Online Admission System
Monthly
SQL injection in itsourcecode Online Admission System 1.0 lets an authenticated low-privilege user inject arbitrary SQL through the ID parameter of the admin-area script /admin/sum.php, allowing data disclosure or manipulation. Publicly available exploit code exists (referenced via the VulDB submission and a public GitHub issue), although the CVE is not listed in CISA KEV, so there is no confirmed active exploitation. With a CVSS 4.0 base score of 5.3 (E:P, PR:L) and only low confidentiality/integrity/availability impact, this is a low-to-moderate risk that should not be treated as an urgent priority despite the public exploit.
Authenticated SQL injection in itsourcecode Online Admission System 1.0 lets a user who can reach the administrative interface inject arbitrary SQL through the 'sy' (school year) parameter of /admin/schoolyear.php, allowing read and modification of backend database contents. The attack is network-reachable but requires a valid session on the admin panel (the assessed vector is CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L), so unauthenticated internet attackers cannot reach the vulnerable endpoint without first obtaining or bypassing admin credentials. Publicly available exploit code exists (a proof-of-concept has been published via the vendor-adjacent GitHub issue linked from VulDB), but there is no confirmed active exploitation (CISA KEV) and the CWE-89 flaw is assessed as low priority. EPSS data was not provided in this intelligence set.
SQL injection in itsourcecode Online Admission System 1.0 allows an attacker who already holds a valid low-privilege session to manipulate the ID parameter of /admin/key.php and inject arbitrary SQL into the backend database. Exploitation is remote but gated behind authentication and access to the administrative endpoint, so it is a low-priority, low-real-risk issue per our assessment; the practical exposure is confined to insiders or attackers who have already obtained credentials. Publicly available exploit code exists, no public exploit has been confirmed as actively exploited, and no CISA KEV entry is associated with this CVE.
SQL injection in itsourcecode Online Admission System 1.0 lets an authenticated, low-privileged user manipulate the schedid argument on /new.php so that attacker-controlled input is interpreted as part of a backend SQL statement, giving limited confidentiality, integrity and availability impact with no user interaction required. The issue is remotely reachable and publicly available exploit code exists (a public GitHub issue demonstrates the vector), but CISA KEV does not list it and no vendor-released patch was identified in the available data, so this remains a moderate-severity, low-priority issue for most deployments. Exposure is bounded by the authentication prerequisite: an attacker needs a valid low-privileged session in the application, and from the reported vector the injection does not inherently yield full database or host control.
SQL injection in itsourcecode Online Admission System 1.0 lets remote attackers manipulate the ID argument processed by /admin/examinee.php and inject arbitrary SQL into the application's database queries, potentially exposing or altering stored admission records. Exploitation is assisted by publicly available exploit code (publicly available exploit code exists; VulDB submission and a public GitHub issue reference the flaw) and the CVSS 4.0 vector rates it 6.9 with E:P (proof-of-concept maturity), but there is no CISA KEV entry, so this is not confirmed actively exploited (CISA KEV). The practical limiting factor is reachability: the vulnerable script sits under /admin/, so while the provided CVSS 4.0 vector claims PR:N/UI:N, deployments that enforce an admin login would require valid or bypassed admin credentials, which our independent assessment reflects by modeling the flaw as PR:L with high confidentiality impact.
SQL injection in itsourcecode Online Admission System 1.0 allows remote attackers to read or alter database contents via the fname argument processed by register1.php. The flaw is tracked as CVE-2026-105181 (CWE-89) with a CVSS 4.0 base score of 5.3 and publicly available exploit code; there is no CISA KEV confirmation of active exploitation. The CVSS vector indicates PR:L, but because register1.php is a registration endpoint, the required privilege level is questionable and may in practice be unauthenticated - defenders should verify.
Unauthenticated SQL injection in itsourcecode Online Admission System 1.0 allows remote attackers to manipulate the 'User' login argument in /login1.php to execute arbitrary SQL queries against the underlying database. Publicly available exploit code exists, but the product is a niche educational PHP application with limited real-world deployment, and the assessed impact is Low (VC:L/VI:L/VA:L), indicating partial rather than full database compromise. Signals are mixed and lean toward low-to-moderate real-world risk despite the network-facing, unauthenticated nature of the flaw.
SourceCodester Online Admission System 1.0 contains a SQL injection vulnerability in the /programmes.php file's program parameter that allows unauthenticated remote attackers to execute arbitrary database queries. Public exploit code is available for this vulnerability, and no patch is currently available. The flaw enables attackers to potentially read, modify, or delete sensitive admission system data.
A vulnerability was identified in projectworlds Online Admission System 1.0. Rated medium severity (CVSS 6.9), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
A vulnerability has been found in projectworlds Online Admission System 1.0 and classified as critical. Rated medium severity (CVSS 6.9), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
A vulnerability, which was classified as critical, has been found in projectworlds Online Admission System 1.0.php. Rated medium severity (CVSS 6.9), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
A vulnerability was found in projectworlds Online Admission System 1.0. Rated medium severity (CVSS 6.9), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
SQL injection in projectworlds Online Admission System 1.0 exposes the `/adminac.php` endpoint to unauthenticated remote database manipulation via an unsanitized `id` parameter. Any internet-facing deployment of this PHP application allows an attacker to read, modify, or partially disrupt the underlying database without credentials. A public proof-of-concept exploit exists on GitHub, though EPSS exploitation probability sits at just 0.07% (22nd percentile), reflecting the product's extremely narrow deployment footprint rather than reduced exploitability of the flaw itself.
SQL injection in Projectworlds Online Admission System 1.0 allows authenticated remote attackers to manipulate the 'markof' parameter in /admin.php, leading to database queries with limited confidentiality and integrity impact. The vulnerability has publicly available exploit code, though actual exploitation appears limited given the low EPSS score (0.07%) and requirement for authenticated access, suggesting this affects only deployments where admin credentials are already compromised or accessible.
Projectworlds Online Admission System v1 is vulnerable to SQL Injection in index.php via the 'a_id' parameter. Rated critical severity (CVSS 9.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
A vulnerability was found in Project Worlds Online Admission System 1.0 and classified as critical.php. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
A vulnerability classified as problematic has been found in SourceCodester Online Admission System. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
A vulnerability, which was classified as problematic, was found in SourceCodester Online Admission System. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
A vulnerability was found in SourceCodester Online Admission System and classified as critical. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
A vulnerability has been found in SourceCodester Online Admission System and classified as critical. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
SQL injection in itsourcecode Online Admission System 1.0 lets an authenticated low-privilege user inject arbitrary SQL through the ID parameter of the admin-area script /admin/sum.php, allowing data disclosure or manipulation. Publicly available exploit code exists (referenced via the VulDB submission and a public GitHub issue), although the CVE is not listed in CISA KEV, so there is no confirmed active exploitation. With a CVSS 4.0 base score of 5.3 (E:P, PR:L) and only low confidentiality/integrity/availability impact, this is a low-to-moderate risk that should not be treated as an urgent priority despite the public exploit.
Authenticated SQL injection in itsourcecode Online Admission System 1.0 lets a user who can reach the administrative interface inject arbitrary SQL through the 'sy' (school year) parameter of /admin/schoolyear.php, allowing read and modification of backend database contents. The attack is network-reachable but requires a valid session on the admin panel (the assessed vector is CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L), so unauthenticated internet attackers cannot reach the vulnerable endpoint without first obtaining or bypassing admin credentials. Publicly available exploit code exists (a proof-of-concept has been published via the vendor-adjacent GitHub issue linked from VulDB), but there is no confirmed active exploitation (CISA KEV) and the CWE-89 flaw is assessed as low priority. EPSS data was not provided in this intelligence set.
SQL injection in itsourcecode Online Admission System 1.0 allows an attacker who already holds a valid low-privilege session to manipulate the ID parameter of /admin/key.php and inject arbitrary SQL into the backend database. Exploitation is remote but gated behind authentication and access to the administrative endpoint, so it is a low-priority, low-real-risk issue per our assessment; the practical exposure is confined to insiders or attackers who have already obtained credentials. Publicly available exploit code exists, no public exploit has been confirmed as actively exploited, and no CISA KEV entry is associated with this CVE.
SQL injection in itsourcecode Online Admission System 1.0 lets an authenticated, low-privileged user manipulate the schedid argument on /new.php so that attacker-controlled input is interpreted as part of a backend SQL statement, giving limited confidentiality, integrity and availability impact with no user interaction required. The issue is remotely reachable and publicly available exploit code exists (a public GitHub issue demonstrates the vector), but CISA KEV does not list it and no vendor-released patch was identified in the available data, so this remains a moderate-severity, low-priority issue for most deployments. Exposure is bounded by the authentication prerequisite: an attacker needs a valid low-privileged session in the application, and from the reported vector the injection does not inherently yield full database or host control.
SQL injection in itsourcecode Online Admission System 1.0 lets remote attackers manipulate the ID argument processed by /admin/examinee.php and inject arbitrary SQL into the application's database queries, potentially exposing or altering stored admission records. Exploitation is assisted by publicly available exploit code (publicly available exploit code exists; VulDB submission and a public GitHub issue reference the flaw) and the CVSS 4.0 vector rates it 6.9 with E:P (proof-of-concept maturity), but there is no CISA KEV entry, so this is not confirmed actively exploited (CISA KEV). The practical limiting factor is reachability: the vulnerable script sits under /admin/, so while the provided CVSS 4.0 vector claims PR:N/UI:N, deployments that enforce an admin login would require valid or bypassed admin credentials, which our independent assessment reflects by modeling the flaw as PR:L with high confidentiality impact.
SQL injection in itsourcecode Online Admission System 1.0 allows remote attackers to read or alter database contents via the fname argument processed by register1.php. The flaw is tracked as CVE-2026-105181 (CWE-89) with a CVSS 4.0 base score of 5.3 and publicly available exploit code; there is no CISA KEV confirmation of active exploitation. The CVSS vector indicates PR:L, but because register1.php is a registration endpoint, the required privilege level is questionable and may in practice be unauthenticated - defenders should verify.
Unauthenticated SQL injection in itsourcecode Online Admission System 1.0 allows remote attackers to manipulate the 'User' login argument in /login1.php to execute arbitrary SQL queries against the underlying database. Publicly available exploit code exists, but the product is a niche educational PHP application with limited real-world deployment, and the assessed impact is Low (VC:L/VI:L/VA:L), indicating partial rather than full database compromise. Signals are mixed and lean toward low-to-moderate real-world risk despite the network-facing, unauthenticated nature of the flaw.
SourceCodester Online Admission System 1.0 contains a SQL injection vulnerability in the /programmes.php file's program parameter that allows unauthenticated remote attackers to execute arbitrary database queries. Public exploit code is available for this vulnerability, and no patch is currently available. The flaw enables attackers to potentially read, modify, or delete sensitive admission system data.
A vulnerability was identified in projectworlds Online Admission System 1.0. Rated medium severity (CVSS 6.9), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
A vulnerability has been found in projectworlds Online Admission System 1.0 and classified as critical. Rated medium severity (CVSS 6.9), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
A vulnerability, which was classified as critical, has been found in projectworlds Online Admission System 1.0.php. Rated medium severity (CVSS 6.9), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
A vulnerability was found in projectworlds Online Admission System 1.0. Rated medium severity (CVSS 6.9), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
SQL injection in projectworlds Online Admission System 1.0 exposes the `/adminac.php` endpoint to unauthenticated remote database manipulation via an unsanitized `id` parameter. Any internet-facing deployment of this PHP application allows an attacker to read, modify, or partially disrupt the underlying database without credentials. A public proof-of-concept exploit exists on GitHub, though EPSS exploitation probability sits at just 0.07% (22nd percentile), reflecting the product's extremely narrow deployment footprint rather than reduced exploitability of the flaw itself.
SQL injection in Projectworlds Online Admission System 1.0 allows authenticated remote attackers to manipulate the 'markof' parameter in /admin.php, leading to database queries with limited confidentiality and integrity impact. The vulnerability has publicly available exploit code, though actual exploitation appears limited given the low EPSS score (0.07%) and requirement for authenticated access, suggesting this affects only deployments where admin credentials are already compromised or accessible.
Projectworlds Online Admission System v1 is vulnerable to SQL Injection in index.php via the 'a_id' parameter. Rated critical severity (CVSS 9.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
A vulnerability was found in Project Worlds Online Admission System 1.0 and classified as critical.php. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
A vulnerability classified as problematic has been found in SourceCodester Online Admission System. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
A vulnerability, which was classified as problematic, was found in SourceCodester Online Admission System. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
A vulnerability was found in SourceCodester Online Admission System and classified as critical. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
A vulnerability has been found in SourceCodester Online Admission System and classified as critical. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.