4.0 vector carries an E:P exploit-maturity flag consistent with the public disclosure of working exploit code; there is no indication of confirmed active exploitation (not in CISA KEV). The issue is real but moderate-priority: it is bounded to version 1.0 deployments whose admin scripts are exposed to the attacker, and no vendor patch has been identified at time of analysis.
Authenticated SQL injection in itsourcecode Leave Management System 1.0 allows low-privilege users to execute arbitrary SQL commands via the LEAVTID parameter in /module/leavetype/controller.php. Exploitation requires a valid session (PR:L) and publicly available exploit code exists, but the product is a free sample/hobby PHP application with negligible production deployment, making real-world exposure minimal.
SQL injection in itsourcecode Leave Management System 1.0 lets an authenticated attacker with a low-privilege session (PR:L per the CVSS vectors) read and tamper with database contents through the ID parameter of /module/department/index.php; our independent assessment rates confidentiality impact high and integrity impact low. Publicly available exploit code exists, and the attack is network-reachable with no user interaction and no non-default configuration required. Real-world risk is moderate-to-low despite the published exploit, because the vulnerable endpoint sits inside the authenticated department administration module and the product itself is a rarely deployed hobbyist PHP application.
SQL injection in itsourcecode Leave Management System 1.0 allows an authenticated user to manipulate the DEPTID argument of /module/department/controller.php and inject arbitrary SQL into the application's backend queries. Per the assessed CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N), the primary impact is high confidentiality loss with limited integrity effect, and exploitation requires a valid application session (PR:L) - no user interaction or non-default configuration is needed beyond the department module being reachable. Publicly available exploit code exists (a public proof-of-concept is referenced at github.com/VivianQYW/cve/issues/2 and the VulDB entry 407922), so the technical barrier to weaponization is low, though real-world risk is tempered by the product's very small deployment footprint; there is no indication of confirmed active exploitation (CISA KEV).
SQL injection in itsourcecode Leave Management System 1.0 allows an authenticated remote user to manipulate the ID argument in /module/leave/index.php and potentially read or modify database contents. Publicly available exploit code exists, but the attack requires a valid session and the product is a niche PHP application unlikely to be internet-exposed in production, so our assessment treats this as a low-real-priority issue despite the genuine CWE-89 flaw. No CISA KEV confirmation is provided.
SQL injection in the ID parameter of /module/employee/index.php in itsourcecode Leave Management System 1.0 allows an attacker holding a low-privilege authenticated session to read sensitive records and partially modify database contents, with no user interaction and no special configuration required. Publicly available exploit code exists, disclosed through a public GitHub issue and catalogued by VulDB, but there is no CISA KEV listing and therefore no confirmation of active exploitation. Our independent re-assessment (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N) treats the confidentiality impact as High and rates the issue more seriously than the CVSS 4.0 base score of 2.1 attached to the VulDB entry, although the practical risk is constrained by the product's extremely small real-world deployment footprint.
Reflected cross-site scripting in itsourcecode Loan Management System 1.0 allows a remote, unauthenticated attacker to inject arbitrary script through the 'page' argument processed by navbar.php, because the value is echoed back into the HTML response without output encoding. Publicly available exploit code exists (a GitHub issue referenced from the CVE record), and the CVSS 4.0 base score is only 2.1 because exploitation requires the victim to interact and the demonstrated impact is limited to integrity (VI:L) with no confidentiality or availability loss and no scope change. It is not reported as actively exploited and no CISA KEV entry is present.
SQL injection in itsourcecode Sales and Inventory System 1.0 allows an authenticated remote attacker to manipulate backend database queries via the unsanitized prodcode parameter in /pages/pro_edit1.php. A public proof-of-concept exploit exists on GitHub, lowering the barrier to exploitation for any attacker holding a low-privilege account. The CVSS 4.0 score of 2.1 reflects constrained partial database read, write, and availability impact rather than full compromise, and no active exploitation has been reported.
SQL injection in itsourcecode Sales and Inventory System 1.0 allows authenticated remote attackers to manipulate the `ID` parameter in `/pages/inv_edit1.php` to execute arbitrary SQL against the backend database. A public exploit has been disclosed via GitHub, lowering the skill barrier for opportunistic abuse. No vendor-released patch has been identified at time of analysis; the CVSS 4.0 score of 5.3 with E:P maturity reflects partial but confirmed exploitability.
SQL injection in itsourcecode Sales and Inventory System 1.0 exposes the `/pages/sup_edit1.php` endpoint to database manipulation via an unsanitized `ID` parameter, enabling a low-privileged remote attacker to read or modify arbitrary backend database contents. A publicly available exploit (POC on GitHub) confirms the technique is reproducible with minimal skill. The vulnerability is no public exploit identified in CISA KEV, but the combination of network accessibility, a published POC, and trivial exploitation mechanics elevates practical risk for any instance exposed to the network.
SQL injection in itsourcecode Sales and Inventory System 1.0 allows an authenticated remote attacker to manipulate backend database queries via the `firstname` parameter in `/pages/emp_transac.php?action=add`. A publicly available proof-of-concept exploit has been released via GitHub, confirming the attack path. The vulnerability arises from unsanitized user input being passed directly to a SQL query in a PHP-based web application, enabling data extraction or database manipulation depending on database permissions.
SQL injection in itsourcecode Sales and Inventory System 1.0 allows authenticated remote attackers to manipulate database queries via the `firstname` parameter in `/pages/cust_pos_trans.php`. The flaw is a classic CWE-89 unsanitized input issue in a PHP-based point-of-sale and inventory management application. A publicly available proof-of-concept exploit exists; no public exploit identified as actively exploited in the wild (not in CISA KEV).
SQL injection in itsourcecode Sales and Inventory System 1.0 allows remote authenticated attackers with low-privilege accounts to manipulate the ID argument passed to mysqli_query() in /pages/us_searchfrm.php, enabling database enumeration, data exfiltration, and potential data modification. A public exploit has been published on GitHub, corroborated by VulDB reporting. The CVSS 4.0 vector (PR:L, E:P) confirms authentication is required but that exploit code is in circulation, lowering the bar for opportunistic abuse.
SQL injection in itsourcecode Sales and Inventory System 1.0 allows authenticated remote attackers to manipulate database queries through the `ID` parameter of `/pages/cust_edit1.php`. Exploitation requires low-privilege authentication and can result in unauthorized data read, modification, and limited availability impact against the underlying database. A public proof-of-concept exploit has been disclosed via GitHub, lowering the bar for opportunistic exploitation of any deployed instance.
SQL injection in itsourcecode Sales and Inventory System 1.0 allows authenticated remote attackers to manipulate database queries by injecting arbitrary SQL via the `ID` parameter in `/pages/pro_searchfrm.php`. The CVSS 4.0 vector (PR:L) confirms that low-privilege authenticated access is required, limiting the exposure compared to fully unauthenticated SQLi. A publicly available proof-of-concept exists on GitHub (referenced as an issue in the yunfan668/cve repository), though no active exploitation has been confirmed by CISA KEV. The affected product is a free PHP educational source-code project distributed by itsourcecode.com, constraining real-world impact to deployments of this niche academic software.
SQL injection in itsourcecode Sales and Inventory System 1.0 allows authenticated remote attackers to manipulate the unsanitized `ID` parameter in `/pages/us_edit1.php`, enabling unauthorized database reads, data modification, and potential privilege escalation within the application. A public proof-of-concept exploit has been disclosed on GitHub, confirming the issue is both reproducible and accessible to low-skilled attackers. No vendor patch has been identified; the product is a PHP-based educational/demo application with limited enterprise deployment footprint.
SQL injection in itsourcecode Sales and Inventory System 1.0 exposes the /pages/settings_edit.php endpoint to database manipulation via the unsanitized ID parameter. Authenticated attackers with low-privilege access can read, modify, or partially disrupt database contents. A public proof-of-concept has been disclosed on GitHub, materially lowering the exploitation skill threshold for any system running this application.
SQL injection in itsourcecode School Management System 1.0 allows unauthenticated remote attackers to manipulate the email parameter in User_Login.php, injecting arbitrary SQL into backend database queries at the pre-authentication login endpoint. With a public exploit available on GitHub, exploitation requires minimal skill and no credentials. The CVSS 4.0 vector confirms network-accessible, no-privilege exploitation with partial confidentiality, integrity, and availability impact against the underlying database.
SQL injection in itsourcecode Information System Society Membership System 1.0 exposes the database to read and write operations by authenticated remote attackers who manipulate the `student_id` parameter in `/society/check_student.php`. A public proof-of-concept exploit has been disclosed on GitHub. The CVSS 4.0 base score of 5.3 with low-impact ratings across C/I/A appears conservative for a CWE-89 flaw, which typically permits full database extraction and modification via UNION or stacked-query techniques.
SQL injection in itsourcecode Sales and Inventory System 1.0 allows authenticated remote attackers to manipulate database queries via the Username parameter in /pages/us_transac.php. The CVSS 4.0 vector (PR:L) confirms a login is required, limiting the unauthenticated attack surface, but the impact spans confidentiality, integrity, and availability of the underlying database. A public proof-of-concept exploit has been disclosed via a GitHub issue, raising the likelihood of opportunistic exploitation against any exposed instance.
SQL injection in itsourcecode Sales and Inventory System 1.0 exposes the `/pages/sup_transac.php` endpoint to database manipulation via the unsanitized `companyname` parameter. Authenticated remote attackers can inject arbitrary SQL, achieving partial read and write access to the underlying database. A public proof-of-concept exploit exists per GitHub issue reference; no CISA KEV listing has been observed.
SQL injection in itsourcecode Sales and Inventory System 1.0 allows authenticated remote attackers to manipulate database queries via the Name parameter in /pages/pro_transac.php?action=add. The vulnerability stems from unsanitized user input passed directly to SQL queries in a PHP backend, enabling data extraction, modification, or denial of service against the underlying database. A public exploit has been disclosed on GitHub, lowering the bar for exploitation.
SQL injection in itsourcecode Sales and Inventory System 1.0 allows low-privileged remote attackers to manipulate database queries via the firstname parameter in the /pages/cust_transac.php?action=add endpoint, potentially enabling unauthorized data exfiltration, modification, or deletion. The CVSS 4.0 vector confirms authentication is required (PR:L), restricting exploitation to users with at least low-privilege credentials. A public exploit is available on GitHub, lowering the practical barrier for authenticated attackers, though no confirmed active exploitation (CISA KEV) has been identified.
SQL injection in itsourcecode Sales and Inventory System 1.0 allows authenticated remote attackers to manipulate the ID parameter in /pages/us_del.php?type=user to execute arbitrary SQL statements against the backend database. The CVSS 4.0 vector (PR:L) confirms that low-privilege authenticated access is required, limiting the attack surface to logged-in users. A public proof-of-concept exploit has been disclosed on GitHub, elevating practical risk despite the moderate base score of 5.3.
SQL injection in itsourcecode Sales and Inventory System 1.0 allows low-privileged remote attackers to manipulate the `ID` parameter in `/pages/trans_view.php`, enabling arbitrary database read and write operations. The vulnerability is CWE-89 (Improper Neutralization of Special Elements in SQL Commands), affecting version 1.0 with no version range ambiguity per the CPE wildcard. A public exploit has been released and is available for use in attacks, raising the practical risk above the moderate CVSS 4.0 score of 5.3 suggests.
SQL injection in itsourcecode Sales and Inventory System 1.0 allows a remote authenticated low-privileged user to manipulate the ID parameter in /pages/pro_del.php to read, modify, or partially disrupt the underlying database. The vulnerability is exploitable over the network with low complexity and carries a publicly available proof-of-concept. No vendor patch has been identified; the software is a free educational PHP project distributed by itsourcecode.com, limiting real-world production exposure.
SQL injection in itsourcecode Sales and Inventory System 1.0 allows authenticated remote attackers to manipulate the unsanitized `ID` parameter in `/pages/inv_del.php`, enabling database enumeration, data extraction, and record modification. The application is an educational PHP project from itsourcecode.com with minimal production exposure, and a public proof-of-concept exploit has been published on GitHub. No vendor-released patch has been identified at time of analysis.
Unrestricted file upload in itsourcecode Online Medicine Delivery System 1.0 allows unauthenticated remote attackers to upload arbitrary files - including PHP webshells - through the image parameter of the Order Management Controller endpoint. The vulnerable function doInsert in /rider/orders/controller.php?action=add performs no validation of uploaded file types, enabling direct server-side code execution. A public exploit demonstrating RCE via this file upload path has been released on GitHub and is actively circulating.
Reflected cross-site scripting in itsourcecode Online Medicine Delivery System 1.0 allows an authenticated remote attacker to inject and execute arbitrary JavaScript in a victim's browser by manipulating the `location` parameter of the `/index.php?q=orderdetails` endpoint. The attacker must induce a logged-in user to follow a crafted URL, at which point the unsanitized parameter value is reflected directly into the page response. A public proof-of-concept writeup on GitHub confirms exploitability; no KEV designation applies.
SQL injection in itsourcecode Online Medicine Delivery System 1.0 allows remote authenticated customers to manipulate the backend database via the `proid` parameter in the `addwishlist` function at `/customer/controller.php?action=addwish`. Any valid customer-level session can submit a crafted POST request to extract or modify database contents, including potentially customer PII, credentials, and order records. No KEV listing exists; CVSS 4.0 scores this 5.3 (Medium), reflecting the authentication barrier (PR:L) and limited per-component impact ratings.
SQL injection in itsourcecode Online Medicine Delivery System 1.0 allows remote attackers to manipulate the ID argument passed to Order::pupdate in the rider order-confirmation endpoint, enabling arbitrary database queries. The vulnerable parameter is processed without sanitization at /rider/orders/controller.php?action=edit&actions=confirm. A public proof-of-concept has been disclosed on GitHub; no KEV listing and no vendor patch are available at time of analysis.
SQL injection in itsourcecode Online Medicine Delivery System 1.0 exposes unauthenticated attackers to direct database manipulation via the Password Recovery Interface. The `Customer::find_phone` function in `/passwordrecover.php` accepts the `phonenumber` parameter without sanitization, allowing arbitrary SQL to be injected into backend queries. A public proof-of-concept exploit has been disclosed on GitHub; the vulnerability is not currently listed in CISA KEV, but the low complexity and zero-authentication requirement make opportunistic exploitation trivial.
SQL injection in itsourcecode Online Medicine Delivery System 1.0 allows unauthenticated remote attackers to manipulate backend database queries via the Category parameter in the Product Category Filter Interface at /index.php?q=product. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) confirms exploitation requires no privileges or user interaction, and a public proof-of-concept is available on GitHub (E:P), materially lowering the exploitation barrier. Impact is rated Low across confidentiality, integrity, and availability, suggesting constrained database access rather than full system compromise; no CISA KEV listing has been identified.
SQL injection in itsourcecode Online Medicine Delivery System 1.0 exposes the Product Search Interface to remote unauthenticated database manipulation via the Search argument handled by the `loadResultList` function at `/index.php?q=product`. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) confirms no authentication, no complexity, and no user interaction are required. Publicly available exploit code exists, documented on GitHub via VulDB submission, though this product has not been added to the CISA KEV catalog and no widespread exploitation has been confirmed.
SQL injection in itsourcecode Online Medicine Delivery System 1.0 exposes database contents to remote unauthenticated attackers through the `ID` parameter in the `loadResultList` function on the Product Detail Page. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) confirms exploitation requires no credentials, no special configuration, and no user interaction. A proof-of-concept exploit has been publicly disclosed on GitHub, materially lowering the bar for opportunistic attackers beyond what the moderate score alone implies.
SQL injection in itsourcecode Online Medicine Delivery System 1.0 allows unauthenticated remote attackers to manipulate the U_USERNAME parameter in the Customer::cusAuthentication function at /login.php, enabling authentication bypass and potential database extraction. A public proof-of-concept exploit is available on GitHub, confirmed by the CVSS 4.0 E:P (proof-of-concept) modifier and a linked exploit write-up. No patch has been identified; this is a small PHP application likely used in academic or learning environments with limited production exposure.
SQL injection in itsourcecode Online Medicine Delivery System 1.0 allows unauthenticated remote attackers to manipulate database queries through the emp_email parameter on the rider login endpoint. The Employee::employeeAuthentication function at /rider/login.php incorporates unsanitized email input directly into SQL queries, enabling authentication bypass and potential data extraction. A public proof-of-concept exploit has been released with no vendor patch available, making any deployed instance immediately exploitable by low-skill attackers.
SQL injection in itsourcecode Sales and Inventory System 1.0 allows remote authenticated attackers to manipulate database queries via the unsanitized `ID` parameter in `/pages/inv_edit.php`. Exploitation requires a valid application account (PR:L per CVSS 4.0 vector), and a public proof-of-concept is available on GitHub, lowering the exploitation bar for any user with credentials. The vulnerability is not currently listed in CISA KEV, and the CVSS 4.0 score of 5.3 (Medium) reflects the authentication prerequisite limiting broader impact.
SQL injection in itsourcecode Sales and Inventory System 1.0 exposes the /pages/sup_searchfrm.php endpoint to database manipulation via the unsanitized ID parameter. Low-privileged authenticated attackers can remotely exploit this classic CWE-89 flaw to read, modify, or potentially delete backend database records. A public proof-of-concept exploit has been disclosed via GitHub; no active exploitation or CISA KEV listing has been identified at time of analysis.
SQL injection in itsourcecode Sales and Inventory System 1.0 exposes the `/pages/cust_searchfrm.php` customer search endpoint to database manipulation via an unsanitized `ID` parameter. Authenticated remote attackers with low-privilege access can alter backend SQL queries to read, modify, or delete customer and inventory records. A public proof-of-concept exploit is available, lowering the bar for targeted attacks despite the absence of a CISA KEV listing.
SQL injection in itsourcecode Sales and Inventory System 1.0 allows authenticated remote attackers to manipulate database queries via the ID parameter in /pages/pro_edit.php. The vulnerability stems from unsanitized user input passed directly to SQL queries (CWE-89), enabling read and limited write access to the underlying database. A public proof-of-concept exploit has been disclosed on GitHub; no active exploitation by KEV standards is confirmed at this time.
SQL injection in itsourcecode Sales and Inventory System 1.0 exposes the `/pages/emp_searchfrm.php` endpoint to authenticated remote attackers who can manipulate database queries by injecting malicious SQL through the unsanitized `ID` parameter. Low-privileged users with valid credentials can read, modify, or corrupt application database contents. A public proof-of-concept exploit has been published via GitHub, making active exploitation a credible near-term risk for any internet-exposed instance.
SQL injection in itsourcecode Sales and Inventory System 1.0 allows low-privileged remote attackers to manipulate database queries via the unsanitized 'ID' parameter in /pages/emp_del.php. The CVSS 4.0 vector (PR:L, E:P) confirms exploitation requires a low-privileged authenticated session but no special configuration beyond basic access. A public proof-of-concept exploit has been released, raising the practical risk above what the moderate CVSS score alone suggests; however, this vulnerability is not currently listed in CISA KEV.
Unauthenticated remote access to the CRUD operation handler in itsourcecode Payroll System 1.0 allows any network-accessible attacker to create, read, update, or delete payroll records without credentials. The root cause is CWE-306 - the ajax.php endpoint processes the 'action' parameter and executes database operations without verifying caller identity. A public proof-of-concept exploit is available on GitHub, making exploitation trivially accessible to low-skill attackers against any internet-exposed deployment.
SQL injection in itsourcecode Sales and Inventory System 1.0 exposes the /pages/cust_del.php endpoint to database manipulation via an unsanitized ID parameter. Authenticated remote attackers holding low-privilege accounts can craft malicious SQL to read, modify, or delete customer and inventory records. A publicly available proof-of-concept exploit exists on GitHub, though the vulnerability is not listed in CISA KEV and carries a CVSS 4.0 score of 2.1 reflecting limited impact.
Unauthenticated SQL injection in itsourcecode Online Clinic Management System 1.0 exposes the Admin Login endpoint (success/login.php) to remote exploitation via the Username parameter. Any network-reachable attacker can manipulate SQL queries without credentials or user interaction, enabling authentication bypass and arbitrary database read/write. A public exploit POC has been disclosed on GitHub (microwaveabi/vul issue #63), substantially lowering the barrier to exploitation; no CISA KEV listing has been confirmed at time of analysis.
SQL injection in itsourcecode Real Estate Management System 1.0 exposes the search.php endpoint to remote unauthenticated database manipulation via the search, delivery_type, search_price, and property_type parameters. A public proof-of-concept exploit has been published on GitHub (issue #5, microwaveabi/vul), making this trivially accessible to low-skill attackers. CVSS 4.0 rates this 6.9 with low-level impact across confidentiality, integrity, and availability on the vulnerable system; no active exploitation by CISA KEV has been confirmed at time of analysis.
Unrestricted file upload in itsourcecode Payroll System 1.0 exposes the application to potential remote code execution through the save_settings function in admin_class.php, where the img parameter accepts files without validating type or content. The CVSS 4.0 vector indicates network-accessible exploitation with no privileges required (PR:N), meaning an attacker can submit a crafted multipart request to upload a PHP webshell directly. A public proof-of-concept exploit exists per the GitHub reference and VulDB reporting; this is not confirmed in CISA KEV, but the low barrier to exploitation combined with POC availability elevates real-world risk beyond the 6.9 score implies.
SQL injection in itsourcecode Library Management System 1.0 allows remote authenticated attackers to manipulate database queries via the ID parameter in editbooks.php. The vulnerability is classified as CWE-89 (Improper Neutralization of Special Elements used in an SQL Command) and affects the book editing function, potentially exposing or corrupting the underlying database. A public proof-of-concept exploit exists, raising the operational risk for any unpatched deployment.
SQL injection in itsourcecode Sales and Inventory System 1.0 exposes the customer edit endpoint to database manipulation by authenticated network attackers who can control the ID parameter in /pages/cust_edit.php. The CVSS 4.0 base score of 2.1 reflects limited impact across confidentiality, integrity, and availability, though a public proof-of-concept exploit exists on GitHub. No active exploitation by CISA KEV has been confirmed; the low score and limited deployment footprint constrain real-world priority despite the public exploit.
SQL injection in itsourcecode Sales and Inventory System 1.0 exposes the login endpoint to unauthenticated remote exploitation via the unsanitized `User` parameter in `/pages/processlogin.php`. Attackers can manipulate backend SQL queries without any prior authentication, enabling authentication bypass or database data extraction. A public proof-of-concept has been disclosed on GitHub, and the unauthenticated network attack vector (CVSS 4.0 PR:N, AV:N with E:P) makes any internet-exposed deployment immediately actionable - no public exploit identified as confirmed actively exploited (not in CISA KEV) at time of analysis.
SQL injection in itsourcecode Hospital Management System Project in PHP 1.0 allows low-privilege authenticated remote attackers to manipulate database queries via the `delid` parameter in `/viewservicetype.php`. Publicly available exploit code exists, reported and disclosed through VulDB. Successful exploitation yields partial confidentiality, integrity, and availability impact against the application database, with no lateral scope change to external systems confirmed.
SQL injection in itsourcecode Hospital Management System 1.0 allows authenticated remote attackers to manipulate the `delid` parameter in `/viewappointmentapproved.php` to execute arbitrary SQL commands against the backend database. A publicly available proof-of-concept exploit exists on GitHub, elevating the practical risk beyond the moderate CVSS score. No active CISA KEV listing has been confirmed, but the low attack complexity and network-accessible vector make opportunistic exploitation feasible against any exposed instance with valid credentials.
SQL injection in itsourcecode Hospital Management System 1.0 exposes the /viewbilling.php endpoint to database manipulation via the unsanitized delid parameter, exploitable by any low-privileged authenticated user over the network. A publicly available proof-of-concept has been disclosed on GitHub, lowering the barrier to exploitation significantly. Impact is bounded to partial confidentiality, integrity, and availability loss against the application database, with no confirmed scope change to adjacent systems.
SQL injection in itsourcecode Hospital Management System 1.0 allows low-privileged remote attackers to manipulate the `delid` parameter in `/viewdepartment.php`, enabling arbitrary SQL query execution against the backend database. The CVSS 4.0 score of 5.3 reflects limited but confirmed confidentiality, integrity, and availability impact. A proof-of-concept exploit is publicly available on GitHub, materially lowering the barrier to exploitation; however, no active exploitation has been confirmed via CISA KEV.
SQL injection in itsourcecode Hospital Management System 1.0 exposes patient and operational database contents to remote authenticated attackers via the `delid` parameter in `/viewroom.php`. The vulnerability carries a CVSS 4.0 score of 5.3 with a network attack vector and low complexity, and a public proof-of-concept exploit has been disclosed on GitHub. No CISA KEV listing exists, but the combination of a live exploit and sensitive healthcare data context elevates practical urgency beyond what the moderate score alone suggests.
SQL injection in itsourcecode Hospital Management System 1.0 exposes the /viewprescriptionrecord.php endpoint to authenticated remote attackers who can manipulate the `delid` parameter to execute arbitrary SQL commands against the underlying database. Publicly available exploit code exists on GitHub, confirmed by the CVSS 4.0 E:P modifier, though no CISA KEV listing indicates active widespread exploitation at time of analysis. Given the healthcare context, the combination of public exploit availability and sensitive patient data makes this a higher-priority remediation than the low CVSS 4.0 score of 2.1 alone suggests.
SQL injection in itsourcecode Hospital Management System 1.0 allows authenticated remote attackers to manipulate database queries via the `delid` parameter in /viewpaymentreport.php. A publicly available proof-of-concept exploit exists on GitHub, lowering the barrier to exploitation for any reachable instance. The CVSS 4.0 vector confirms low-privilege authentication is required (PR:L), and impact is rated partial across confidentiality, integrity, and availability - though SQL injection primitives can often be escalated beyond initial scoring to achieve broader data extraction.
SQL injection in itsourcecode Hospital Management System 1.0 exposes patient management functionality to low-privileged authenticated attackers who can manipulate the `delid` parameter in /viewpatient.php to alter or extract database records. Successful exploitation allows unauthorized read, modification, or deletion of patient data, carrying significant regulatory and privacy consequences in healthcare environments. A proof-of-concept exploit has been publicly disclosed via GitHub, materially lowering the bar for opportunistic attacks against unpatched instances; the vulnerability is not currently listed in the CISA KEV catalog.
SQL injection in itsourcecode Hospital Management System 1.0 exposes the `/vieworder.php` endpoint to database manipulation via the unvalidated `delid` parameter, exploitable by authenticated remote attackers. A publicly available exploit has been disclosed on GitHub, raising the realistic likelihood of opportunistic exploitation against unpatched deployments. No CISA KEV listing is present, but the healthcare-sector context and public POC make this a meaningful remediation priority for any operator running this software.
SQL injection in itsourcecode Hospital Management System 1.0 exposes the `/viewmedicine.php` endpoint to database manipulation via the unsanitized `delid` parameter, allowing remote low-privileged attackers to read, alter, or delete hospital database contents including patient and medication records. A public proof-of-concept exploit is confirmed available on GitHub, lowering the bar for exploitation significantly. No vendor-released patch exists, making manual code remediation or decommissioning the only available mitigations.
SQL injection in itsourcecode Hospital Management System 1.0 allows authenticated remote attackers to execute arbitrary SQL queries via the delid parameter in viewdoctortimings.php. A low-privileged user account is required to exploit the flaw, after which an attacker can extract, modify, or potentially delete sensitive data from the underlying database - including patient records and physician scheduling data. A public proof-of-concept exploit has been published on GitHub, materially lowering the barrier for opportunistic exploitation.
SQL injection in itsourcecode Hospital Management System 1.0 exposes authenticated attackers to database manipulation via the `delid` parameter in `/viewdoctorconsultancycharge.php`. The vulnerability is PHP-based, requires only low-privilege authentication, and carries a public proof-of-concept exploit documented on GitHub. No active exploitation has been confirmed via CISA KEV, and the CVSS 4.0 score of 2.1 reflects constrained impact, though the sensitivity of healthcare data elevates organizational risk beyond the raw score.
SQL injection in itsourcecode Hospital Management System 1.0 exposes the `/viewdoctor.php` endpoint to database manipulation via the unsanitized `delid` parameter, allowing authenticated remote attackers to read, modify, or potentially delete records including patient and physician data. No active exploitation is confirmed in the CISA KEV catalog, but a public proof-of-concept exploit exists on GitHub, materially lowering the skill threshold for attacks. The CVSS 4.0 score of 5.3 with PR:L reflects a constrained but realistic threat to healthcare deployments with lax access controls.
SQL injection in itsourcecode Hospital Management System 1.0 allows authenticated remote attackers to manipulate database queries via the `editid` parameter in /servicetype.php. The vulnerability is a classic CWE-89 unsanitized input passed directly to a SQL query, enabling read and write access to the underlying database. A public proof-of-concept exploit exists (GitHub issue linked in references), raising the practical risk above the low CVSS 4.0 base score of 2.1 - though exploitation is not confirmed in CISA KEV and real-world deployment of this product is limited.
SQL injection in itsourcecode Hospital Management System 1.0 exposes the `/prescription.php` endpoint to database manipulation via the unsanitized `editid` parameter, exploitable by remote authenticated users. A public proof-of-concept exploit is available on GitHub, lowering the skill barrier for exploitation. No CISA KEV listing is present; the CVSS 4.0 score of 2.1 reflects low impact across all dimensions, likely constrained by the database user's privileges or the limited data scope accessible through this endpoint.
SQL injection in itsourcecode Hospital Management System 1.0 allows remote authenticated attackers to manipulate database queries via the `editid` parameter in `/prescriptionorder.php`. The CVSS 4.0 vector (PR:L) confirms low-privilege authenticated access is required, limiting opportunistic exploitation but not targeted abuse by authorized users or compromised accounts. A publicly available proof-of-concept exploit exists on GitHub, lowering the barrier for exploitation. No patch has been identified; no public exploit identified at time of analysis in CISA KEV.
SQL injection in itsourcecode Hospital Management System 1.0 exposes the `/prescriptionorderreport.php` endpoint to database manipulation via the unsanitized `delid` parameter, exploitable by remote authenticated attackers. A publicly available proof-of-concept (GitHub ltranquility/submit_vuln issue #10) confirms exploitability; the CVSS 4.0 E:P metric corroborates this. No CISA KEV listing exists, and real-world impact is bounded by the low-privilege authentication prerequisite and the niche deployment footprint of this educational PHP codebase.
Cross-site scripting in itsourcecode Courier Management System 1.0 allows remote, unauthenticated attackers to inject arbitrary client-side scripts via the `page` parameter of /index.php, requiring only that a victim user follow a crafted link. A publicly available proof-of-concept exploit exists, lowering the bar for abuse. No patch has been identified at time of analysis; no CISA KEV listing, but the public PoC and low attack complexity make this actionable for defenders protecting user sessions.
SQL injection in itsourcecode Hospital Management System 1.0 exposes authenticated users' ability to manipulate backend database queries via the `delid` parameter in `/prescriptionrecord.php`. Any instance accessible over the network is at risk of unauthorized data extraction or record manipulation - a significant concern given the sensitive patient and prescription data typically stored in such systems. Public exploit code is available on GitHub, and no vendor-released patch has been identified at time of analysis; exploitation is not confirmed in CISA KEV but the low attack complexity and public POC reduce the barrier to abuse.