PHP
Monthly
Reflected XSS in Ilevia EVE X1 Server firmware (all versions through 4.7.18.0.eden) exposes unauthenticated network attackers to client-side code execution by injecting malicious payloads via the index.php endpoint on port 8080. A publicly available proof-of-concept exploit exists (ZSL-2025-5961), raising the practical risk above the 5.1 CVSS score alone would suggest. Critically, Ilevia has formally declined to issue a patch, leaving all deployed devices permanently unmitigated at the firmware level - the only vendor-sanctioned control is network segmentation.
SQL injection in itsourcecode Online Examination System 1.0 allows remote attackers to manipulate the Username parameter of /index.php to execute arbitrary SQL commands, compromising database confidentiality, integrity, and availability. Public exploit code exists, but the extremely low EPSS score (0.01%) indicates minimal real-world exploitation likelihood. No vendor patch is available.
SQL injection in Automated Voting System 1.0 allows high-privileged remote attackers to manipulate the Password parameter in /admin/update_user.php, potentially causing limited confidentiality and integrity impacts. The vulnerability requires admin-level privileges (PR:H) to exploit and has publicly available exploit code, but carries very low real-world risk due to EPSS of 0.01% and the high privilege requirement that limits practical attack surface.
SQL injection in Automated Voting System 1.0 allows authenticated remote attackers to manipulate the firstname parameter in /admin/add_candidate_modal.php, resulting in limited confidentiality, integrity, and availability impact. The vulnerability has a very low CVSS score (2.1) due to requirement for authenticated access and limited scope, but publicly available exploit code exists. Active exploitation is not confirmed in CISA KEV, and the EPSS score of 0.01% indicates minimal real-world exploitation probability despite public POC availability.
SQL injection in Campcodes Online Beauty Parlor Management System 1.0 allows high-privileged attackers to manipulate the searchdata parameter in /admin/search-appointment.php, enabling arbitrary database queries with limited confidentiality and integrity impact. The vulnerability requires administrative privileges to exploit and has a publicly disclosed proof-of-concept, though real-world exploitation risk is minimal given the EPSS score of 0.01% and the requirement for high-privilege access.
SQL injection in Campcodes Online Beauty Parlor Management System 1.0 allows authenticated high-privilege administrators to execute arbitrary SQL queries via the sername parameter in /admin/manage-services.php. The vulnerability requires high administrative privileges and has publicly available exploit code, though real-world impact is limited by its requirement for already-compromised admin accounts with no lateral movement or privilege escalation capability.
SQL injection in Best Salon Management System 1.0 allows remote attackers to manipulate the serv_id parameter in /booking.php, potentially gaining unauthorized access to the database or modifying data. A public exploit is available, though EPSS assigns a low exploitation probability (0.03%). No active exploitation is reported.
Unrestricted file upload in Oranbyte School Management System allows remote attackers to upload arbitrary files, including PHP shells, to the server via the /assets/uploadSllyabus.php endpoint. The vulnerability requires no authentication and has a publicly available exploit, but the low EPSS score (0.06%) suggests limited active exploitation. Attackers can achieve code execution if the uploaded file is accessible and executable.
Unrestricted file upload in Oranbyte's School Management System (PHP) allows remote unauthenticated attackers to upload arbitrary files via the /assets/uploadNotes.php endpoint without authentication or file-type validation. Because the upload target is a web-accessible PHP directory, a successful upload of a PHP webshell grants the attacker arbitrary server-side code execution. A public proof-of-concept exploit is available on GitHub, and no patched version has been identified given the product's rolling release model.
Unrestricted file upload in OranByte School Management System allows remote attackers to upload arbitrary files via the /assets/changeSllyabus.php endpoint without authentication. Successful exploitation can lead to code execution and full server compromise. Exploit code is publicly available, though no active exploitation is confirmed.
Unrestricted file upload in Oranbyte School Management System allows remote unauthenticated attackers to upload arbitrary files via /assets/createNotice.php, potentially leading to remote code execution. Public exploit code exists; no patch version identified as the product uses a rolling release model, and exploitation probability (EPSS 0.06%) is low despite public exploit availability.
Unrestricted file upload in ProjectsAndPrograms School Management System allows remote attackers to upload arbitrary files via the /assets/editNotes.php endpoint. An attacker can send a specially crafted request to execute malicious code on the server. A publicly available proof-of-concept exists, but no active exploitation has been confirmed.
SQL injection in the Inferno Online Clothing Store PHP application's login endpoint (/log.php) exposes the cemail and password parameters to unsanitized database queries, enabling unauthenticated remote attackers to extract database contents or bypass authentication entirely. The affected codebase is tracked to commit 827dd42bfbe380e8de76fdc67958c24cf1246208 of the yousaf530 GitHub project. A public proof-of-concept exploit exists per VulDB submission 665475, and the vendor did not respond to responsible disclosure outreach.
SQL injection in jimit105 Project-Online-Shopping-Website allows high-privilege remote attackers to manipulate the product_code parameter in /delete.php, enabling unauthorized query execution against the backend database. The vulnerability affects an unknown function of the Product Inventory Handler component and requires administrative credentials (PR:H). Exploit code has been published, though active exploitation remains unconfirmed by CISA KEV. EPSS score of 0.02% indicates minimal real-world exploitation probability despite CVE assignment.
SQL injection in SourceCodester Best Salon Management System 1.0 allows unauthenticated remote attackers to manipulate the ServiceId parameter in /panel/add_invoice.php, potentially accessing or modifying database contents. Public proof-of-concept code is available, though EPSS indicates low exploitation probability (0.03%) and no active exploitation is confirmed.
SQL injection in SourceCodester Best Salon Management System 1.0 allows remote attackers to compromise the application database via the editid parameter in /panel/edit-appointment.php. Publicly available exploit code exists, and the vulnerability can be triggered without authentication. EPSS score is 0.03%, indicating low exploitation probability despite the easy remote attack vector.
SQL injection in Simple Food Ordering System 1.0 allows authenticated remote attackers to execute arbitrary SQL queries via the cname parameter in /addcategory.php, compromising data confidentiality and integrity. The vulnerability has publicly available exploit code and is confirmed to have limited scope impact (affecting only data confidentiality, integrity, and availability of specific queries); however, EPSS score of 0.03% (8th percentile) suggests minimal real-world exploitation likelihood despite public availability of proof-of-concept code.
SQL injection in Simple Food Ordering System 1.0 allows authenticated remote attackers to execute arbitrary SQL queries via the Category parameter in /addproduct.php. The vulnerability has low practical risk despite public exploit availability due to CVSS 2.1 scoring and minimal confidentiality/integrity impact, though it requires prior authentication. EPSS exploitation probability is extremely low at 0.03% percentile, suggesting limited real-world attack interest despite public POC availability.
SQL injection in SourceCodester Simple Inventory System 1.0 via the uemail parameter in /user.php allows authenticated remote attackers to manipulate database queries with low impact. CVSS 2.1 reflects the low severity due to authentication requirement and limited scope, but a public exploit exists and EPSS percentile of 8% indicates below-average real-world exploitation likelihood despite POC availability.
SQL injection in SourceCodester Simple Inventory System 1.0 via the editBrandName parameter in /brand.php allows authenticated remote attackers to manipulate database queries with low confidentiality, integrity, and availability impact. The CVSS 2.1 score reflects limited scope (authenticated access required, low impact to CIA triad), but publicly available exploit code exists despite minimal real-world exploitation probability (EPSS 0.03%, 8th percentile).
SQL injection in code-projects E-Banking System 1.0 allows unauthenticated remote attackers to manipulate database queries via the username and password parameters in the registration form. Publicly available exploit code exists, but no active exploitation has been confirmed and the EPSS score is very low (0.03%), indicating limited real-world risk despite the ease of exploit.
SQL injection in code-projects Client Details System 1.0 allows authenticated remote attackers to manipulate the uid parameter in /admin/update-profile.php, enabling arbitrary database queries with limited confidentiality and integrity impact. Publicly available exploit code exists; however, the EPSS score of 0.04% and CVSS 2.1 severity indicate low real-world exploitation probability despite low barriers to attack (network-accessible, low complexity, no user interaction required).
SQL injection in projectworlds Online Food Ordering System 1.0 exposes the `/all-orders.php` endpoint to unauthenticated remote exploitation via the unsanitized `Status` parameter, enabling attackers to read, modify, or delete backend database contents. A proof-of-concept exploit has been publicly disclosed on GitHub, lowering the barrier for opportunistic exploitation. No vendor-released patch has been identified; the product is an academic/demo PHP application with very limited production deployment.
SQL injection in Simple Food Ordering System 1.0 allows authenticated remote attackers to execute arbitrary SQL queries via the Category parameter in /editproduct.php, with publicly available exploit code demonstrating the vulnerability. Despite a low CVSS score of 2.1, the vulnerability requires valid credentials and produces limited confidentiality impact, explaining the minimal EPSS exploitation probability of 0.03%.
SQL injection in SourceCodester Online Student Result System 1.0 allows unauthenticated remote attackers to inject SQL commands via the Username field on the /login.php page. Exploit code is publicly available, but EPSS score of 0.03% (8th percentile) indicates a low likelihood of widespread exploitation, and the product is not listed in CISA's Known Exploited Vulnerabilities catalog.
SQL injection in Simple Food Ordering System 1.0 allows authenticated remote attackers to execute arbitrary SQL queries via the cname parameter in editcategory.php, resulting in limited confidentiality and integrity impact. Publicly available exploit code exists; however, the EPSS score of 0.03% indicates minimal real-world exploitation probability despite remote network accessibility and low attack complexity.
SQL injection vulnerability in Campcodes Online Apartment Visitor Management System 1.0 allows remote unauthenticated attackers to perform low-impact database manipulation via the /forgot-password.php email parameter. Public exploit code is available, though no active exploitation has been reported (not listed in CISA KEV), and EPSS signals very low real-world exploitation
SQL injection in code-projects E-Commerce Website 1.0 allows authenticated remote attackers to manipulate the prod_id parameter in /pages/product_add_qty.php, potentially leading to unauthorized database access or data disclosure. The vulnerability has a CVSS score of 2.1 with low impact across confidentiality, integrity, and availability, but public exploit code exists and may lower the exploitation barrier despite the requirement for prior authentication.
SQL injection in code-projects E-Commerce Website 1.0 allows remote, unauthenticated attackers to manipulate database queries via the order_id parameter in /pages/delete_order_details.php, potentially leading to data theft or modification. A proof-of-concept exploit is publicly available, but no active exploitation has been confirmed by CISA KEV, and EPSS probability is very low (0.03%).
SQL injection in Campcodes Online Apartment Visitor Management System 1.0 allows high-privileged remote attackers to manipulate the mobilenumber parameter in /admin-profile.php, potentially leading to unauthorized database access or modification. The vulnerability requires administrative privileges to exploit and has limited confidentiality and integrity impact; public exploit code is available but real-world exploitation risk remains low due to EPSS score of 0.03% and the administrative access prerequisite.
SQL injection in CodeAstro Gym Management System 1.0 allows authenticated remote attackers to execute arbitrary SQL queries via the ID parameter in /admin/actions/delete-equipment.php. The vulnerability requires valid user credentials (PR:L) and has publicly available exploit code; however, the EPSS score of 0.03% and limited impact scope (VC:L/VI:L/VA:L) indicate low real-world exploitation probability despite technical exploitability.
SQL injection in CodeAstro Gym Management System 1.0 allows authenticated remote attackers to execute arbitrary SQL queries via the ID parameter in /admin/edit-equipmentform.php. The vulnerability requires valid user credentials (privilege level L) but no user interaction. Publicly available exploit code exists, though EPSS indicates very low real-world exploitation probability (0.03%, 8th percentile). Despite the public POC, the CVSS 2.1 score and minimal impact scope (VC:L/VI:L/VA:L with no scope change) suggest limited practical risk in most deployments.
SQL injection in CodeAstro Gym Management System 1.0 allows authenticated remote attackers to manipulate the ID parameter in /admin/actions/delete-member.php, enabling unauthorized database queries with limited confidentiality and integrity impact. The vulnerability requires valid administrative credentials and carries a CVSS score of 2.1 with low confidentiality and integrity impact but no availability risk. Publicly available exploit code exists, though real-world exploitation remains extremely limited based on a 0.03% EPSS score.
SQL injection in CodeAstro Gym Management System 1.0 allows authenticated remote attackers to manipulate the ename parameter in /admin/equipment-entry.php, enabling database query modification with low confidentiality, integrity, and availability impact. Publicly available exploit code exists but real-world risk is minimal due to low EPSS score (0.03%, 8th percentile), limited scope impact, and requirement for authenticated access despite the network attack vector.
Drupal Protected Pages module fails to implement rate limiting on authentication attempts, enabling unauthenticated attackers to conduct brute force attacks against password-protected content. Affected versions include Protected Pages 0.0.0 through 1.7.x and 7.x-1.0 through 7.x-2.4. The vulnerability permits attackers to enumerate valid credentials and bypass access controls through repeated login submissions without detection or throttling mechanisms. No public exploit code or active exploitation has been confirmed; EPSS scoring of 0.05% (15th percentile) indicates low real-world exploitation likelihood despite the moderate CVSS score of 6.5.
SQL injection in CodeAstro Gym Management System 1.0 allows authenticated remote attackers to manipulate the plan parameter in /admin/user-payment.php, resulting in limited data access. The vulnerability requires valid login credentials and has low real-world impact due to constrained scope (no server impact, no integrity violation), though publicly available exploit code exists and exploitation probability is minimal per EPSS analysis.
SQL injection in CodeAstro Gym Management System 1.0 via the fullname parameter in /customer/index.php allows authenticated remote attackers to execute arbitrary SQL queries with low confidentiality, integrity, and availability impact. Publicly available exploit code exists; however, the EPSS score of 0.03% (8th percentile) suggests minimal real-world exploitation despite public POC availability, likely due to authentication requirement and narrow deployment scope of this niche management application.
SQL injection in Project Monitoring System 1.0 allows remote attackers to manipulate the uid parameter on the /useredit.php endpoint, potentially exposing or modifying database contents. The exploit code is publicly available, but real-world risk is very low (EPSS 0.03%) and no active exploitation has been confirmed.
SQL injection in code-projects Online Job Search Engine 1.0 via the txtspecialization parameter in searchjob.php allows unauthenticated remote attackers to execute arbitrary SQL commands, leading to unauthorized data access or modification. A publicly disclosed exploit exists, but the affected product is a niche educational project with low real-world deployment, and no active exploitation has been reported.
SQL injection in Online Job Search Engine 1.0 allows remote attackers to manipulate the txtjob
SQL injection in Online Job Search Engine 1.0 allows remote attackers to manipulate database queries via the txtusername parameter in /registration.php. The vulnerability enables extraction, modification, or deletion of database contents and could bypass authentication. Exploit code is publicly available, though active exploitation has not been confirmed.
SQL injection in code-projects E-Commerce Website 1.0 allows remote attackers to manipulate database queries via the Search parameter in /pages/user_index_search.php. Exploit code is publicly available, but no active
SQL injection in projectworlds Gate Pass Management System 1.0 allows remote attackers to execute arbitrary SQL commands via the fullname parameter in /add-pass.php. Exploit code is publicly available; no active exploitation has been confirmed (not in CISA KEV). EPSS indicates a very low probability of widespread exploitation (0.03%), likely due to the product's limited deployment.
SQL injection in Simple Leave Manager 1.0’s /user.php via the ‘table’ parameter allows remote unauthenticated attackers to read, insert, or modify database content. Exploit code is publicly available but no active exploitation in the wild has been confirmed; EPSS score indicates very low exploitation probability.
SQL injection in Campcodes Online Learning Management System 1.0 allows remote unauthenticated attackers to manipulate database queries via the date_start parameter in /admin/calendar_of_events.php. Publicly available exploit code exists, increasing risk, though the EPSS score is low (0.03%) suggesting limited active exploitation. No patch has been identified at time of analysis.
Insecure inherited permissions in Portabilis i-Educar up to version 2.9.10 allow authenticated remote attackers to escalate privileges through the User Type Handler component in AccessLevelController.php, potentially gaining unauthorized access to protected functionality. The vulnerability requires valid login credentials (PR:L) but carries low confidentiality, integrity, and availability impact (VC:L/VI:L/VA:L). Publicly available exploit code exists, though EPSS score of 0.06% (19th percentile) suggests limited real-world exploitation despite public disclosure.
SQL injection vulnerability in Courier Management System 1.0 allows authenticated remote attackers to manipulate the Shippername parameter in /add-courier.php, enabling database queries to be executed with limited confidentiality and integrity impact. The publicly available exploit code and low CVSS score (2.1) reflect the requirement for valid authentication credentials, limiting real-world risk despite confirmed exploit availability.
SQL injection in code-projects Online Complaint Site 1.0 allows authenticated remote attackers to execute arbitrary SQL queries via the Category parameter in /admin/category.php, with publicly available exploit code. CVSS score of 2.1 reflects limited confidentiality impact and requirement for low-privilege authentication; EPSS of 0.03% indicates very low real-world exploitation probability despite public POC availability.
SQL injection in Online Complaint Site 1.0 allows authenticated remote attackers to manipulate the state parameter in /cms/admin/state.php, enabling data exfiltration or modification with limited scope. Publicly available exploit code exists; however, the CVSS 2.1 score and 0.03% EPSS percentile indicate low real-world exploitation risk despite the presence of proof-of-concept.
Authentication bypass in ChurchCRM up to version 5.18.0 allows unauthenticated remote attackers to access API endpoints due to a missing authentication check in the AuthMiddleware component. The publicly available exploit permits trivial remote access to sensitive member data, and a patch has been committed. While EPSS indicates low exploitation probability (0.11%) and no active exploitation is confirmed, the vulnerability presents a moderate risk for exposed ChurchCRM instances.
SQL injection in code-projects Online Complaint Site 1.0 allows authenticated remote attackers to manipulate the cid parameter in /cms/users/complaint-details.php, leading to limited data exposure. The vulnerability requires valid user authentication and has a publicly available proof-of-concept, but the EPSS score of 0.03% and CVSS impact metrics (VC:L/VI:L/VA:L) indicate low real-world exploitation probability despite public availability of exploit code.
SQL injection in code-projects Online Complaint Site 1.0 allows authenticated remote attackers to manipulate the cid parameter in /cms/users/register-complaint.php, resulting in limited confidentiality, integrity, and availability impact. Publicly available exploit code exists, though the EPSS score of 0.03% and requirement for prior authentication significantly constrain real-world exploitation risk compared to the CVSSv4 score of 2.1.
SQL injection in code-projects Online Complaint Site 1.0 allows authenticated remote attackers to manipulate the Username parameter in /cms/users/index.php and execute arbitrary SQL queries with limited impact to confidentiality, integrity, and availability. The CVSS 2.1 score and 0.03% EPSS percentile indicate low real-world risk despite public exploit availability, likely due to the authentication requirement (PR:L) and constrained impact scope.
SQL injection in code-projects E-Commerce Website 1.0 allows remote attackers to manipulate the supp_id parameter in /pages/supplier_update.php, potentially reading, modifying, or deleting database data. Exploit code is publicly available, but no active exploitation has been reported and EPSS indicates low exploitation probability (0.04%).
Stored cross-site scripting (XSS) in code-projects Voting System 1.0 allows remote attackers to inject malicious scripts via the Firstname, Lastname, or Platform parameters in /admin/voters_add.php, requiring user interaction to trigger payload execution. The vulnerability has a low CVSS score (2.1) due to UI requirement, but publicly available exploit code exists and the attack requires no authentication or special configuration.
SQL injection in E-Commerce Website 1.0 allows authenticated remote attackers to manipulate the supp_email parameter in /pages/supplier_add.php, achieving limited information disclosure and integrity violation. The vulnerability requires login credentials (PR:L in CVSS 4.0 vector) but can be exploited over the network with low complexity. Publicly available exploit code exists, though EPSS scoring (0.03%) suggests minimal real-world exploitation despite proof-of-concept availability.
SQL injection in E-Commerce Website 1.0 allows authenticated remote attackers to manipulate the prod_name parameter in /pages/product_add.php, leading to limited confidentiality, integrity, and availability impact. The vulnerability has low real-world risk despite public exploit availability due to low EPSS score (0.03%, 8th percentile) and requirement for prior authentication, suggesting exploitation is unlikely in typical deployments.
Unrestricted file upload in code-projects Voting System 1.0 allows authenticated high-privilege administrators to upload arbitrary files via the photo parameter in /admin/voters_add.php, potentially leading to remote code execution. The vulnerability requires high-privilege credentials (PR:H) to exploit and affects only administrative functions; publicly available exploit code exists but exploitation is limited to admin-authenticated attackers with access to the administrative interface.
SQL injection in PHPGurukul Beauty Parlour Management System 1.1 allows remote unauthenticated attackers to manipulate database queries via the searchdata parameter in /admin/search-invoices.php. Public exploit code is available, but EPSS score is very low (0.03%) and no active exploitation has been confirmed by CISA KEV. The vulnerability can lead to partial data exposure or modification.
SQL injection in Beauty Parlour Management System 1.1 via admin search-appointment.php allows remote attackers to extract or modify database contents. The vulnerability has a publicly available exploit but is not listed in CISA's Known Exploited Vulnerabilities catalog, and
SQL injection in PHPGurukul Beauty Parlour Management System 1.1 allows remote attackers to manipulate the 'delid' parameter in /admin/new-appointment.php, enabling arbitrary SQL command execution. Exploit code is publicly available, increasing potential risk, although no active exploitation has been confirmed by CISA KEV. Affected systems may suffer unauthorized data access, modification, or deletion.
SQL injection in PHPGurukul Beauty Parlour Management System 1.1 allows unauthenticated remote attackers to access or manipulate database data via the `delid` parameter in `/admin/manage-services.php`. A public proof-of-concept exploit is available, though EPSS indicates low exploitation likelihood (0.03%).
SQL injection in SourceCodester Farm Management System 1.0 allows authenticated remote attackers to manipulate the Type parameter in /uploadProduct.php, resulting in limited confidentiality, integrity, and availability impact. The vulnerability has a low CVSS score (2.1) and EPSS score (0.04%) despite public exploit availability, indicating minimal real-world exploitation risk due to the requirement for prior authentication and constrained impact scope.
SQL injection in SourceCodester Farm Management System 1.0 allows authenticated remote attackers to manipulate the Name parameter in /buyNow.php, enabling data exfiltration or modification with limited impact. The vulnerability is exploitable via network access without elevated privileges, publicly available exploit code exists, but real-world risk remains low due to authentication requirement and constrained scope (limited confidentiality, integrity, and availability impact per CVSS4.0 scoring).
Stored cross-site scripting (XSS) in SourceCodester Student Grades Management System 1.0 allows authenticated administrators with high privileges to inject malicious scripts via the first_name or last_name parameters in the Manage Users Page (/admin.php), which are then executed when viewed by other users. The vulnerability requires administrator authentication and user interaction (page view), limiting real-world impact despite public exploit availability. EPSS exploitation probability is extremely low (0.03%, 9th percentile), reflecting the restrictive access controls (PR:H) and user interaction requirement (UI:P) despite network-accessible delivery.
SQL injection in Blood Bank And Donation Management System allows authenticated remote attackers to manipulate the fullname parameter in /donate_blood.php, potentially leading to unauthorized data access or modification. The vulnerability affects all versions up to commit dc9e0393d826fbc85fad9755b5bc12cba1919df2, with publicly available exploit code and a low EPSS score of 0.03% despite CVSS 2.1, indicating exploitation is unlikely in practice due to authentication requirements and limited technical impact.
SQL injection in Simple E-Commerce Bookstore 1.0 allows remote attackers to inject SQL via the register_username parameter during user registration, potentially exposing or altering database contents. Exploit code is publicly available, but EPSS indicates a low 0.03% exploitation probability, and no active exploitation is reported.
SQL injection vulnerability in SourceCodester Wedding Reservation Management System 1.0 allows remote attackers to inject malicious SQL via the 'number' parameter in the insertReservation function of function.php, potentially compromising database confidentiality and integrity. Exploit code is publicly available, and the vulnerability has a CVSS 4.0 base score of 5.5 (Medium) with a low EPSS exploitation probability of 0.03%, indicating limited real-world risk while still enabling data theft or tampering.
SQL injection in SourceCodester Farm Management System 1.0 allows authenticated remote attackers to manipulate the pid parameter in /myCart.php, enabling database queries with limited confidentiality and integrity impact. Public exploit code exists, though the EPSS score of 0.03% suggests minimal real-world exploitation despite the availability of proof-of-concept.
SQL injection in the Wedding Reservation Management System 1.0 allows remote attackers to manipulate the 'User' parameter in /global.php to execute arbitrary SQL queries. A public proof-of-concept exploit exists, but no active exploitation has been confirmed in the wild. The low EPSS score (0.03%) suggests limited real-world exploitation likelihood despite the publicly available exploit.
SQL injection in Simple E-Commerce Bookstore 1.0 allows remote attackers to execute arbitrary SQL via the login_username parameter in /index.php. The vulnerability permits unauthorized access to the database, potentially leading to data exposure or authentication bypass. Public exploit code is available, but no active exploitation or vendor patch has been confirmed.
SQL injection in Advanced Library Management System 1.0 via the user_id parameter in view_member.php allows remote unauthenticated attackers to manipulate database queries, potentially reading, modifying, or deleting data. Exploit code is publicly available, but EPSS indicates very low exploitation likelihood and no active attacks have been reported.
SQL injection in SourceCodester Hotel and Lodge Management System 1.0 allows authenticated remote attackers to manipulate the Name parameter in /edit_booking.php, resulting in limited confidentiality and integrity impact. The vulnerability has public exploit code available but carries exceptionally low EPSS exploitation probability (0.03%, 8th percentile), suggesting minimal real-world threat despite network accessibility and low attack complexity.
Remote SQL injection in SourceCodester Hotel and Lodge Management System 1.0 allows attackers to manipulate database queries via the currsymbol parameter in /edit_curr.php. Exploit code is publicly available, but no active exploitation has been confirmed, and EPSS indicates a low exploitation probability (0.03%).
SQL injection in SourceCodester Hotel and Lodge Management System 1.0 allows unauthenticated remote attackers to manipulate the ID parameter of /edit_room.php, leading to unauthorized database access or modification. A proof-of-concept exploit is publicly available, though active exploitation is not confirmed. The vulnerability affects the default installation without any special configuration changes.
SQL injection in SourceCodester Hotel and Lodge Management System 1.0 allows remote attackers to manipulate database queries via the ID parameter in the /edit_customer.php endpoint. Exploit code is publicly available, though EPSS suggests low exploitation probability (0.03%). The vulnerability can lead to unauthorized data modification or exfiltration with low impact on confidentiality, integrity, and availability.
Unrestricted file upload in SourceCodester Hotel and Lodge Management System version 1.0 allows high-privileged authenticated attackers to upload arbitrary files via the website_image or back_login_image parameters in /manage_website.php, potentially enabling remote code execution. Publicly available exploit code exists, though the low CVSS score of 2.0 reflects the requirement for high-level administrative privileges to trigger the vulnerability.
SQL injection in SourceCodester Hotel and Lodge Management System 1.0 allows authenticated remote attackers to manipulate the Contact parameter in /pages/save_customer.php, enabling data exfiltration or modification with limited scope impact. Publicly available exploit code exists and the vulnerability carries a low CVSS score (2.1) due to requirement for prior authentication and limited technical impact, though the public exploit availability increases practical exploitation risk for unpatched instances.
SQL injection in the login page of Student Transcript Processing System 1.0 allows unauthenticated remote attackers to inject arbitrary SQL commands via the 'uname' parameter. A publicly available proof-of-concept exploit exists, but no evidence of active exploitation or inclusion in CISA KEV has been reported. EPSS predicts a very low exploitation probability (0.03%).
Reflected cross-site scripting (XSS) in itsourcecode Leave Management System 1.0 allows authenticated remote attackers to inject malicious scripts via the ID query parameter in /module/employee/controller.php?action=reset, requiring user interaction to execute. Public exploit code is available, though the vulnerability carries low real-world risk (EPSS 0.03%, CVSS 2.0) due to authentication and user-interaction requirements limiting broad exploitation.
SQL injection in itsourcecode Leave Management System 1.0 allows remote attackers to manipulate database queries via the employid parameter in /reset.php. A public proof-of-concept exploit exists, but the EPSS exploitation probability is very low (0.03%), suggesting limited real‑world exploitation despite ease of attack. No active exploitation (CISA KEV) has been reported, and the vendor has not issued a patch.
SQL injection in code-projects Web-Based Inventory and POS System 1.0 allows authenticated remote attackers to execute arbitrary SQL queries via the shopid parameter in /transaction.php, resulting in limited data confidentiality, integrity, and availability impact. The CVSS 2.1 score reflects low severity due to authentication requirement and constrained scope, but publicly available exploit code exists and the vulnerability has been publicly disclosed.
SQL injection in SourceCodester Simple E-Commerce Bookstore 1.0 allows remote attackers to manipulate the 'remove' parameter in /cart.php to execute arbitrary SQL commands. A publicly available proof-of-concept exploit exists, but the EPSS exploitation probability is very low (0.03%), indicating minimal real-world exploitation risk despite the remote attack vector. No active exploitation in the wild has been confirmed (CISA KEV not listed).
Unrestricted file upload in projectworlds Advanced Library Management System 1.0 allows authenticated remote attackers to upload arbitrary files via the image parameter in /edit_book.php, resulting in low-impact confidentiality, integrity, and availability violations. Public exploit code is available, though EPSS exploitation probability remains very low at 0.05%, suggesting limited real-world attack incentive despite authentication requirement bypass potential.
Stored cross-site scripting in projectworlds Advanced Library Management System 1.0 allows authenticated users with high privileges to inject malicious scripts via the firstname parameter in /edit_admin.php, affecting other users who view admin profiles. Exploitation requires high-privilege authentication and user interaction (UI:P), limiting real-world impact despite network accessibility. Public exploit code exists and EPSS exploitation probability is minimal at 0.03%, suggesting this remains a low-priority vulnerability despite CVE assignment.
Unauthenticated SQL injection in code-projects Web-Based Inventory and POS System 1.0 allows remote attackers to manipulate the emailid parameter on login.php, potentially leading to data theft, authentication bypass, or database corruption. Public exploit code is available, but EPSS indicates a low probability of exploitation (0.03%). No vendor patch has been identified.
SQL injection in Campcodes Advanced Online Voting System 1.0 exposes the admin login endpoint (/admin/login.php) to unauthenticated remote exploitation via a malicious Username parameter. A publicly available proof-of-concept exploit exists, lowering the barrier to exploitation significantly despite a low EPSS score. Successful exploitation can enable authentication bypass or arbitrary data extraction from the backend database, effectively compromising the integrity of the voting system's administrative interface.
Stored cross-site scripting (XSS) in code-projects Voting System 1.0 allows authenticated users with low privileges to inject malicious scripts via the Firstname, Lastname, or Platform parameters in /admin/candidates_edit.php, which execute in the context of other users' browsers when the edited candidate record is viewed. The vulnerability requires user interaction (UI:P) but affects integrity of data displayed to administrators. Exploit code is publicly available on GitHub, though EPSS score of 0.03% indicates limited real-world exploitation despite published POC.
SQL injection in code-projects E-Commerce Website 1.0 allows remote attackers to inject malicious SQL via the order_id parameter of /pages/edit_order_details.php. Exploit code is publicly available, though real-world exploitation probability is very low (EPSS 0.03%). No authentication is required, and the impact is limited to low confidentiality, integrity, and availability impacts.
Unrestricted file upload in Campcodes Advanced Online Voting System 1.0 allows authenticated attackers to upload arbitrary files via manipulation of the photo parameter in /admin/voters_add.php. The vulnerability requires valid login credentials (PR:L) but affects confidentiality, integrity, and availability with low severity. Publicly available exploit code exists; however, EPSS score of 0.04% indicates minimal real-world exploitation probability despite public POC availability.
Reflected XSS in Ilevia EVE X1 Server firmware (all versions through 4.7.18.0.eden) exposes unauthenticated network attackers to client-side code execution by injecting malicious payloads via the index.php endpoint on port 8080. A publicly available proof-of-concept exploit exists (ZSL-2025-5961), raising the practical risk above the 5.1 CVSS score alone would suggest. Critically, Ilevia has formally declined to issue a patch, leaving all deployed devices permanently unmitigated at the firmware level - the only vendor-sanctioned control is network segmentation.
SQL injection in itsourcecode Online Examination System 1.0 allows remote attackers to manipulate the Username parameter of /index.php to execute arbitrary SQL commands, compromising database confidentiality, integrity, and availability. Public exploit code exists, but the extremely low EPSS score (0.01%) indicates minimal real-world exploitation likelihood. No vendor patch is available.
SQL injection in Automated Voting System 1.0 allows high-privileged remote attackers to manipulate the Password parameter in /admin/update_user.php, potentially causing limited confidentiality and integrity impacts. The vulnerability requires admin-level privileges (PR:H) to exploit and has publicly available exploit code, but carries very low real-world risk due to EPSS of 0.01% and the high privilege requirement that limits practical attack surface.
SQL injection in Automated Voting System 1.0 allows authenticated remote attackers to manipulate the firstname parameter in /admin/add_candidate_modal.php, resulting in limited confidentiality, integrity, and availability impact. The vulnerability has a very low CVSS score (2.1) due to requirement for authenticated access and limited scope, but publicly available exploit code exists. Active exploitation is not confirmed in CISA KEV, and the EPSS score of 0.01% indicates minimal real-world exploitation probability despite public POC availability.
SQL injection in Campcodes Online Beauty Parlor Management System 1.0 allows high-privileged attackers to manipulate the searchdata parameter in /admin/search-appointment.php, enabling arbitrary database queries with limited confidentiality and integrity impact. The vulnerability requires administrative privileges to exploit and has a publicly disclosed proof-of-concept, though real-world exploitation risk is minimal given the EPSS score of 0.01% and the requirement for high-privilege access.
SQL injection in Campcodes Online Beauty Parlor Management System 1.0 allows authenticated high-privilege administrators to execute arbitrary SQL queries via the sername parameter in /admin/manage-services.php. The vulnerability requires high administrative privileges and has publicly available exploit code, though real-world impact is limited by its requirement for already-compromised admin accounts with no lateral movement or privilege escalation capability.
SQL injection in Best Salon Management System 1.0 allows remote attackers to manipulate the serv_id parameter in /booking.php, potentially gaining unauthorized access to the database or modifying data. A public exploit is available, though EPSS assigns a low exploitation probability (0.03%). No active exploitation is reported.
Unrestricted file upload in Oranbyte School Management System allows remote attackers to upload arbitrary files, including PHP shells, to the server via the /assets/uploadSllyabus.php endpoint. The vulnerability requires no authentication and has a publicly available exploit, but the low EPSS score (0.06%) suggests limited active exploitation. Attackers can achieve code execution if the uploaded file is accessible and executable.
Unrestricted file upload in Oranbyte's School Management System (PHP) allows remote unauthenticated attackers to upload arbitrary files via the /assets/uploadNotes.php endpoint without authentication or file-type validation. Because the upload target is a web-accessible PHP directory, a successful upload of a PHP webshell grants the attacker arbitrary server-side code execution. A public proof-of-concept exploit is available on GitHub, and no patched version has been identified given the product's rolling release model.
Unrestricted file upload in OranByte School Management System allows remote attackers to upload arbitrary files via the /assets/changeSllyabus.php endpoint without authentication. Successful exploitation can lead to code execution and full server compromise. Exploit code is publicly available, though no active exploitation is confirmed.
Unrestricted file upload in Oranbyte School Management System allows remote unauthenticated attackers to upload arbitrary files via /assets/createNotice.php, potentially leading to remote code execution. Public exploit code exists; no patch version identified as the product uses a rolling release model, and exploitation probability (EPSS 0.06%) is low despite public exploit availability.
Unrestricted file upload in ProjectsAndPrograms School Management System allows remote attackers to upload arbitrary files via the /assets/editNotes.php endpoint. An attacker can send a specially crafted request to execute malicious code on the server. A publicly available proof-of-concept exists, but no active exploitation has been confirmed.
SQL injection in the Inferno Online Clothing Store PHP application's login endpoint (/log.php) exposes the cemail and password parameters to unsanitized database queries, enabling unauthenticated remote attackers to extract database contents or bypass authentication entirely. The affected codebase is tracked to commit 827dd42bfbe380e8de76fdc67958c24cf1246208 of the yousaf530 GitHub project. A public proof-of-concept exploit exists per VulDB submission 665475, and the vendor did not respond to responsible disclosure outreach.
SQL injection in jimit105 Project-Online-Shopping-Website allows high-privilege remote attackers to manipulate the product_code parameter in /delete.php, enabling unauthorized query execution against the backend database. The vulnerability affects an unknown function of the Product Inventory Handler component and requires administrative credentials (PR:H). Exploit code has been published, though active exploitation remains unconfirmed by CISA KEV. EPSS score of 0.02% indicates minimal real-world exploitation probability despite CVE assignment.
SQL injection in SourceCodester Best Salon Management System 1.0 allows unauthenticated remote attackers to manipulate the ServiceId parameter in /panel/add_invoice.php, potentially accessing or modifying database contents. Public proof-of-concept code is available, though EPSS indicates low exploitation probability (0.03%) and no active exploitation is confirmed.
SQL injection in SourceCodester Best Salon Management System 1.0 allows remote attackers to compromise the application database via the editid parameter in /panel/edit-appointment.php. Publicly available exploit code exists, and the vulnerability can be triggered without authentication. EPSS score is 0.03%, indicating low exploitation probability despite the easy remote attack vector.
SQL injection in Simple Food Ordering System 1.0 allows authenticated remote attackers to execute arbitrary SQL queries via the cname parameter in /addcategory.php, compromising data confidentiality and integrity. The vulnerability has publicly available exploit code and is confirmed to have limited scope impact (affecting only data confidentiality, integrity, and availability of specific queries); however, EPSS score of 0.03% (8th percentile) suggests minimal real-world exploitation likelihood despite public availability of proof-of-concept code.
SQL injection in Simple Food Ordering System 1.0 allows authenticated remote attackers to execute arbitrary SQL queries via the Category parameter in /addproduct.php. The vulnerability has low practical risk despite public exploit availability due to CVSS 2.1 scoring and minimal confidentiality/integrity impact, though it requires prior authentication. EPSS exploitation probability is extremely low at 0.03% percentile, suggesting limited real-world attack interest despite public POC availability.
SQL injection in SourceCodester Simple Inventory System 1.0 via the uemail parameter in /user.php allows authenticated remote attackers to manipulate database queries with low impact. CVSS 2.1 reflects the low severity due to authentication requirement and limited scope, but a public exploit exists and EPSS percentile of 8% indicates below-average real-world exploitation likelihood despite POC availability.
SQL injection in SourceCodester Simple Inventory System 1.0 via the editBrandName parameter in /brand.php allows authenticated remote attackers to manipulate database queries with low confidentiality, integrity, and availability impact. The CVSS 2.1 score reflects limited scope (authenticated access required, low impact to CIA triad), but publicly available exploit code exists despite minimal real-world exploitation probability (EPSS 0.03%, 8th percentile).
SQL injection in code-projects E-Banking System 1.0 allows unauthenticated remote attackers to manipulate database queries via the username and password parameters in the registration form. Publicly available exploit code exists, but no active exploitation has been confirmed and the EPSS score is very low (0.03%), indicating limited real-world risk despite the ease of exploit.
SQL injection in code-projects Client Details System 1.0 allows authenticated remote attackers to manipulate the uid parameter in /admin/update-profile.php, enabling arbitrary database queries with limited confidentiality and integrity impact. Publicly available exploit code exists; however, the EPSS score of 0.04% and CVSS 2.1 severity indicate low real-world exploitation probability despite low barriers to attack (network-accessible, low complexity, no user interaction required).
SQL injection in projectworlds Online Food Ordering System 1.0 exposes the `/all-orders.php` endpoint to unauthenticated remote exploitation via the unsanitized `Status` parameter, enabling attackers to read, modify, or delete backend database contents. A proof-of-concept exploit has been publicly disclosed on GitHub, lowering the barrier for opportunistic exploitation. No vendor-released patch has been identified; the product is an academic/demo PHP application with very limited production deployment.
SQL injection in Simple Food Ordering System 1.0 allows authenticated remote attackers to execute arbitrary SQL queries via the Category parameter in /editproduct.php, with publicly available exploit code demonstrating the vulnerability. Despite a low CVSS score of 2.1, the vulnerability requires valid credentials and produces limited confidentiality impact, explaining the minimal EPSS exploitation probability of 0.03%.
SQL injection in SourceCodester Online Student Result System 1.0 allows unauthenticated remote attackers to inject SQL commands via the Username field on the /login.php page. Exploit code is publicly available, but EPSS score of 0.03% (8th percentile) indicates a low likelihood of widespread exploitation, and the product is not listed in CISA's Known Exploited Vulnerabilities catalog.
SQL injection in Simple Food Ordering System 1.0 allows authenticated remote attackers to execute arbitrary SQL queries via the cname parameter in editcategory.php, resulting in limited confidentiality and integrity impact. Publicly available exploit code exists; however, the EPSS score of 0.03% indicates minimal real-world exploitation probability despite remote network accessibility and low attack complexity.
SQL injection vulnerability in Campcodes Online Apartment Visitor Management System 1.0 allows remote unauthenticated attackers to perform low-impact database manipulation via the /forgot-password.php email parameter. Public exploit code is available, though no active exploitation has been reported (not listed in CISA KEV), and EPSS signals very low real-world exploitation
SQL injection in code-projects E-Commerce Website 1.0 allows authenticated remote attackers to manipulate the prod_id parameter in /pages/product_add_qty.php, potentially leading to unauthorized database access or data disclosure. The vulnerability has a CVSS score of 2.1 with low impact across confidentiality, integrity, and availability, but public exploit code exists and may lower the exploitation barrier despite the requirement for prior authentication.
SQL injection in code-projects E-Commerce Website 1.0 allows remote, unauthenticated attackers to manipulate database queries via the order_id parameter in /pages/delete_order_details.php, potentially leading to data theft or modification. A proof-of-concept exploit is publicly available, but no active exploitation has been confirmed by CISA KEV, and EPSS probability is very low (0.03%).
SQL injection in Campcodes Online Apartment Visitor Management System 1.0 allows high-privileged remote attackers to manipulate the mobilenumber parameter in /admin-profile.php, potentially leading to unauthorized database access or modification. The vulnerability requires administrative privileges to exploit and has limited confidentiality and integrity impact; public exploit code is available but real-world exploitation risk remains low due to EPSS score of 0.03% and the administrative access prerequisite.
SQL injection in CodeAstro Gym Management System 1.0 allows authenticated remote attackers to execute arbitrary SQL queries via the ID parameter in /admin/actions/delete-equipment.php. The vulnerability requires valid user credentials (PR:L) and has publicly available exploit code; however, the EPSS score of 0.03% and limited impact scope (VC:L/VI:L/VA:L) indicate low real-world exploitation probability despite technical exploitability.
SQL injection in CodeAstro Gym Management System 1.0 allows authenticated remote attackers to execute arbitrary SQL queries via the ID parameter in /admin/edit-equipmentform.php. The vulnerability requires valid user credentials (privilege level L) but no user interaction. Publicly available exploit code exists, though EPSS indicates very low real-world exploitation probability (0.03%, 8th percentile). Despite the public POC, the CVSS 2.1 score and minimal impact scope (VC:L/VI:L/VA:L with no scope change) suggest limited practical risk in most deployments.
SQL injection in CodeAstro Gym Management System 1.0 allows authenticated remote attackers to manipulate the ID parameter in /admin/actions/delete-member.php, enabling unauthorized database queries with limited confidentiality and integrity impact. The vulnerability requires valid administrative credentials and carries a CVSS score of 2.1 with low confidentiality and integrity impact but no availability risk. Publicly available exploit code exists, though real-world exploitation remains extremely limited based on a 0.03% EPSS score.
SQL injection in CodeAstro Gym Management System 1.0 allows authenticated remote attackers to manipulate the ename parameter in /admin/equipment-entry.php, enabling database query modification with low confidentiality, integrity, and availability impact. Publicly available exploit code exists but real-world risk is minimal due to low EPSS score (0.03%, 8th percentile), limited scope impact, and requirement for authenticated access despite the network attack vector.
Drupal Protected Pages module fails to implement rate limiting on authentication attempts, enabling unauthenticated attackers to conduct brute force attacks against password-protected content. Affected versions include Protected Pages 0.0.0 through 1.7.x and 7.x-1.0 through 7.x-2.4. The vulnerability permits attackers to enumerate valid credentials and bypass access controls through repeated login submissions without detection or throttling mechanisms. No public exploit code or active exploitation has been confirmed; EPSS scoring of 0.05% (15th percentile) indicates low real-world exploitation likelihood despite the moderate CVSS score of 6.5.
SQL injection in CodeAstro Gym Management System 1.0 allows authenticated remote attackers to manipulate the plan parameter in /admin/user-payment.php, resulting in limited data access. The vulnerability requires valid login credentials and has low real-world impact due to constrained scope (no server impact, no integrity violation), though publicly available exploit code exists and exploitation probability is minimal per EPSS analysis.
SQL injection in CodeAstro Gym Management System 1.0 via the fullname parameter in /customer/index.php allows authenticated remote attackers to execute arbitrary SQL queries with low confidentiality, integrity, and availability impact. Publicly available exploit code exists; however, the EPSS score of 0.03% (8th percentile) suggests minimal real-world exploitation despite public POC availability, likely due to authentication requirement and narrow deployment scope of this niche management application.
SQL injection in Project Monitoring System 1.0 allows remote attackers to manipulate the uid parameter on the /useredit.php endpoint, potentially exposing or modifying database contents. The exploit code is publicly available, but real-world risk is very low (EPSS 0.03%) and no active exploitation has been confirmed.
SQL injection in code-projects Online Job Search Engine 1.0 via the txtspecialization parameter in searchjob.php allows unauthenticated remote attackers to execute arbitrary SQL commands, leading to unauthorized data access or modification. A publicly disclosed exploit exists, but the affected product is a niche educational project with low real-world deployment, and no active exploitation has been reported.
SQL injection in Online Job Search Engine 1.0 allows remote attackers to manipulate the txtjob
SQL injection in Online Job Search Engine 1.0 allows remote attackers to manipulate database queries via the txtusername parameter in /registration.php. The vulnerability enables extraction, modification, or deletion of database contents and could bypass authentication. Exploit code is publicly available, though active exploitation has not been confirmed.
SQL injection in code-projects E-Commerce Website 1.0 allows remote attackers to manipulate database queries via the Search parameter in /pages/user_index_search.php. Exploit code is publicly available, but no active
SQL injection in projectworlds Gate Pass Management System 1.0 allows remote attackers to execute arbitrary SQL commands via the fullname parameter in /add-pass.php. Exploit code is publicly available; no active exploitation has been confirmed (not in CISA KEV). EPSS indicates a very low probability of widespread exploitation (0.03%), likely due to the product's limited deployment.
SQL injection in Simple Leave Manager 1.0’s /user.php via the ‘table’ parameter allows remote unauthenticated attackers to read, insert, or modify database content. Exploit code is publicly available but no active exploitation in the wild has been confirmed; EPSS score indicates very low exploitation probability.
SQL injection in Campcodes Online Learning Management System 1.0 allows remote unauthenticated attackers to manipulate database queries via the date_start parameter in /admin/calendar_of_events.php. Publicly available exploit code exists, increasing risk, though the EPSS score is low (0.03%) suggesting limited active exploitation. No patch has been identified at time of analysis.
Insecure inherited permissions in Portabilis i-Educar up to version 2.9.10 allow authenticated remote attackers to escalate privileges through the User Type Handler component in AccessLevelController.php, potentially gaining unauthorized access to protected functionality. The vulnerability requires valid login credentials (PR:L) but carries low confidentiality, integrity, and availability impact (VC:L/VI:L/VA:L). Publicly available exploit code exists, though EPSS score of 0.06% (19th percentile) suggests limited real-world exploitation despite public disclosure.
SQL injection vulnerability in Courier Management System 1.0 allows authenticated remote attackers to manipulate the Shippername parameter in /add-courier.php, enabling database queries to be executed with limited confidentiality and integrity impact. The publicly available exploit code and low CVSS score (2.1) reflect the requirement for valid authentication credentials, limiting real-world risk despite confirmed exploit availability.
SQL injection in code-projects Online Complaint Site 1.0 allows authenticated remote attackers to execute arbitrary SQL queries via the Category parameter in /admin/category.php, with publicly available exploit code. CVSS score of 2.1 reflects limited confidentiality impact and requirement for low-privilege authentication; EPSS of 0.03% indicates very low real-world exploitation probability despite public POC availability.
SQL injection in Online Complaint Site 1.0 allows authenticated remote attackers to manipulate the state parameter in /cms/admin/state.php, enabling data exfiltration or modification with limited scope. Publicly available exploit code exists; however, the CVSS 2.1 score and 0.03% EPSS percentile indicate low real-world exploitation risk despite the presence of proof-of-concept.
Authentication bypass in ChurchCRM up to version 5.18.0 allows unauthenticated remote attackers to access API endpoints due to a missing authentication check in the AuthMiddleware component. The publicly available exploit permits trivial remote access to sensitive member data, and a patch has been committed. While EPSS indicates low exploitation probability (0.11%) and no active exploitation is confirmed, the vulnerability presents a moderate risk for exposed ChurchCRM instances.
SQL injection in code-projects Online Complaint Site 1.0 allows authenticated remote attackers to manipulate the cid parameter in /cms/users/complaint-details.php, leading to limited data exposure. The vulnerability requires valid user authentication and has a publicly available proof-of-concept, but the EPSS score of 0.03% and CVSS impact metrics (VC:L/VI:L/VA:L) indicate low real-world exploitation probability despite public availability of exploit code.
SQL injection in code-projects Online Complaint Site 1.0 allows authenticated remote attackers to manipulate the cid parameter in /cms/users/register-complaint.php, resulting in limited confidentiality, integrity, and availability impact. Publicly available exploit code exists, though the EPSS score of 0.03% and requirement for prior authentication significantly constrain real-world exploitation risk compared to the CVSSv4 score of 2.1.
SQL injection in code-projects Online Complaint Site 1.0 allows authenticated remote attackers to manipulate the Username parameter in /cms/users/index.php and execute arbitrary SQL queries with limited impact to confidentiality, integrity, and availability. The CVSS 2.1 score and 0.03% EPSS percentile indicate low real-world risk despite public exploit availability, likely due to the authentication requirement (PR:L) and constrained impact scope.
SQL injection in code-projects E-Commerce Website 1.0 allows remote attackers to manipulate the supp_id parameter in /pages/supplier_update.php, potentially reading, modifying, or deleting database data. Exploit code is publicly available, but no active exploitation has been reported and EPSS indicates low exploitation probability (0.04%).
Stored cross-site scripting (XSS) in code-projects Voting System 1.0 allows remote attackers to inject malicious scripts via the Firstname, Lastname, or Platform parameters in /admin/voters_add.php, requiring user interaction to trigger payload execution. The vulnerability has a low CVSS score (2.1) due to UI requirement, but publicly available exploit code exists and the attack requires no authentication or special configuration.
SQL injection in E-Commerce Website 1.0 allows authenticated remote attackers to manipulate the supp_email parameter in /pages/supplier_add.php, achieving limited information disclosure and integrity violation. The vulnerability requires login credentials (PR:L in CVSS 4.0 vector) but can be exploited over the network with low complexity. Publicly available exploit code exists, though EPSS scoring (0.03%) suggests minimal real-world exploitation despite proof-of-concept availability.
SQL injection in E-Commerce Website 1.0 allows authenticated remote attackers to manipulate the prod_name parameter in /pages/product_add.php, leading to limited confidentiality, integrity, and availability impact. The vulnerability has low real-world risk despite public exploit availability due to low EPSS score (0.03%, 8th percentile) and requirement for prior authentication, suggesting exploitation is unlikely in typical deployments.
Unrestricted file upload in code-projects Voting System 1.0 allows authenticated high-privilege administrators to upload arbitrary files via the photo parameter in /admin/voters_add.php, potentially leading to remote code execution. The vulnerability requires high-privilege credentials (PR:H) to exploit and affects only administrative functions; publicly available exploit code exists but exploitation is limited to admin-authenticated attackers with access to the administrative interface.
SQL injection in PHPGurukul Beauty Parlour Management System 1.1 allows remote unauthenticated attackers to manipulate database queries via the searchdata parameter in /admin/search-invoices.php. Public exploit code is available, but EPSS score is very low (0.03%) and no active exploitation has been confirmed by CISA KEV. The vulnerability can lead to partial data exposure or modification.
SQL injection in Beauty Parlour Management System 1.1 via admin search-appointment.php allows remote attackers to extract or modify database contents. The vulnerability has a publicly available exploit but is not listed in CISA's Known Exploited Vulnerabilities catalog, and
SQL injection in PHPGurukul Beauty Parlour Management System 1.1 allows remote attackers to manipulate the 'delid' parameter in /admin/new-appointment.php, enabling arbitrary SQL command execution. Exploit code is publicly available, increasing potential risk, although no active exploitation has been confirmed by CISA KEV. Affected systems may suffer unauthorized data access, modification, or deletion.
SQL injection in PHPGurukul Beauty Parlour Management System 1.1 allows unauthenticated remote attackers to access or manipulate database data via the `delid` parameter in `/admin/manage-services.php`. A public proof-of-concept exploit is available, though EPSS indicates low exploitation likelihood (0.03%).
SQL injection in SourceCodester Farm Management System 1.0 allows authenticated remote attackers to manipulate the Type parameter in /uploadProduct.php, resulting in limited confidentiality, integrity, and availability impact. The vulnerability has a low CVSS score (2.1) and EPSS score (0.04%) despite public exploit availability, indicating minimal real-world exploitation risk due to the requirement for prior authentication and constrained impact scope.
SQL injection in SourceCodester Farm Management System 1.0 allows authenticated remote attackers to manipulate the Name parameter in /buyNow.php, enabling data exfiltration or modification with limited impact. The vulnerability is exploitable via network access without elevated privileges, publicly available exploit code exists, but real-world risk remains low due to authentication requirement and constrained scope (limited confidentiality, integrity, and availability impact per CVSS4.0 scoring).
Stored cross-site scripting (XSS) in SourceCodester Student Grades Management System 1.0 allows authenticated administrators with high privileges to inject malicious scripts via the first_name or last_name parameters in the Manage Users Page (/admin.php), which are then executed when viewed by other users. The vulnerability requires administrator authentication and user interaction (page view), limiting real-world impact despite public exploit availability. EPSS exploitation probability is extremely low (0.03%, 9th percentile), reflecting the restrictive access controls (PR:H) and user interaction requirement (UI:P) despite network-accessible delivery.
SQL injection in Blood Bank And Donation Management System allows authenticated remote attackers to manipulate the fullname parameter in /donate_blood.php, potentially leading to unauthorized data access or modification. The vulnerability affects all versions up to commit dc9e0393d826fbc85fad9755b5bc12cba1919df2, with publicly available exploit code and a low EPSS score of 0.03% despite CVSS 2.1, indicating exploitation is unlikely in practice due to authentication requirements and limited technical impact.
SQL injection in Simple E-Commerce Bookstore 1.0 allows remote attackers to inject SQL via the register_username parameter during user registration, potentially exposing or altering database contents. Exploit code is publicly available, but EPSS indicates a low 0.03% exploitation probability, and no active exploitation is reported.
SQL injection vulnerability in SourceCodester Wedding Reservation Management System 1.0 allows remote attackers to inject malicious SQL via the 'number' parameter in the insertReservation function of function.php, potentially compromising database confidentiality and integrity. Exploit code is publicly available, and the vulnerability has a CVSS 4.0 base score of 5.5 (Medium) with a low EPSS exploitation probability of 0.03%, indicating limited real-world risk while still enabling data theft or tampering.
SQL injection in SourceCodester Farm Management System 1.0 allows authenticated remote attackers to manipulate the pid parameter in /myCart.php, enabling database queries with limited confidentiality and integrity impact. Public exploit code exists, though the EPSS score of 0.03% suggests minimal real-world exploitation despite the availability of proof-of-concept.
SQL injection in the Wedding Reservation Management System 1.0 allows remote attackers to manipulate the 'User' parameter in /global.php to execute arbitrary SQL queries. A public proof-of-concept exploit exists, but no active exploitation has been confirmed in the wild. The low EPSS score (0.03%) suggests limited real-world exploitation likelihood despite the publicly available exploit.
SQL injection in Simple E-Commerce Bookstore 1.0 allows remote attackers to execute arbitrary SQL via the login_username parameter in /index.php. The vulnerability permits unauthorized access to the database, potentially leading to data exposure or authentication bypass. Public exploit code is available, but no active exploitation or vendor patch has been confirmed.
SQL injection in Advanced Library Management System 1.0 via the user_id parameter in view_member.php allows remote unauthenticated attackers to manipulate database queries, potentially reading, modifying, or deleting data. Exploit code is publicly available, but EPSS indicates very low exploitation likelihood and no active attacks have been reported.
SQL injection in SourceCodester Hotel and Lodge Management System 1.0 allows authenticated remote attackers to manipulate the Name parameter in /edit_booking.php, resulting in limited confidentiality and integrity impact. The vulnerability has public exploit code available but carries exceptionally low EPSS exploitation probability (0.03%, 8th percentile), suggesting minimal real-world threat despite network accessibility and low attack complexity.
Remote SQL injection in SourceCodester Hotel and Lodge Management System 1.0 allows attackers to manipulate database queries via the currsymbol parameter in /edit_curr.php. Exploit code is publicly available, but no active exploitation has been confirmed, and EPSS indicates a low exploitation probability (0.03%).
SQL injection in SourceCodester Hotel and Lodge Management System 1.0 allows unauthenticated remote attackers to manipulate the ID parameter of /edit_room.php, leading to unauthorized database access or modification. A proof-of-concept exploit is publicly available, though active exploitation is not confirmed. The vulnerability affects the default installation without any special configuration changes.
SQL injection in SourceCodester Hotel and Lodge Management System 1.0 allows remote attackers to manipulate database queries via the ID parameter in the /edit_customer.php endpoint. Exploit code is publicly available, though EPSS suggests low exploitation probability (0.03%). The vulnerability can lead to unauthorized data modification or exfiltration with low impact on confidentiality, integrity, and availability.
Unrestricted file upload in SourceCodester Hotel and Lodge Management System version 1.0 allows high-privileged authenticated attackers to upload arbitrary files via the website_image or back_login_image parameters in /manage_website.php, potentially enabling remote code execution. Publicly available exploit code exists, though the low CVSS score of 2.0 reflects the requirement for high-level administrative privileges to trigger the vulnerability.
SQL injection in SourceCodester Hotel and Lodge Management System 1.0 allows authenticated remote attackers to manipulate the Contact parameter in /pages/save_customer.php, enabling data exfiltration or modification with limited scope impact. Publicly available exploit code exists and the vulnerability carries a low CVSS score (2.1) due to requirement for prior authentication and limited technical impact, though the public exploit availability increases practical exploitation risk for unpatched instances.
SQL injection in the login page of Student Transcript Processing System 1.0 allows unauthenticated remote attackers to inject arbitrary SQL commands via the 'uname' parameter. A publicly available proof-of-concept exploit exists, but no evidence of active exploitation or inclusion in CISA KEV has been reported. EPSS predicts a very low exploitation probability (0.03%).
Reflected cross-site scripting (XSS) in itsourcecode Leave Management System 1.0 allows authenticated remote attackers to inject malicious scripts via the ID query parameter in /module/employee/controller.php?action=reset, requiring user interaction to execute. Public exploit code is available, though the vulnerability carries low real-world risk (EPSS 0.03%, CVSS 2.0) due to authentication and user-interaction requirements limiting broad exploitation.
SQL injection in itsourcecode Leave Management System 1.0 allows remote attackers to manipulate database queries via the employid parameter in /reset.php. A public proof-of-concept exploit exists, but the EPSS exploitation probability is very low (0.03%), suggesting limited real‑world exploitation despite ease of attack. No active exploitation (CISA KEV) has been reported, and the vendor has not issued a patch.
SQL injection in code-projects Web-Based Inventory and POS System 1.0 allows authenticated remote attackers to execute arbitrary SQL queries via the shopid parameter in /transaction.php, resulting in limited data confidentiality, integrity, and availability impact. The CVSS 2.1 score reflects low severity due to authentication requirement and constrained scope, but publicly available exploit code exists and the vulnerability has been publicly disclosed.
SQL injection in SourceCodester Simple E-Commerce Bookstore 1.0 allows remote attackers to manipulate the 'remove' parameter in /cart.php to execute arbitrary SQL commands. A publicly available proof-of-concept exploit exists, but the EPSS exploitation probability is very low (0.03%), indicating minimal real-world exploitation risk despite the remote attack vector. No active exploitation in the wild has been confirmed (CISA KEV not listed).
Unrestricted file upload in projectworlds Advanced Library Management System 1.0 allows authenticated remote attackers to upload arbitrary files via the image parameter in /edit_book.php, resulting in low-impact confidentiality, integrity, and availability violations. Public exploit code is available, though EPSS exploitation probability remains very low at 0.05%, suggesting limited real-world attack incentive despite authentication requirement bypass potential.
Stored cross-site scripting in projectworlds Advanced Library Management System 1.0 allows authenticated users with high privileges to inject malicious scripts via the firstname parameter in /edit_admin.php, affecting other users who view admin profiles. Exploitation requires high-privilege authentication and user interaction (UI:P), limiting real-world impact despite network accessibility. Public exploit code exists and EPSS exploitation probability is minimal at 0.03%, suggesting this remains a low-priority vulnerability despite CVE assignment.
Unauthenticated SQL injection in code-projects Web-Based Inventory and POS System 1.0 allows remote attackers to manipulate the emailid parameter on login.php, potentially leading to data theft, authentication bypass, or database corruption. Public exploit code is available, but EPSS indicates a low probability of exploitation (0.03%). No vendor patch has been identified.
SQL injection in Campcodes Advanced Online Voting System 1.0 exposes the admin login endpoint (/admin/login.php) to unauthenticated remote exploitation via a malicious Username parameter. A publicly available proof-of-concept exploit exists, lowering the barrier to exploitation significantly despite a low EPSS score. Successful exploitation can enable authentication bypass or arbitrary data extraction from the backend database, effectively compromising the integrity of the voting system's administrative interface.
Stored cross-site scripting (XSS) in code-projects Voting System 1.0 allows authenticated users with low privileges to inject malicious scripts via the Firstname, Lastname, or Platform parameters in /admin/candidates_edit.php, which execute in the context of other users' browsers when the edited candidate record is viewed. The vulnerability requires user interaction (UI:P) but affects integrity of data displayed to administrators. Exploit code is publicly available on GitHub, though EPSS score of 0.03% indicates limited real-world exploitation despite published POC.
SQL injection in code-projects E-Commerce Website 1.0 allows remote attackers to inject malicious SQL via the order_id parameter of /pages/edit_order_details.php. Exploit code is publicly available, though real-world exploitation probability is very low (EPSS 0.03%). No authentication is required, and the impact is limited to low confidentiality, integrity, and availability impacts.
Unrestricted file upload in Campcodes Advanced Online Voting System 1.0 allows authenticated attackers to upload arbitrary files via manipulation of the photo parameter in /admin/voters_add.php. The vulnerability requires valid login credentials (PR:L) but affects confidentiality, integrity, and availability with low severity. Publicly available exploit code exists; however, EPSS score of 0.04% indicates minimal real-world exploitation probability despite public POC availability.