Sourcecodester
Monthly
SQL injection in SourceCodester Performance Indicator System 1.0 lets a remote attacker inject arbitrary SQL through the 'Contact' argument handled by /opils/staff/save_profile.php, potentially reading or altering data in the underlying database. The assessed impact is limited to Low across confidentiality, integrity and availability (CVSS 3.1 base 6.9, AV:N/AC:L/PR:N/UI:N), so exposure is partial rather than full application takeover. A public PoC reference exists in a GitHub issue; it is not verified as working exploit code, and no confirmed active exploitation is reported - the vuln.today decision label is 'this_month', indicating a genuine but non-emergency issue concentrated in a niche PHP application unlikely to be widely deployed in production.
SQL injection in SourceCodester Performance Indicator System 1.0 lets remote attackers alter SQL statements executed by /opils/staff/edit_dealer.php through the Contact parameter, potentially reading or tampering with dealer records and other data in the underlying database. The supplied scoring (CVSS 4.0 6.9, AV:N/AC:L/PR:N/UI:N, E:P) describes network-reachable exploitation without privileges or user interaction, although the 'staff' path segment suggests the page may normally sit behind a staff login, so true unauthenticated reachability in a default deployment is unconfirmed. A public PoC reference exists; it is not verified as working exploit code, and no confirmed active exploitation has been reported.
SQL injection in the Contact argument handled by /opils/staff/adddealer.php in SourceCodester Performance Indicator System 1.0 allows remote attackers to inject arbitrary SQL into the application's backend queries, with limited confidentiality, integrity and availability impact. The vendor scored it 6.9 under CVSS 4.0 (E:P), and it is a textbook low-to-moderate-priority web SQL injection rather than a top-tier emergency: the affected endpoint is a single, obscure page in a niche PHP product with very low real-world deployment, and authentication requirements are not confirmed from available data - the '/staff/' path suggests an administrative area that may require valid staff credentials even though the assessed vector carries PR:N. A public PoC reference exists; it is not verified as working exploit code, and there is no CISA KEV listing indicating active exploitation.
SQL injection in SourceCodester Performance Indicator System 1.0 lets a remote attacker who can authenticate to the admin area manipulate the ID argument of /opils/admin/deleteproduct.php and inject SQL, with low confidentiality, integrity, and availability impact under the assessed vector. This is a medium-severity, lower-priority issue rather than an urgent one: the priority label is this_month, and the supplied data contains no KEV confirmation. A public PoC reference exists at the linked GitHub issue, but it is not verified as working exploit code.
Missing authorization in the Admin Endpoint of SourceCodester Food Order Management System 1.0 allows remote attackers to invoke administrative functionality without valid admin credentials, with limited confidentiality, integrity, and availability impact. Publicly available exploit code exists, making the issue practical wherever the admin interface is network-exposed; no CISA KEV listing or confirmed active exploitation was provided at time of analysis. Because the vulnerable function is unnamed, defenders should confirm the affected admin route using the published PoC before tuning detections.
Stored cross-site scripting in SourceCodester Inventory System 1.0 allows an authenticated user to inject script through the Hsn_Code parameter of /api/transactions_handler.php?action=save_sale, which executes in another user's browser when the saved sale is viewed. Exploitation requires an authenticated account and victim interaction, limiting real-world urgency; no public exploit identified at time of analysis and no CISA KEV active-exploitation signal was provided. The assessed impact is a limited integrity effect in the victim's browser context, with no confidentiality or availability impact.
Stored cross-site scripting in SourceCodester Inventory System 1.0 is a genuine-but-low-priority issue: an authenticated low-privilege user can inject script through the Product_Name, Product_Code, or Vendor_Name parameters when saving a purchase via /api/transactions_handler.php?action=save_purchase, and the payload executes when another user views the affected purchase record. Publicly available exploit code exists, but there is no CISA KEV confirmation of active exploitation, and the product's limited deployment base reduces practical risk. The independent assessment scores this as CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N, requiring a valid account and victim interaction.
Cross-site scripting in SourceCodester Inventory System 1.0 allows an authenticated low-privileged user to inject script through the Product_Id or Product_Name argument in /api/products_handler.php?action=save, with execution occurring when another user later views the Product Management page. Exploitation requires valid credentials and victim interaction, publicly available exploit code exists, and the CVSS 4.0 score is 5.1; impact is limited to browser-session integrity with no confidentiality or availability loss.
SQL injection in SourceCodester Online Reviewer System 1.0 allows unauthenticated remote attackers to alter the SQL query behind the login form at login/index.php by supplying crafted input in the username or password field. Because the vulnerable endpoint is the pre-authentication login page, exploitation requires only network reachability to the application - no credentials, user interaction, or non-default configuration - and publicly available exploit code exists (a PoC is published at tracexlabs.com). The impact is moderate rather than catastrophic: CVSS 6.9 and an independent assessment of CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L indicate limited confidentiality, integrity, and availability effects, most likely authentication bypass and/or disclosure of data held in the application's backend database.
Unauthenticated SQL injection in SourceCodester Online Exam System 1.0 allows remote attackers to manipulate the username and pass parameters submitted to the pre-authentication login handler at adminpanel/admin/query/loginExe.php, potentially bypassing authentication and reading or altering backend database contents. The flaw is remotely reachable with low complexity, no privileges and no user interaction (CVSS 4.0: PR:N/UI:N/AC:L), and publicly available exploit code exists, though no confirmed active exploitation (CISA KEV) has been reported. EPSS and KEV data were not provided for this record.
Unauthenticated SQL injection in SourceCodester Art Gallery Management System 1.0 lets a remote attacker inject arbitrary SQL through the 'Name' argument handled by Action::save_user in admin/admin_class.php during account creation, allowing manipulation of the underlying database. The vulnerable code path is reachable without credentials or user interaction (CVSS 4.0 vector AV:N/AC:L/AT:N/PR:N/UI:N), and publicly available exploit code exists, including a pre-authentication admin-creation proof of concept, though this CVE is not listed in CISA KEV so active exploitation is not confirmed. Impact is rated low across confidentiality, integrity and availability (CVSS 6.9 base, assessed CVSS 3.1 6.9-equivalent), making this a moderate, opportunistic risk concentrated on internet-exposed instances of this niche PHP application.
Improper authorization in SourceCodester Simple Cafe Billing System 1.0 allows remote unauthenticated attackers to manipulate the 'Type' parameter in the save_user action of admin_class.php, enabling unauthorized modification of user roles within the User Management component. The vulnerability is network-exploitable (CVSS 4.0 base 5.5, CVSS 3.1 AV:N/AC:L/PR:N/UI:N) with no authentication or user interaction required, and publicly available exploit code exists; active exploitation has not been confirmed (not in CISA KEV). The application's narrow deployment footprint limits real-world exposure.
Unrestricted file upload in SourceCodester Library Management System 1.0 allows remote attackers to upload arbitrary files via the 'image' parameter to admin/add_admin.php, which uses move_uploaded_file without validating file type or extension, potentially leading to remote code execution if the uploaded file is web-accessible and the server executes PHP. Publicly available exploit code exists (though not confirmed as actively exploited in the wild), and the CVSS vector asserts unauthenticated access (PR:N), but the endpoint resides under an admin/ path, so exploitation may be limited to authenticated administrators in deployments that enforce access controls on that directory. Risk signals conflict and must be weighed carefully.
Unrestricted file upload in SourceCodester E-Learning System 1.0 lets remote attackers write arbitrary files, including executable PHP scripts, onto the server by manipulating the img argument in the save_users handler at /classes/Users.php?f=save. Successful exploitation depends on the endpoint being reachable and on the handler accepting the upload without file-type, extension, or content validation, followed by retrieving the uploaded file from a directory where PHP execution is permitted. Publicly available exploit code exists (referenced at tracexlabs.com as an 'elearning-preauth-rce' release) and the VulDB-sourced input warns it might be used; the CVSS 4.0 vector scores 6.9 with PR:N and UI:N, though our assessment notes that save_users is normally an administrative user-management action, so genuine pre-authentication reachability in a default install is not confirmed from the available data and should be verified.
Unrestricted file upload in SourceCodester Contact Tracing System 1.0 allows remote attackers to send a crafted file through the save handler at /classes/Users.php?f=save so that move_uploaded_file places attacker-controlled content into a web-accessible location, potentially yielding PHP code execution if the upload directory is executable. The provided CVSS 4.0 vector is CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P, indicating no privileges or user interaction in the assessed scenario, though the endpoint's Users save context warrants source-level confirmation of pre-auth reachability, and impact is limited to version 1.0. Publicly available exploit code exists, but the supplied data does not confirm CISA KEV active exploitation.
SQL injection in SourceCodester Performance Indicator System 1.0 lets a remote attacker manipulate the ID argument of /opils/staff/sales_history.php and inject arbitrary SQL into the application's database queries. Publicly available exploit code exists, and the provided CVSS 4.0 vector rates the issue 5.5 (AV:N/AC:L/PR:N/UI:N), though the /staff/ path indicates the endpoint may sit behind a staff-authenticated area, which would constrain real-world exploitation. Overall real-world priority is low because the product is rarely deployed and no CISA KEV or active-exploitation reporting is present in the supplied data.
SQL injection in the 'credit' parameter handled by /opils/staff/edit_credit.php in SourceCodester Performance Indicator System 1.0 lets remote attackers inject arbitrary SQL into backend database queries, with limited confidentiality, integrity, and availability impact as reflected in the 6.9 score and the assessed CVSS:3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L). Publicly available exploit code exists - a proof-of-concept write-up was published in a GitHub issue linked from the CVE record - but there is no confirmed active exploitation (CISA KEV) at time of analysis. The supplied CVSS 4.0 vector asserts PR:N (no privileges required), yet the endpoint sits under a /staff/ administrative path, so defenders should verify whether their deployment requires a staff session; the dominant real-world limiter remains deployment scarcity of this niche PHP application.
SQL injection in SourceCodester Performance Indicator System 1.0 allows remote attackers to manipulate the Category argument in /opils/staff/product.php and alter database queries, yielding low impact to confidentiality, integrity, and availability. Publicly available exploit code exists; no CISA KEV confirmation is present, and authentication requirements are not confirmed because the supplied vector marks PR:N while the independent assessment suggests the staff endpoint may require login. Real-world risk leans low because the product has a rare deployment footprint and the assessed impact is limited, despite the medium CVSS 4.0 base score of 6.9.
Authenticated remote attackers can exploit a SQL injection vulnerability in SourceCodester Performance Indicator System 1.0 by manipulating the 'pqty' parameter in the /opils/staff/edit_quantity.php endpoint. A public exploit has been disclosed, but the product's limited production use and the requirement for valid staff credentials (as indicated by the /staff/ path) make this a moderate, low-priority issue. No active exploitation has been confirmed.
SQL injection in SourceCodester Performance Indicator System 1.0 lets an attacker inject arbitrary SQL through the 'prodcategory' parameter handled by /opils/admin/addproduct.php, allowing manipulation of the underlying database contents and disclosure of stored data. The vulnerable endpoint sits under /admin/, so realistic exploitation most likely requires either a valid administrative session or an add-product page that lacks an adequate session check, which the independent assessment captures by scoring the issue PR:L rather than PR:N; the vendor-style vector instead lists PR:N, and that authentication requirement remains the key unconfirmed limiting factor. Publicly available exploit code exists for this issue, raising the likelihood of opportunistic scanning and abuse, though impact is bounded to low confidentiality, integrity and availability effects (CVSS 3.1 base 6.9, AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L) and no CISA KEV listing indicates confirmed active exploitation.
Stored cross-site scripting in SourceCodester Drug Recommendation System 1.0 lets unauthenticated remote attackers inject arbitrary script through the name or email argument handled by Admin/user_record.php, which then executes in the browser session of an administrator viewing the Admin Record Tables page. Publicly available exploit code exists, and no vendor-released patch has been identified, though CVSS 4.0 scoring of 5.3 with UI:P reflects that a privileged victim must passively render the tainted record before the payload fires. This is a genuinely low-priority issue despite being publicly disclosed, because impact is confined to script execution in the viewing user's browser (integrity-low) with no direct server compromise.
Cross-site scripting in SourceCodester Drug Recommendation System 1.0 allows remote, unauthenticated attackers to inject script payloads into the Student Registration workflow at Auth/add_student.php via the txtname, txtpassword, txtemail, txtphone and txtprevious_school fields. Publicly available exploit code exists (CVSS 4.0 E:P, CVSS 3.1 base 5.3) and the injected script executes only when a victim - plausibly an administrator reviewing submitted registration records - renders the tainted output in a browser, so impact is bounded to that victim's browser session within the application. Exploitation is not confirmed actively exploited (not in CISA KEV), and no vendor-released patch was identified at time of analysis, making this a low-to-moderate priority issue despite the public exploit.
SQL injection in SourceCodester Performance Indicator System 1.0 allows low-privilege authenticated attackers to manipulate the 'Category' parameter in /opils/admin/view_product.php, leading to limited confidentiality, integrity, and availability impact. Publicly available exploit code exists, and the CVSS vector requires PR:L, meaning attackers must first obtain valid low-privilege credentials to the admin interface. There is no evidence of confirmed active exploitation (CISA KEV), and the EPSS score is not available.
Stored cross-site scripting in SourceCodester Simple Student Information System 1.0 lets remote, unauthenticated attackers inject arbitrary JavaScript through the firstname and lastname fields processed by /register.php, which executes in the browser of any victim who later views the affected profile page. Publicly available exploit code exists, and the vendor has not released a patch; this is a low-to-moderate priority issue despite the remote attack vector because successful exploitation requires the victim to view the tainted page (UI:P) and impact is limited to client-side script execution with no server-side code execution, no confidentiality loss of stored data, and no availability impact.
Reflected cross-site scripting in SourceCodester Simple Student Information System 1.0 allows a low-privileged authenticated attacker to inject script through the 'searchbox' argument handled by the clean function in searchresults.php, which reflects the value into the results page without proper output encoding. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:P) shows the attacker needs low-level authentication to reach the search page, while successful execution requires a logged-in victim to view the attacker-influenced results page, so impact is confined to integrity within the victim's browser session (VC:N/VI:L/VA:N). Publicly available exploit code exists (referenced from a public GitHub issue), but there is no CISA KEV listing indicating confirmed active exploitation; combined with an assessed CVSS 3.1 of 5.1, this is a low-to-moderate priority issue rather than an urgent one.
Remote SQL injection in SourceCodester Simple Student Information System 1.0 via searchquery.php allows attackers to manipulate database queries and potentially read or alter application data, and the independent assessment rates this as a low-to-moderate real-world risk despite the network-reachable vector. The assessed CVSS v3.1 vector is AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L, while the CVSS v4.0 score is 6.9; the PR:N/UI:N values indicate unauthenticated exploitation with no user interaction, but the search endpoint may sit behind an application login in common deployments, so defenders should confirm whether searchquery.php is reachable pre-authentication. No public exploit was identified at time of analysis.
Cross-site request forgery in SourceCodester Drug Recommendation System 1.0 allows a remote attacker to make an authenticated victim's browser submit unintended state-changing requests, because the application's forms do not validate anti-CSRF tokens (CWE-352). The attacker needs no credentials of their own (CVSS:3.1 AV:N/AC:L/PR:N/UI:R/S:U), but success requires luring a logged-in victim to attacker-controlled content while their session is active, and the resulting impact is limited to low integrity with no confidentiality or availability loss. Publicly available exploit code exists (published in the hackliu/Vulnerability-Reports repository as VULN-06-CSRF-Missing-Tokens.md), but there is no evidence of confirmed active exploitation (not listed in CISA KEV), so this should be treated as a low-to-moderate real-world risk rather than a mass-exploitation event.
Cross-site scripting (XSS) in SourceCodester Drug Recommendation System 1.0 allows remote attackers to inject malicious scripts via the Admin/add_drug.php endpoint, which execute in an authenticated administrator's browser when the drug data is rendered. The attack requires user interaction and typically administrator-level access to the vulnerable form, and while publicly available exploit code exists, the overall risk is assessed as low-to-moderate due to these prerequisites and the limited browser-context impact.
Authentication bypass in SourceCodester Drug Recommendation System 1.0 lets remote, unauthenticated attackers impersonate arbitrary accounts by manipulating the user_id argument processed by the application's Auth Guard component. Per the CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N), no credentials, user interaction, or special configuration are required, so any network-reachable default installation is exposed; impact is bounded to LOW confidentiality, integrity, and availability (VC:L/VI:L/VA:L), limiting the attacker to unauthorized read/limited modification rather than full system compromise. Publicly available exploit code exists, including a detailed GitHub write-up of the broken access control issue, so exploitation is trivial for anyone who can reach the instance; the practical risk is tempered mainly by the product's very small real-world deployment footprint and the capped impact ratings.
SQL injection in SourceCodester Online Reviewer Management System 1.0 lets unauthenticated remote attackers execute arbitrary database queries through the 'Subject' GET parameter of /reviewer_0/admins/assessments/Subject/btn_functions.php when action=course. Per the CVSS v4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N, E:P) no credentials or user interaction are required against a default deployment, and publicly available exploit code exists (a proof-of-concept was published via the VulDB-linked GitHub issue); there is no confirmed active exploitation (CISA KEV). Impact is scoped to confidentiality, integrity and availability of the application's backend data at a low level, making this a moderate-severity, exposure-dependent risk rather than a broad remote-takeover event.
SQL injection in SourceCodester Online Reviewer Management System 1.0 allows an attacker to manipulate the SQL statement executed by the administrative assessment handler at /reviewer_0/admins/assessments/Subject/btn_functions.php?action=update by supplying crafted input in the 'Subject' argument, enabling unauthorized read and modification of data stored by the application. Publicly available exploit code exists (referenced through a GitHub proof-of-concept issue linked from the VulDB entry), but there is no CISA KEV listing confirming active exploitation, and no EPSS signal was provided. Impact is bounded rather than catastrophic: our independent assessment (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L) rates confidentiality, integrity and availability effects as low, and exploitation likely requires an authenticated admin/reviewer session to reach the /admins/ path despite the vendor's CVSS 4.0 vector claiming PR:N; the dominant real-world limiter is that this product is rarely run in production.
SQL injection in SourceCodester Online Reviewer Management System 1.0 lets remote attackers manipulate the Title argument in /reviewer_0/admins/assessments/activities/btn_functions.php?action=update to alter database queries, and publicly available exploit code exists. The supplied CVSS 4.0 vector is 6.9 with PR:N, but the independent assessment notes the '/admins/' path strongly implies administrative authentication; if that login gates the endpoint, exploitation requires authenticated admin access. Because the product is niche and real-world exposure depends on whether the admin area is reachable, this is assessed as a low-to-moderate priority despite the public exploit.
SQL injection in SourceCodester Drug Recommendation System 1.0 allows an authenticated administrator to inject arbitrary SQL through the txtname parameter on the admin-only Symptom Creation page (/Admin/add_symptom.php), corrupting or disclosing the underlying MySQL database. The flaw stems from improper use of mysqli_real_escape_string during query construction (CWE-89), and because the vulnerable endpoint sits behind the admin login (CVSS PR:H), an attacker must first hold administrator credentials; the assessed impact is limited confidentiality, integrity, and availability loss (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L). Publicly available exploit code exists and has been published, elevating practical risk for any deployment where admin credentials are weak, shared, or exposed, but this is not an unauthenticated or pre-auth remote compromise and should be treated as a comparatively low-priority finding.
SQL injection in the admin Drug Creation routine of SourceCodester Drug Recommendation System 1.0 lets an attacker with an existing administrator session read and tamper with the application's database by submitting crafted values through the txtname, cmdtype, txtusage, txtsideeffect, or cmdcontraindication parameters of /Admin/add_drug.php. The hard prerequisite is prior admin-level access (CVSS PR:H / the assessed CVSS:3.1 vector PR:H), so this is not exploitable by an anonymous remote user against a default installation, and impact is bounded to partial confidentiality, integrity and availability of the application database. Publicly available exploit code exists (the CVSS 4.0 vector carries E:P), although there is no indication of confirmed active exploitation (not in CISA KEV), and the issue should be treated as low-to-moderate priority relative to the SQL injection classification.
SQL injection in SourceCodester Drug Recommendation System 1.0 allows an authenticated administrator to manipulate the ID parameter of /Admin/edit_class.php and execute arbitrary SQL against the underlying database. The vulnerability is network-reachable with low complexity but requires high privileges (PR:H), limiting practical exploitation to malicious insiders or attackers who have already compromised an admin account; a publicly available exploit code exists, though no active exploitation has been confirmed. Given the niche product and the high-privilege precondition, this is a low-to-moderate priority issue that is unlikely to warrant emergency patching in most environments.
SQL injection in SourceCodester Drug Recommendation System 1.0 allows unauthenticated remote attackers to execute arbitrary SQL commands via the cmdschool parameter in /Auth/add_student.php. A public exploit has been released (publicly available exploit code exists; no evidence of active exploitation in CISA KEV) and the CVSS 4.0 base score is 6.9 (medium). The vulnerability is limited to low confidentiality, integrity, and availability impact, and real-world risk is low because the application is a niche academic/demo PHP project rarely exposed to the internet.
SQL injection in SourceCodester Online Reviewer Management System 1.0 allows a remote attacker, likely with a valid administrative session, to manipulate the Title parameter of /reviewer_0/admins/assessments/activities/btn_functions.php?action=activity and alter backend SQL queries, exposing or modifying limited application data. Publicly available exploit code exists, but CISA KEV does not list this as actively exploited, and the assessed CVSS 3.1 vector is PR:L, so successful exploitation is gated by access to the administrative module. This is a low-priority finding despite the medium headline score because the vulnerable endpoint is inside the admin path and the assessed impact is limited to low confidentiality, integrity, and availability effects.
Unauthenticated remote SQL injection in SourceCodester Car Driving School Management System 1.0 allows attackers to inject arbitrary SQL through the f=save_enrollment action of /classes/Master.php, potentially reading or altering data in the application's backend database. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) confirms the flaw is reachable without credentials or user interaction, though all vulnerable-system impacts are rated Low (VC:L/VI:L/VA:L) with no subsequent-system impact, yielding a moderate 6.9 rather than a critical score. Publicly available exploit code exists (referenced via a GitHub issue and the VulDB entry), and the affected version is 1.0 of this open-source PHP application; no public exploit identified at time of analysis beyond that released proof-of-concept, and the software has no CISA KEV listing.
SQL injection in the test_id parameter of exam-delete.php in SourceCodester Online Reviewer Management System 1.0 allows remote attackers to manipulate database queries, resulting in low-impact confidentiality, integrity, and availability loss (CVSS 4.0 6.9, medium). Publicly available exploit code exists and the attack is network-reachable with no user interaction; the published CVSS 4.0 vector rates it PR:N (unauthenticated), although our independent assessment notes the vulnerable script sits under the /admins/ administrative directory, implying a valid admin session is required in practice and that authentication requirements should be confirmed before the PR:N rating is trusted. The product is a small-footprint PHP application by SourceCodester, so real-world exposure is limited, and no CISA KEV listing indicates confirmed active exploitation.
SQL injection in SourceCodester Online Reviewer Management System 1.0 allows remote attackers to execute arbitrary SQL commands via the access_code parameter in /reviewer_0/admins/assessments/examproper/btn_functions.php. Per the CVSS vector, no authentication or user interaction is required, though the endpoint's location under an 'admins/' directory suggests it may be intended for authenticated administrators; a public exploit exists. No vendor-released patch has been identified at time of analysis, but the product is a niche educational PHP application with minimal enterprise deployment, so real-world risk is limited.
SQL injection in SourceCodester Online Reviewer Management System 1.0 allows remote attackers to manipulate the 'ID' request parameter of /reviewer_0/admins/assessments/examproper/questions-view.php, altering backend database queries with partial confidentiality, integrity and availability impact (CVSS 5.5; vendor-disclosed, VulDB-tracked). Publicly available exploit code exists - a proof-of-concept is published at https://github.com/Aszadom/cve/issues/1 - but there is no confirmed active exploitation (CISA KEV). The CVSS 4.0 vector records PR:N/UI:N (no authentication or user interaction required), although the '/admins/' segment of the vulnerable path suggests the questions-view function is part of the administrative interface and may in practice require an authenticated admin session, which would materially limit realistic exploitation. No vendor-released patch was identified at time of analysis.
Cross-site scripting in SourceCodester Smart Attendance System with QR Code Scanner 1.0 lets unauthenticated remote attackers inject arbitrary JavaScript through the full_name parameter of the Self-Registration page (student_signup.php), which then executes in the browser of any user or administrator who renders the affected name. Publicly available exploit code exists, but there is no confirmation of active exploitation. Impact is confined to the victim's browser context - session token theft, defacement, or redirection - with no server-side compromise, and the product is a niche hobby-grade PHP application with essentially no production deployment.
SQL injection in SourceCodester Online Reviewer Management System 1.0 allows attackers to manipulate the test_id parameter in /reviewer_0/admins/assessments/pretest/exam-delete.php, potentially reading or altering database contents. Publicly available exploit code exists, but practical exploitation requires reaching the administrative interface and likely a valid admin session despite the CVSS 4.0 vector indicating no privileges; the product's rare deployment footprint further limits real-world risk. This is a classic high-nominal/low-real-risk finding with limited confidentiality, integrity, and availability impact.
SQL injection in SourceCodester Online Reviewer Management System 1.0 lets an attacker who can reach the administrative assessment endpoint inject arbitrary SQL through the test_id parameter of /reviewer_0/admins/assessments/pretest/btn_functions.php?action=update, exposing and potentially altering stored review and assessment data. Publicly available exploit code exists (a proof-of-concept is published in the GitHub issue referenced by VulDB), and the vendor has not shipped a fixed version. Because the vulnerable path sits under /admins/, exploitation in practice most likely requires a valid administrative session, making reachability of the admin area and credential strength the primary limiting factors; the CVSS 4.0 score of 6.9 treats it as PR:N, our own assessment rates it CVSS:3.1 AV:N/AC:L/PR:L/UI:N with high confidentiality and low integrity impact.
SQL injection in SourceCodester Online Reviewer Management System 1.0 lets remote attackers inject arbitrary SQL through the difficulty_id parameter on the /reviewer_0/admins/assessments/databank/btn_functions.php endpoint when action=add, allowing partial read, modification, and disruption of the underlying database. The vendor-supplied CVSS 4.0 score is 6.9 with a vector claiming no privileges or user interaction required (PR:N/UI:N), but the vulnerable path sits inside the /admins/ administrative area, which in typical deployments is only reachable behind an authenticated administrator session - an independent assessment re-rates it as CVSS 3.1 AV:N/AC:L/PR:L/UI:N with low confidentiality, integrity, and availability impact. Publicly available exploit code exists and has been published alongside the disclosure, and there is no indication of confirmed active exploitation (no CISA KEV listing), while exploitation is further constrained by how few instances of this obscure PHP application are deployed and internet-reachable.
Cross-site scripting in SourceCodester Drug Recommendation System 1.0 allows unauthenticated remote attackers to inject arbitrary script through the 'full name' argument processed by /drug_recommender/index.php, with the payload executing in a victim's browser once the unsanitized value is rendered. Publicly available exploit code exists - a GitHub proof-of-concept README documents the injection path (profile XSS) - but there is no evidence of confirmed active exploitation, and the vendor/analyst scoring places this at 5.3 (CVSS 4.0 AV:N/AC:L/PR:N/UI:P, with the independent assessment using CVSS 3.1 AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N), reflecting integrity-limited impact with no confidentiality or availability loss. Overall this is a low-to-moderate risk issue: it requires victim interaction and an internet-reachable deployment of an obscure PHP application unlikely to be exposed in production.
Stored cross-site scripting in SourceCodester Drug Recommendation System 1.0 allows an authenticated user with access to the User Management add_user function to inject malicious script via the txtname, txtemail, or txtpassword parameters, which then executes in the browser of any user who views the affected page. Publicly available exploit code exists, though exploitation requires authentication (PR:L per the assessed CVSS 3.1 vector) and victim interaction (UI:P), and the target is a niche application with essentially no production deployment, making the real-world risk low. The assessed impact is limited to browser-context integrity (VI:L) with no confidentiality or availability effect.
Stored cross-site scripting in the admin symptom-management form (drug_recommender/Admin/add_symptom) of SourceCodester Drug Recommendation System 1.0 lets a user supply malicious content through the txtname argument that is later rendered in a browser without proper output encoding. The attack is remote but gated behind a high-privilege administrator account (CVSS PR:H) and requires a victim to view the affected admin page (UI:P/UI:R), which effectively restricts exploitation to the admin context - closer to self-XSS than a cross-privilege attack - and makes this a low real-world priority despite a public exploit. Publicly available exploit code exists (a GitHub PoC walkthrough linked from the CVE record); there is no indication of confirmed active exploitation (not in CISA KEV), and the independent assessment rates the overall real-world risk as low.
SQL injection in SourceCodester Drug Recommendation System 1.0 lets a remote attacker manipulate the SQL query behind /drug_recommender/Admin/edit_user.php by tampering with the ID parameter, enabling unauthorized read and modification of backend data. The vulnerability carries a publicly available exploit (proof-of-concept published on GitHub), so exploitation is trivial for anyone who can reach the endpoint, though no confirmed active exploitation (CISA KEV) has been reported. Scoring is split: the CNA/VulDB vector rates it CVSS 4.0 at 6.9 with PR:N, while our independent assessment scores it CVSS 3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N, because the /Admin/ path strongly suggests an authenticated administrative session is normally required, which markedly reduces the realistic attack surface and real-world priority despite the alarming-looking technical impact.
SQL injection in SourceCodester Drug Recommendation System 1.0 allows remote attackers to manipulate the ID parameter in /Admin/edit_symptom.php, causing the application to execute attacker-influenced SQL against its backend database and potentially read or alter symptom records. Publicly available exploit code exists, but there is no CISA KEV confirmation of active exploitation; independent assessment treats this as a lower real-world priority because the /Admin/ endpoint is normally protected by an admin login and the product's deployment base is very small. The vendor's CVSS 4.0 vector rates it 6.9 with PR:N, while the independent CVSS 3.1 assessment requires admin-level authentication (PR:L) and assigns high confidentiality and integrity impact with limited availability impact.
SQL injection in SourceCodester Online Reviewer Management System 1.0 allows remote attackers to manipulate the ID parameter of /reviewer_0/admins/assessments/subject/btn_functions.php?action=remove and execute attacker-controlled SQL against the application's backend database, potentially exposing or altering stored records. Publicly available exploit code exists (a public proof-of-concept referenced from VulDB and a public GitHub issue), which lowers the skill barrier, but there is no confirmed actively exploited (CISA KEV) status and no EPSS estimate was supplied. Impact is bounded rather than catastrophic: the vendor vector rates confidentiality, integrity and availability impact as low (VC:L/VI:L/VA:L, E:P), and our independent assessment scores it CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L - a classic low-real-priority SQL injection for a niche PHP project despite a mid-range base score, with the main open question being whether the administrative script is actually reachable without a valid admin session.
SQL injection in SourceCodester Online Reviewer Management System 1.0 lets remote attackers inject arbitrary SQL through the courseID argument handled by /reviewer_0/admins/assessments/course/btn_functions.php, giving read access to backend data and limited ability to modify or disrupt it (integrity and availability impact rated Low, confidentiality High in our independent assessment). Publicly available exploit code exists - a proof-of-concept has been published via the GitHub issue referenced by VulDB - and the vendor-supplied CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) claims unauthenticated, no-interaction exploitation. Despite the 6.9 score, real-world risk is bounded: exploitation requires that the script be reachable, and because it lives under an /admins/ directory, practical unauthenticated access depends on the deployment lacking a session or authorization guard on that path, a common but unverified trait of SourceCodester projects. No CISA KEV entry or confirmed in-the-wild exploitation was identified at time of analysis.
SQL injection in SourceCodester Online Reviewer Management System 1.0 allows remote attackers to alter SQL queries through the Course parameter of /reviewer_0/admins/assessments/course/btn_functions.php, enabling data disclosure along with limited integrity and availability impact. Publicly available exploit code exists via a GitHub PoC issue, but there is no evidence of active exploitation, and the feed CVSS 4.0 score of 6.9 overstates practical risk. The independent assessment rates this as LOW priority because the affected product is a niche educational PHP application with a single known version, negligible internet-facing deployment, and an unverified access-control prerequisite, consistent with an assessed CVSS 3.1 vector of AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:L.
SQL injection in the login handler of SourceCodester Inventory and Monitoring System 1.0 lets remote unauthenticated attackers inject arbitrary SQL through the Username argument of /index.php, potentially reading and altering database contents. The flaw requires no credentials, no user interaction, and no non-default configuration, and publicly available exploit code exists; there is no indication of confirmed active exploitation (no CISA KEV listing). Note the scoring split: the CNA's CVSS 4.0 vector rates 5.5 with limited (VC:L/VI:L/VA:L) impact, while our independent assessment treats confidentiality and integrity as High (CVSS 3.1 9.8); real-world risk is in practice bounded less by any technical prerequisite than by the product's small deployment footprint.
SQL injection in SourceCodester Inventory and Monitoring System 1.0 allows remote attackers to manipulate database queries through the difficulty_id parameter of the /admins/assessments/databank/btn_functions.php?action=add endpoint. Publicly available exploit code exists, and the vendor-supplied CVSS 4.0 score of 6.9 treats the flaw as remotely reachable without authentication (PR:N); however, our independent assessment rates it CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N because the /admins/ path implies an administrative function that typically sits behind a login, so a valid staff or admin session may be required, which materially lowers realistic risk. Impact is limited to low-confidentiality and low-integrity effects on the backend database; there is no evidence of active exploitation, and the affected product is a niche PHP application with a very small deployment footprint, making broad opportunistic targeting unlikely.
Cross-site scripting (XSS) in the Category Update function (/admin/update_category.php) of SourceCodester Online Food Ordering System 1.0 allows an authenticated administrator to inject script payloads that execute in the browser when the manipulated category page is rendered, requiring user interaction. Publicly available exploit code exists, but the high-privilege prerequisite (admin access) and limited integrity-only impact make this a low-severity admin self-XSS scenario; no active exploitation (CISA KEV) is indicated.
Unrestricted file upload in SourceCodester Online Faculty Clearance System 1.0 allows authenticated remote attackers to upload arbitrary files - including PHP webshells - via the profile picture upload endpoint at production/edit_picture.php, leading to remote code execution on the host server. The vulnerability stems from PHP's move_uploaded_file() being called without validating file type or extension. A public proof-of-concept exploit exists (GitHub issue linked from VulDB). No KEV listing; EPSS data not provided in source intelligence.
Unauthenticated remote SQL injection in SourceCodester Online Faculty Clearance System 1.0 allows an attacker to inject arbitrary SQL through the ID argument of /delete_faculty1.php, exposing or destroying records in the underlying database. The CVSS 4.0 vector rates network-reachable, low-complexity, no-privilege, no-interaction exploitation with low confidentiality, integrity and availability impact (base 5.5), and publicly available exploit code exists, so unpatched internet-facing instances are immediately at risk. No CISA KEV entry or EPSS score was supplied, so there is no confirmed evidence of active exploitation in the wild at time of analysis.
Unauthenticated SQL injection in SourceCodester Online Faculty Clearance System 1.0 allows remote attackers to inject arbitrary SQL through the ID argument of /delete_requirement.php, giving them read and write access to the application's clearance records. Publicly available exploit code exists (GitHub OnlyCMJB/cve issue 2), and the flaw is tracked by VulDB and ENISA EUVD, but CISA KEV does not list it as actively exploited. Because this is a demo-grade PHP application distributed as downloadable source with no vendor patch channel identified, exposure is concentrated among institutions that deployed it as-is on an internet-facing web server.
Unrestricted file upload in SourceCodester College Notes Gallery Management System 1.0 allows an authenticated remote attacker to upload arbitrary file types through the profile image parameter at /dashboard/userprofile.php. Because the application is PHP-based, this flaw (CWE-434) creates a realistic path to remote code execution if a PHP webshell is uploaded to a web-accessible directory. A public proof-of-concept exploit exists on GitHub, lowering the bar for exploitation. No active exploitation (CISA KEV) has been reported, and the affected product is a small educational PHP application with limited production footprint.
SQL injection in SourceCodester/katojkalemba Online Food Ordering System 1.0 allows remote unauthenticated attackers to manipulate the `id` parameter in `/web/order.php` to inject arbitrary SQL, achieving partial read and write access to the underlying database. The CVSS 4.0 vector carries an E:P modifier confirming public exploit code is available, lowering the barrier to exploitation significantly. No vendor patch has been identified at time of analysis, and no CISA KEV listing exists.
SQL injection in SourceCodester Online Food Ordering System 1.0 allows any unauthenticated remote attacker to manipulate the database through the unsanitized `ID` parameter of `/web/category-foods.php`. A public exploit has been released, enabling database extraction, record modification, or deletion without any authentication. No vendor patch has been identified at time of analysis.
Unauthenticated SQL injection in the login handler (/College/login.php) of SourceCodester College Notes Gallery Management System 1.0 allows remote attackers to inject arbitrary SQL through the 'User' parameter. Publicly available exploit code exists (disclosed via a GitHub issue referenced by VulDB), and successful abuse can bypass authentication and expose or corrupt the backend database. The CVSS 4.0 base score is 5.5 with the E:P threat metric, reflecting limited but real confidentiality, integrity, and availability impact.
Authorization bypass via Insecure Direct Object Reference (IDOR) in SourceCodester Inventory Management System 1.0 allows authenticated remote attackers to access arbitrary invoice records by manipulating the ID parameter in invoice.php. The flaw is classified as CWE-639 (Authorization Bypass Through User-Controlled Key), meaning the application trusts a user-supplied identifier to gate access without server-side ownership verification. A publicly available proof-of-concept exploit exists on GitHub; no public KEV or active exploitation has been confirmed at the time of analysis.
Stored cross-site scripting in SourceCodester Inventory Management System 1.0 allows an authenticated remote attacker to inject malicious scripts via the Product_Name parameter handled by /api/products_handler.php in the Product Management Module. When other authenticated users subsequently view affected product listings, the injected payload executes in their browsers, enabling session hijacking, credential theft, or UI redressing. A public proof-of-concept exploit is available on GitHub, lowering the bar for exploitation by non-expert attackers.
Cross-site scripting in SourceCodester Inventory Management System 1.0 allows authenticated remote attackers to inject and execute arbitrary client-side scripts via the `/api/vendors_handler.php` Vendor Management endpoint. A public proof-of-concept exploit has been published on GitHub (gist by fhewm98), confirming the issue is reproducible. Exploitation requires low-privilege authentication and victim interaction, limiting blast radius, but successful attacks can hijack sessions, redirect users, or perform unauthorized actions on behalf of the victim.
Reflected or stored cross-site scripting in SourceCodester Inventory Management System 1.0 allows an authenticated remote attacker to inject malicious JavaScript via the Customer_Name parameter in the Customer Management Module's /api/customers_handler.php endpoint. When a second user (such as an administrator) loads the affected customer record, the payload executes in their browser, enabling session hijacking or unauthorized actions on their behalf. A public proof-of-concept exploit is available on GitHub; no active exploitation (KEV) has been confirmed.
SQL injection in SourceCodester School Registration and Fee System 1.0 allows unauthenticated remote attackers to read, modify, or delete database contents via the Category parameter in /bilal/save_class.php. A public proof-of-concept exploit has been disclosed on GitHub, lowering the skill threshold for exploitation. No KEV listing exists, but the combination of unauthenticated network access and a publicly available exploit makes this an active concern for any deployed instance.
SQL injection in SourceCodester School Registration and Fee System 1.0 allows remote unauthenticated attackers to manipulate database queries via the `period` parameter of `/bilal/normal/pay_report.php`. A public proof-of-concept exploit has been published on GitHub (vuldb.com/submit/912055, github.com/zuojiu567/cve/issues/3), lowering the bar for exploitation significantly. No vendor patch has been identified at time of analysis, leaving deployments exposed with no vendor-supplied remediation path.
SQL injection in SourceCodester School Registration and Fee System 1.0 exposes the student deletion endpoint (/bilal/normal/delete_stud.php) to remote unauthenticated attackers through an unsanitized PHP array parameter `selector[]`. A proof-of-concept exploit is publicly available via GitHub, enabling attackers to read or manipulate the underlying MySQL/MariaDB database. The CVSS 4.0 score of 6.9 (Medium) reflects per-axis Low impact across confidentiality, integrity, and availability, consistent with a PHP application database rather than a critical infrastructure system; no KEV listing indicates no confirmed mass exploitation at time of analysis.
Cross-site scripting in SourceCodester Simple Traffic Offense System 1.0 allows remote attackers to inject arbitrary JavaScript via the site_name and site_desc parameters of the save-settings.php Settings Update Endpoint. The injected payload is stored server-side and executes in the browser of any user who subsequently loads the affected page. A public proof-of-concept exploit has been disclosed on GitHub (issue #3 in tan1540684326-QAQ/cve), confirming the vulnerability is reproducible.
Unauthenticated remote user deletion is possible in SourceCodester Simple Traffic Offense System 1.0 via the delete-user.php endpoint, which processes a user-supplied ID parameter without any session or privilege check. An attacker with HTTP access to the application can delete arbitrary user accounts without logging in, impacting data integrity and application availability. A publicly available proof-of-concept exploit exists on GitHub (no public exploit identified at time of analysis applies to KEV only - PoC is confirmed); the vulnerability is not listed in CISA KEV.
Missing authentication in SourceCodester Simple Traffic Offense System 1.0 allows unauthenticated remote attackers to create arbitrary user accounts by manipulating the `position` argument in `saveuser.php`. The user-creation endpoint fails to enforce any authentication gate (CWE-306), exposing it to direct network exploitation with no prerequisites. A public proof-of-concept exploit exists, raising the practical risk beyond what the moderate CVSS 4.0 score of 6.9 might suggest.
SQL injection in SourceCodester Online Voting System 1.0 allows unauthenticated remote attackers to read and manipulate the application database through the /voting/ajax.php?action=save_category endpoint. The Category parameter is passed directly into a backend SQL query without sanitization or parameterization, enabling classic error-based or UNION-based injection. A public proof-of-concept exploit is available on GitHub, making opportunistic exploitation trivially reproducible with no authentication required.
Cross-site request forgery in SourceCodester Syllabus-Aligned Learning Management & Examination System 1.0 allows a remote unauthenticated attacker to perform unauthorized state-changing actions on behalf of an authenticated victim by tricking them into visiting a malicious page. The vulnerability stems from missing CSRF tokens on one or more application functions, as documented in a public exploit report filed under VULN-08-CSRF-Missing-Tokens. A proof-of-concept exploit is publicly available on GitHub, though no active exploitation has been confirmed by CISA KEV.
Cleartext storage of sensitive database credentials and user data in SourceCodester Syllabus-Aligned Learning Management & Examination System 1.0 exposes plaintext secrets via the `cict_portal.sql` file. The SQL dump file, commonly placed within the web-accessible directory in SourceCodester PHP projects, can be retrieved directly over the network without authentication, leaking whatever credentials or personal data it contains. A public proof-of-concept exploit is available on GitHub, confirmed by VulDB and the referenced researcher report, raising the practical exploitation risk above what the moderate CVSS 4.0 score of 6.9 might suggest at first glance.
Session fixation in SourceCodester Syllabus-Aligned Learning Management & Examination System 1.0 allows unauthenticated remote attackers to pre-plant a session identifier via the auth_process.php login endpoint, then hijack the authenticated session after a victim logs in. The auth_process.php component fails to regenerate the session ID upon successful authentication, enabling full account takeover of any user who can be socially engineered into authenticating through a crafted link. A public exploit PoC exists on GitHub; no vendor patch has been released.
Cross-site scripting in SourceCodester Syllabus-Aligned Learning Management & Examination System 1.0 allows remote unauthenticated attackers to inject arbitrary JavaScript via the msg, title, or content parameters in manage_subjects.php. A public proof-of-concept on GitHub documents both reflected and stored XSS variants, confirming the vulnerability is exploitable and the details are widely available. No vendor-released patch has been identified, and no active exploitation has been confirmed via CISA KEV.
Unauthenticated IDOR (Insecure Direct Object Reference) in SourceCodester Syllabus-Aligned Learning Management & Examination System 1.0 allows remote attackers to delete arbitrary exam records by manipulating the `ID` parameter in `delete_exam.php` without any authorization check. Any network-accessible attacker can iterate over exam IDs to destroy examination data belonging to other users or system administrators. A public proof-of-concept exploit has been disclosed on GitHub, lowering the bar for opportunistic abuse.
Hard-coded database credentials embedded in db.php of SourceCodester Syllabus-Aligned Learning Management & Examination System 1.0 allow unauthenticated remote attackers to obtain and reuse valid database credentials without any prior authentication. The credentials, baked directly into the PHP source file, are exposed to any party who can read or retrieve that file over the network. Publicly available exploit code has been published per the VulDB submission and a GitHub vulnerability report covering the same product, elevating this beyond a theoretical risk.
Unauthenticated privilege escalation in SourceCodester Syllabus-Aligned Learning Management & Examination System 1.0 allows remote attackers to register as privileged users - including administrator - by manipulating the `role` parameter in the `register` function of `auth.php`. Because the application fails to enforce server-side role validation during self-registration, any unauthenticated user can tamper the role field to claim elevated privileges at account creation time. A public proof-of-concept exploit is available on GitHub, lowering the bar for opportunistic exploitation.
SQL injection in SourceCodester Class and Exam Timetabling System 1.0 allows remote attackers to manipulate database queries via the room_name parameter passed to the mysqli_query() call in /admin/modal_add_room.php. Exploitation yields limited data disclosure and modification (VC:L/VI:L per CVSS 4.0), consistent with a classic unsanitized input flaw in a PHP/MySQL stack. A public proof-of-concept is available on GitHub, no vendor patch has been identified, and no active exploitation (CISA KEV) has been confirmed.
Unauthenticated SQL injection in SourceCodester Class and Exam Timetabling System 1.0 exposes the application to full database read and write via the `fname` parameter in `/admin/modal_add_product.php`. The underlying `mysqli_query` call accepts unsanitized user input, allowing remote attackers to craft malicious SQL payloads without any authentication. A public exploit has been disclosed on GitHub, materially increasing the likelihood of opportunistic exploitation.
SQL injection in SourceCodester Class and Exam Timetabling System 1.0 allows remote unauthenticated attackers to manipulate backend database queries via the unsanitized `course` parameter passed directly to mysqli_query in /admin/modal_add_coursea.php. The vulnerability carries limited but confirmed data exposure and integrity risk (VC:L/VI:L/VA:L per CVSS 4.0). A public proof-of-concept exploit was published to GitHub, lowering the bar for exploitation significantly. No vendor patch has been identified.
SQL injection in SourceCodester Class and Exam Timetabling System 1.0 exposes the `course` parameter in `/admin/modal_add_course2.php` to unauthenticated remote attackers who can manipulate the underlying MySQL database. The vulnerability is rooted in direct, unsanitized input concatenation into a `mysqli_query()` call, yielding bounded but real read, write, and partial availability impact. A proof-of-concept exploit has been publicly disclosed on GitHub, materially lowering the exploitation barrier.
SQL injection in SourceCodester Class and Exam Timetabling System 1.0 exposes the database to unauthenticated remote attackers via the `course` parameter passed to `mysqli_query()` in `/admin/modal_add_course1.php`. An attacker can craft a malicious HTTP request to read, modify, or delete database contents without prior authentication, as confirmed by a publicly available proof-of-concept exploit. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N) reflects straightforward remote exploitation with no special conditions, though limited CIA impact scores (VC:L/VI:L/VA:L) suggest partial rather than full database compromise.
SQL injection in SourceCodester Class and Exam Timetabling System 1.0 allows unauthenticated remote attackers to execute arbitrary SQL against the application database through the unvalidated `course` parameter in `/admin/modal_add_course.php`. The `mysqli_query` function receives attacker-controlled input without parameterization or sanitization, enabling full database extraction, credential theft, and record manipulation. A public proof-of-concept exploit is available on GitHub; no vendor patch has been identified at time of analysis.
SQL injection in SourceCodester Class and Exam Timetabling System 1.0 exposes the `/delete_user_account.php` endpoint to unauthenticated remote exploitation via an unsanitized `id` parameter. The flaw allows attackers to read, modify, or delete underlying database records without any authentication credential. A public proof-of-concept exploit is available via GitHub, materially elevating practical risk beyond what the moderate CVSS 4.0 score of 6.9 might suggest at face value.
Unauthenticated SQL injection in SourceCodester Class and Exam Timetabling System 1.0 allows remote attackers to manipulate the database through the ID parameter in /delete_user.php. The vulnerability requires no privileges or user interaction, and a public proof-of-concept exploit has been published on GitHub. Impact is limited by the CVSS 4.0 assessment (VC:L/VI:L/VA:L), suggesting partial data read/write rather than full database compromise, though chained exploitation could escalate impact.
SQL injection in SourceCodester Class and Exam Timetabling System 1.0 exposes the /delete_teacher.php endpoint to unauthenticated remote database manipulation via an unsanitized ID parameter (CWE-89). A proof-of-concept exploit has been publicly released on GitHub, making opportunistic exploitation straightforward for low-skilled attackers. Attackers with network access to the application can extract, modify, or delete records from the underlying database without supplying credentials.
SQL injection in SourceCodester Performance Indicator System 1.0 lets a remote attacker inject arbitrary SQL through the 'Contact' argument handled by /opils/staff/save_profile.php, potentially reading or altering data in the underlying database. The assessed impact is limited to Low across confidentiality, integrity and availability (CVSS 3.1 base 6.9, AV:N/AC:L/PR:N/UI:N), so exposure is partial rather than full application takeover. A public PoC reference exists in a GitHub issue; it is not verified as working exploit code, and no confirmed active exploitation is reported - the vuln.today decision label is 'this_month', indicating a genuine but non-emergency issue concentrated in a niche PHP application unlikely to be widely deployed in production.
SQL injection in SourceCodester Performance Indicator System 1.0 lets remote attackers alter SQL statements executed by /opils/staff/edit_dealer.php through the Contact parameter, potentially reading or tampering with dealer records and other data in the underlying database. The supplied scoring (CVSS 4.0 6.9, AV:N/AC:L/PR:N/UI:N, E:P) describes network-reachable exploitation without privileges or user interaction, although the 'staff' path segment suggests the page may normally sit behind a staff login, so true unauthenticated reachability in a default deployment is unconfirmed. A public PoC reference exists; it is not verified as working exploit code, and no confirmed active exploitation has been reported.
SQL injection in the Contact argument handled by /opils/staff/adddealer.php in SourceCodester Performance Indicator System 1.0 allows remote attackers to inject arbitrary SQL into the application's backend queries, with limited confidentiality, integrity and availability impact. The vendor scored it 6.9 under CVSS 4.0 (E:P), and it is a textbook low-to-moderate-priority web SQL injection rather than a top-tier emergency: the affected endpoint is a single, obscure page in a niche PHP product with very low real-world deployment, and authentication requirements are not confirmed from available data - the '/staff/' path suggests an administrative area that may require valid staff credentials even though the assessed vector carries PR:N. A public PoC reference exists; it is not verified as working exploit code, and there is no CISA KEV listing indicating active exploitation.
SQL injection in SourceCodester Performance Indicator System 1.0 lets a remote attacker who can authenticate to the admin area manipulate the ID argument of /opils/admin/deleteproduct.php and inject SQL, with low confidentiality, integrity, and availability impact under the assessed vector. This is a medium-severity, lower-priority issue rather than an urgent one: the priority label is this_month, and the supplied data contains no KEV confirmation. A public PoC reference exists at the linked GitHub issue, but it is not verified as working exploit code.
Missing authorization in the Admin Endpoint of SourceCodester Food Order Management System 1.0 allows remote attackers to invoke administrative functionality without valid admin credentials, with limited confidentiality, integrity, and availability impact. Publicly available exploit code exists, making the issue practical wherever the admin interface is network-exposed; no CISA KEV listing or confirmed active exploitation was provided at time of analysis. Because the vulnerable function is unnamed, defenders should confirm the affected admin route using the published PoC before tuning detections.
Stored cross-site scripting in SourceCodester Inventory System 1.0 allows an authenticated user to inject script through the Hsn_Code parameter of /api/transactions_handler.php?action=save_sale, which executes in another user's browser when the saved sale is viewed. Exploitation requires an authenticated account and victim interaction, limiting real-world urgency; no public exploit identified at time of analysis and no CISA KEV active-exploitation signal was provided. The assessed impact is a limited integrity effect in the victim's browser context, with no confidentiality or availability impact.
Stored cross-site scripting in SourceCodester Inventory System 1.0 is a genuine-but-low-priority issue: an authenticated low-privilege user can inject script through the Product_Name, Product_Code, or Vendor_Name parameters when saving a purchase via /api/transactions_handler.php?action=save_purchase, and the payload executes when another user views the affected purchase record. Publicly available exploit code exists, but there is no CISA KEV confirmation of active exploitation, and the product's limited deployment base reduces practical risk. The independent assessment scores this as CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N, requiring a valid account and victim interaction.
Cross-site scripting in SourceCodester Inventory System 1.0 allows an authenticated low-privileged user to inject script through the Product_Id or Product_Name argument in /api/products_handler.php?action=save, with execution occurring when another user later views the Product Management page. Exploitation requires valid credentials and victim interaction, publicly available exploit code exists, and the CVSS 4.0 score is 5.1; impact is limited to browser-session integrity with no confidentiality or availability loss.
SQL injection in SourceCodester Online Reviewer System 1.0 allows unauthenticated remote attackers to alter the SQL query behind the login form at login/index.php by supplying crafted input in the username or password field. Because the vulnerable endpoint is the pre-authentication login page, exploitation requires only network reachability to the application - no credentials, user interaction, or non-default configuration - and publicly available exploit code exists (a PoC is published at tracexlabs.com). The impact is moderate rather than catastrophic: CVSS 6.9 and an independent assessment of CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L indicate limited confidentiality, integrity, and availability effects, most likely authentication bypass and/or disclosure of data held in the application's backend database.
Unauthenticated SQL injection in SourceCodester Online Exam System 1.0 allows remote attackers to manipulate the username and pass parameters submitted to the pre-authentication login handler at adminpanel/admin/query/loginExe.php, potentially bypassing authentication and reading or altering backend database contents. The flaw is remotely reachable with low complexity, no privileges and no user interaction (CVSS 4.0: PR:N/UI:N/AC:L), and publicly available exploit code exists, though no confirmed active exploitation (CISA KEV) has been reported. EPSS and KEV data were not provided for this record.
Unauthenticated SQL injection in SourceCodester Art Gallery Management System 1.0 lets a remote attacker inject arbitrary SQL through the 'Name' argument handled by Action::save_user in admin/admin_class.php during account creation, allowing manipulation of the underlying database. The vulnerable code path is reachable without credentials or user interaction (CVSS 4.0 vector AV:N/AC:L/AT:N/PR:N/UI:N), and publicly available exploit code exists, including a pre-authentication admin-creation proof of concept, though this CVE is not listed in CISA KEV so active exploitation is not confirmed. Impact is rated low across confidentiality, integrity and availability (CVSS 6.9 base, assessed CVSS 3.1 6.9-equivalent), making this a moderate, opportunistic risk concentrated on internet-exposed instances of this niche PHP application.
Improper authorization in SourceCodester Simple Cafe Billing System 1.0 allows remote unauthenticated attackers to manipulate the 'Type' parameter in the save_user action of admin_class.php, enabling unauthorized modification of user roles within the User Management component. The vulnerability is network-exploitable (CVSS 4.0 base 5.5, CVSS 3.1 AV:N/AC:L/PR:N/UI:N) with no authentication or user interaction required, and publicly available exploit code exists; active exploitation has not been confirmed (not in CISA KEV). The application's narrow deployment footprint limits real-world exposure.
Unrestricted file upload in SourceCodester Library Management System 1.0 allows remote attackers to upload arbitrary files via the 'image' parameter to admin/add_admin.php, which uses move_uploaded_file without validating file type or extension, potentially leading to remote code execution if the uploaded file is web-accessible and the server executes PHP. Publicly available exploit code exists (though not confirmed as actively exploited in the wild), and the CVSS vector asserts unauthenticated access (PR:N), but the endpoint resides under an admin/ path, so exploitation may be limited to authenticated administrators in deployments that enforce access controls on that directory. Risk signals conflict and must be weighed carefully.
Unrestricted file upload in SourceCodester E-Learning System 1.0 lets remote attackers write arbitrary files, including executable PHP scripts, onto the server by manipulating the img argument in the save_users handler at /classes/Users.php?f=save. Successful exploitation depends on the endpoint being reachable and on the handler accepting the upload without file-type, extension, or content validation, followed by retrieving the uploaded file from a directory where PHP execution is permitted. Publicly available exploit code exists (referenced at tracexlabs.com as an 'elearning-preauth-rce' release) and the VulDB-sourced input warns it might be used; the CVSS 4.0 vector scores 6.9 with PR:N and UI:N, though our assessment notes that save_users is normally an administrative user-management action, so genuine pre-authentication reachability in a default install is not confirmed from the available data and should be verified.
Unrestricted file upload in SourceCodester Contact Tracing System 1.0 allows remote attackers to send a crafted file through the save handler at /classes/Users.php?f=save so that move_uploaded_file places attacker-controlled content into a web-accessible location, potentially yielding PHP code execution if the upload directory is executable. The provided CVSS 4.0 vector is CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P, indicating no privileges or user interaction in the assessed scenario, though the endpoint's Users save context warrants source-level confirmation of pre-auth reachability, and impact is limited to version 1.0. Publicly available exploit code exists, but the supplied data does not confirm CISA KEV active exploitation.
SQL injection in SourceCodester Performance Indicator System 1.0 lets a remote attacker manipulate the ID argument of /opils/staff/sales_history.php and inject arbitrary SQL into the application's database queries. Publicly available exploit code exists, and the provided CVSS 4.0 vector rates the issue 5.5 (AV:N/AC:L/PR:N/UI:N), though the /staff/ path indicates the endpoint may sit behind a staff-authenticated area, which would constrain real-world exploitation. Overall real-world priority is low because the product is rarely deployed and no CISA KEV or active-exploitation reporting is present in the supplied data.
SQL injection in the 'credit' parameter handled by /opils/staff/edit_credit.php in SourceCodester Performance Indicator System 1.0 lets remote attackers inject arbitrary SQL into backend database queries, with limited confidentiality, integrity, and availability impact as reflected in the 6.9 score and the assessed CVSS:3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L). Publicly available exploit code exists - a proof-of-concept write-up was published in a GitHub issue linked from the CVE record - but there is no confirmed active exploitation (CISA KEV) at time of analysis. The supplied CVSS 4.0 vector asserts PR:N (no privileges required), yet the endpoint sits under a /staff/ administrative path, so defenders should verify whether their deployment requires a staff session; the dominant real-world limiter remains deployment scarcity of this niche PHP application.
SQL injection in SourceCodester Performance Indicator System 1.0 allows remote attackers to manipulate the Category argument in /opils/staff/product.php and alter database queries, yielding low impact to confidentiality, integrity, and availability. Publicly available exploit code exists; no CISA KEV confirmation is present, and authentication requirements are not confirmed because the supplied vector marks PR:N while the independent assessment suggests the staff endpoint may require login. Real-world risk leans low because the product has a rare deployment footprint and the assessed impact is limited, despite the medium CVSS 4.0 base score of 6.9.
Authenticated remote attackers can exploit a SQL injection vulnerability in SourceCodester Performance Indicator System 1.0 by manipulating the 'pqty' parameter in the /opils/staff/edit_quantity.php endpoint. A public exploit has been disclosed, but the product's limited production use and the requirement for valid staff credentials (as indicated by the /staff/ path) make this a moderate, low-priority issue. No active exploitation has been confirmed.
SQL injection in SourceCodester Performance Indicator System 1.0 lets an attacker inject arbitrary SQL through the 'prodcategory' parameter handled by /opils/admin/addproduct.php, allowing manipulation of the underlying database contents and disclosure of stored data. The vulnerable endpoint sits under /admin/, so realistic exploitation most likely requires either a valid administrative session or an add-product page that lacks an adequate session check, which the independent assessment captures by scoring the issue PR:L rather than PR:N; the vendor-style vector instead lists PR:N, and that authentication requirement remains the key unconfirmed limiting factor. Publicly available exploit code exists for this issue, raising the likelihood of opportunistic scanning and abuse, though impact is bounded to low confidentiality, integrity and availability effects (CVSS 3.1 base 6.9, AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L) and no CISA KEV listing indicates confirmed active exploitation.
Stored cross-site scripting in SourceCodester Drug Recommendation System 1.0 lets unauthenticated remote attackers inject arbitrary script through the name or email argument handled by Admin/user_record.php, which then executes in the browser session of an administrator viewing the Admin Record Tables page. Publicly available exploit code exists, and no vendor-released patch has been identified, though CVSS 4.0 scoring of 5.3 with UI:P reflects that a privileged victim must passively render the tainted record before the payload fires. This is a genuinely low-priority issue despite being publicly disclosed, because impact is confined to script execution in the viewing user's browser (integrity-low) with no direct server compromise.
Cross-site scripting in SourceCodester Drug Recommendation System 1.0 allows remote, unauthenticated attackers to inject script payloads into the Student Registration workflow at Auth/add_student.php via the txtname, txtpassword, txtemail, txtphone and txtprevious_school fields. Publicly available exploit code exists (CVSS 4.0 E:P, CVSS 3.1 base 5.3) and the injected script executes only when a victim - plausibly an administrator reviewing submitted registration records - renders the tainted output in a browser, so impact is bounded to that victim's browser session within the application. Exploitation is not confirmed actively exploited (not in CISA KEV), and no vendor-released patch was identified at time of analysis, making this a low-to-moderate priority issue despite the public exploit.
SQL injection in SourceCodester Performance Indicator System 1.0 allows low-privilege authenticated attackers to manipulate the 'Category' parameter in /opils/admin/view_product.php, leading to limited confidentiality, integrity, and availability impact. Publicly available exploit code exists, and the CVSS vector requires PR:L, meaning attackers must first obtain valid low-privilege credentials to the admin interface. There is no evidence of confirmed active exploitation (CISA KEV), and the EPSS score is not available.
Stored cross-site scripting in SourceCodester Simple Student Information System 1.0 lets remote, unauthenticated attackers inject arbitrary JavaScript through the firstname and lastname fields processed by /register.php, which executes in the browser of any victim who later views the affected profile page. Publicly available exploit code exists, and the vendor has not released a patch; this is a low-to-moderate priority issue despite the remote attack vector because successful exploitation requires the victim to view the tainted page (UI:P) and impact is limited to client-side script execution with no server-side code execution, no confidentiality loss of stored data, and no availability impact.
Reflected cross-site scripting in SourceCodester Simple Student Information System 1.0 allows a low-privileged authenticated attacker to inject script through the 'searchbox' argument handled by the clean function in searchresults.php, which reflects the value into the results page without proper output encoding. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:P) shows the attacker needs low-level authentication to reach the search page, while successful execution requires a logged-in victim to view the attacker-influenced results page, so impact is confined to integrity within the victim's browser session (VC:N/VI:L/VA:N). Publicly available exploit code exists (referenced from a public GitHub issue), but there is no CISA KEV listing indicating confirmed active exploitation; combined with an assessed CVSS 3.1 of 5.1, this is a low-to-moderate priority issue rather than an urgent one.
Remote SQL injection in SourceCodester Simple Student Information System 1.0 via searchquery.php allows attackers to manipulate database queries and potentially read or alter application data, and the independent assessment rates this as a low-to-moderate real-world risk despite the network-reachable vector. The assessed CVSS v3.1 vector is AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L, while the CVSS v4.0 score is 6.9; the PR:N/UI:N values indicate unauthenticated exploitation with no user interaction, but the search endpoint may sit behind an application login in common deployments, so defenders should confirm whether searchquery.php is reachable pre-authentication. No public exploit was identified at time of analysis.
Cross-site request forgery in SourceCodester Drug Recommendation System 1.0 allows a remote attacker to make an authenticated victim's browser submit unintended state-changing requests, because the application's forms do not validate anti-CSRF tokens (CWE-352). The attacker needs no credentials of their own (CVSS:3.1 AV:N/AC:L/PR:N/UI:R/S:U), but success requires luring a logged-in victim to attacker-controlled content while their session is active, and the resulting impact is limited to low integrity with no confidentiality or availability loss. Publicly available exploit code exists (published in the hackliu/Vulnerability-Reports repository as VULN-06-CSRF-Missing-Tokens.md), but there is no evidence of confirmed active exploitation (not listed in CISA KEV), so this should be treated as a low-to-moderate real-world risk rather than a mass-exploitation event.
Cross-site scripting (XSS) in SourceCodester Drug Recommendation System 1.0 allows remote attackers to inject malicious scripts via the Admin/add_drug.php endpoint, which execute in an authenticated administrator's browser when the drug data is rendered. The attack requires user interaction and typically administrator-level access to the vulnerable form, and while publicly available exploit code exists, the overall risk is assessed as low-to-moderate due to these prerequisites and the limited browser-context impact.
Authentication bypass in SourceCodester Drug Recommendation System 1.0 lets remote, unauthenticated attackers impersonate arbitrary accounts by manipulating the user_id argument processed by the application's Auth Guard component. Per the CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N), no credentials, user interaction, or special configuration are required, so any network-reachable default installation is exposed; impact is bounded to LOW confidentiality, integrity, and availability (VC:L/VI:L/VA:L), limiting the attacker to unauthorized read/limited modification rather than full system compromise. Publicly available exploit code exists, including a detailed GitHub write-up of the broken access control issue, so exploitation is trivial for anyone who can reach the instance; the practical risk is tempered mainly by the product's very small real-world deployment footprint and the capped impact ratings.
SQL injection in SourceCodester Online Reviewer Management System 1.0 lets unauthenticated remote attackers execute arbitrary database queries through the 'Subject' GET parameter of /reviewer_0/admins/assessments/Subject/btn_functions.php when action=course. Per the CVSS v4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N, E:P) no credentials or user interaction are required against a default deployment, and publicly available exploit code exists (a proof-of-concept was published via the VulDB-linked GitHub issue); there is no confirmed active exploitation (CISA KEV). Impact is scoped to confidentiality, integrity and availability of the application's backend data at a low level, making this a moderate-severity, exposure-dependent risk rather than a broad remote-takeover event.
SQL injection in SourceCodester Online Reviewer Management System 1.0 allows an attacker to manipulate the SQL statement executed by the administrative assessment handler at /reviewer_0/admins/assessments/Subject/btn_functions.php?action=update by supplying crafted input in the 'Subject' argument, enabling unauthorized read and modification of data stored by the application. Publicly available exploit code exists (referenced through a GitHub proof-of-concept issue linked from the VulDB entry), but there is no CISA KEV listing confirming active exploitation, and no EPSS signal was provided. Impact is bounded rather than catastrophic: our independent assessment (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L) rates confidentiality, integrity and availability effects as low, and exploitation likely requires an authenticated admin/reviewer session to reach the /admins/ path despite the vendor's CVSS 4.0 vector claiming PR:N; the dominant real-world limiter is that this product is rarely run in production.
SQL injection in SourceCodester Online Reviewer Management System 1.0 lets remote attackers manipulate the Title argument in /reviewer_0/admins/assessments/activities/btn_functions.php?action=update to alter database queries, and publicly available exploit code exists. The supplied CVSS 4.0 vector is 6.9 with PR:N, but the independent assessment notes the '/admins/' path strongly implies administrative authentication; if that login gates the endpoint, exploitation requires authenticated admin access. Because the product is niche and real-world exposure depends on whether the admin area is reachable, this is assessed as a low-to-moderate priority despite the public exploit.
SQL injection in SourceCodester Drug Recommendation System 1.0 allows an authenticated administrator to inject arbitrary SQL through the txtname parameter on the admin-only Symptom Creation page (/Admin/add_symptom.php), corrupting or disclosing the underlying MySQL database. The flaw stems from improper use of mysqli_real_escape_string during query construction (CWE-89), and because the vulnerable endpoint sits behind the admin login (CVSS PR:H), an attacker must first hold administrator credentials; the assessed impact is limited confidentiality, integrity, and availability loss (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L). Publicly available exploit code exists and has been published, elevating practical risk for any deployment where admin credentials are weak, shared, or exposed, but this is not an unauthenticated or pre-auth remote compromise and should be treated as a comparatively low-priority finding.
SQL injection in the admin Drug Creation routine of SourceCodester Drug Recommendation System 1.0 lets an attacker with an existing administrator session read and tamper with the application's database by submitting crafted values through the txtname, cmdtype, txtusage, txtsideeffect, or cmdcontraindication parameters of /Admin/add_drug.php. The hard prerequisite is prior admin-level access (CVSS PR:H / the assessed CVSS:3.1 vector PR:H), so this is not exploitable by an anonymous remote user against a default installation, and impact is bounded to partial confidentiality, integrity and availability of the application database. Publicly available exploit code exists (the CVSS 4.0 vector carries E:P), although there is no indication of confirmed active exploitation (not in CISA KEV), and the issue should be treated as low-to-moderate priority relative to the SQL injection classification.
SQL injection in SourceCodester Drug Recommendation System 1.0 allows an authenticated administrator to manipulate the ID parameter of /Admin/edit_class.php and execute arbitrary SQL against the underlying database. The vulnerability is network-reachable with low complexity but requires high privileges (PR:H), limiting practical exploitation to malicious insiders or attackers who have already compromised an admin account; a publicly available exploit code exists, though no active exploitation has been confirmed. Given the niche product and the high-privilege precondition, this is a low-to-moderate priority issue that is unlikely to warrant emergency patching in most environments.
SQL injection in SourceCodester Drug Recommendation System 1.0 allows unauthenticated remote attackers to execute arbitrary SQL commands via the cmdschool parameter in /Auth/add_student.php. A public exploit has been released (publicly available exploit code exists; no evidence of active exploitation in CISA KEV) and the CVSS 4.0 base score is 6.9 (medium). The vulnerability is limited to low confidentiality, integrity, and availability impact, and real-world risk is low because the application is a niche academic/demo PHP project rarely exposed to the internet.
SQL injection in SourceCodester Online Reviewer Management System 1.0 allows a remote attacker, likely with a valid administrative session, to manipulate the Title parameter of /reviewer_0/admins/assessments/activities/btn_functions.php?action=activity and alter backend SQL queries, exposing or modifying limited application data. Publicly available exploit code exists, but CISA KEV does not list this as actively exploited, and the assessed CVSS 3.1 vector is PR:L, so successful exploitation is gated by access to the administrative module. This is a low-priority finding despite the medium headline score because the vulnerable endpoint is inside the admin path and the assessed impact is limited to low confidentiality, integrity, and availability effects.
Unauthenticated remote SQL injection in SourceCodester Car Driving School Management System 1.0 allows attackers to inject arbitrary SQL through the f=save_enrollment action of /classes/Master.php, potentially reading or altering data in the application's backend database. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) confirms the flaw is reachable without credentials or user interaction, though all vulnerable-system impacts are rated Low (VC:L/VI:L/VA:L) with no subsequent-system impact, yielding a moderate 6.9 rather than a critical score. Publicly available exploit code exists (referenced via a GitHub issue and the VulDB entry), and the affected version is 1.0 of this open-source PHP application; no public exploit identified at time of analysis beyond that released proof-of-concept, and the software has no CISA KEV listing.
SQL injection in the test_id parameter of exam-delete.php in SourceCodester Online Reviewer Management System 1.0 allows remote attackers to manipulate database queries, resulting in low-impact confidentiality, integrity, and availability loss (CVSS 4.0 6.9, medium). Publicly available exploit code exists and the attack is network-reachable with no user interaction; the published CVSS 4.0 vector rates it PR:N (unauthenticated), although our independent assessment notes the vulnerable script sits under the /admins/ administrative directory, implying a valid admin session is required in practice and that authentication requirements should be confirmed before the PR:N rating is trusted. The product is a small-footprint PHP application by SourceCodester, so real-world exposure is limited, and no CISA KEV listing indicates confirmed active exploitation.
SQL injection in SourceCodester Online Reviewer Management System 1.0 allows remote attackers to execute arbitrary SQL commands via the access_code parameter in /reviewer_0/admins/assessments/examproper/btn_functions.php. Per the CVSS vector, no authentication or user interaction is required, though the endpoint's location under an 'admins/' directory suggests it may be intended for authenticated administrators; a public exploit exists. No vendor-released patch has been identified at time of analysis, but the product is a niche educational PHP application with minimal enterprise deployment, so real-world risk is limited.
SQL injection in SourceCodester Online Reviewer Management System 1.0 allows remote attackers to manipulate the 'ID' request parameter of /reviewer_0/admins/assessments/examproper/questions-view.php, altering backend database queries with partial confidentiality, integrity and availability impact (CVSS 5.5; vendor-disclosed, VulDB-tracked). Publicly available exploit code exists - a proof-of-concept is published at https://github.com/Aszadom/cve/issues/1 - but there is no confirmed active exploitation (CISA KEV). The CVSS 4.0 vector records PR:N/UI:N (no authentication or user interaction required), although the '/admins/' segment of the vulnerable path suggests the questions-view function is part of the administrative interface and may in practice require an authenticated admin session, which would materially limit realistic exploitation. No vendor-released patch was identified at time of analysis.
Cross-site scripting in SourceCodester Smart Attendance System with QR Code Scanner 1.0 lets unauthenticated remote attackers inject arbitrary JavaScript through the full_name parameter of the Self-Registration page (student_signup.php), which then executes in the browser of any user or administrator who renders the affected name. Publicly available exploit code exists, but there is no confirmation of active exploitation. Impact is confined to the victim's browser context - session token theft, defacement, or redirection - with no server-side compromise, and the product is a niche hobby-grade PHP application with essentially no production deployment.
SQL injection in SourceCodester Online Reviewer Management System 1.0 allows attackers to manipulate the test_id parameter in /reviewer_0/admins/assessments/pretest/exam-delete.php, potentially reading or altering database contents. Publicly available exploit code exists, but practical exploitation requires reaching the administrative interface and likely a valid admin session despite the CVSS 4.0 vector indicating no privileges; the product's rare deployment footprint further limits real-world risk. This is a classic high-nominal/low-real-risk finding with limited confidentiality, integrity, and availability impact.
SQL injection in SourceCodester Online Reviewer Management System 1.0 lets an attacker who can reach the administrative assessment endpoint inject arbitrary SQL through the test_id parameter of /reviewer_0/admins/assessments/pretest/btn_functions.php?action=update, exposing and potentially altering stored review and assessment data. Publicly available exploit code exists (a proof-of-concept is published in the GitHub issue referenced by VulDB), and the vendor has not shipped a fixed version. Because the vulnerable path sits under /admins/, exploitation in practice most likely requires a valid administrative session, making reachability of the admin area and credential strength the primary limiting factors; the CVSS 4.0 score of 6.9 treats it as PR:N, our own assessment rates it CVSS:3.1 AV:N/AC:L/PR:L/UI:N with high confidentiality and low integrity impact.
SQL injection in SourceCodester Online Reviewer Management System 1.0 lets remote attackers inject arbitrary SQL through the difficulty_id parameter on the /reviewer_0/admins/assessments/databank/btn_functions.php endpoint when action=add, allowing partial read, modification, and disruption of the underlying database. The vendor-supplied CVSS 4.0 score is 6.9 with a vector claiming no privileges or user interaction required (PR:N/UI:N), but the vulnerable path sits inside the /admins/ administrative area, which in typical deployments is only reachable behind an authenticated administrator session - an independent assessment re-rates it as CVSS 3.1 AV:N/AC:L/PR:L/UI:N with low confidentiality, integrity, and availability impact. Publicly available exploit code exists and has been published alongside the disclosure, and there is no indication of confirmed active exploitation (no CISA KEV listing), while exploitation is further constrained by how few instances of this obscure PHP application are deployed and internet-reachable.
Cross-site scripting in SourceCodester Drug Recommendation System 1.0 allows unauthenticated remote attackers to inject arbitrary script through the 'full name' argument processed by /drug_recommender/index.php, with the payload executing in a victim's browser once the unsanitized value is rendered. Publicly available exploit code exists - a GitHub proof-of-concept README documents the injection path (profile XSS) - but there is no evidence of confirmed active exploitation, and the vendor/analyst scoring places this at 5.3 (CVSS 4.0 AV:N/AC:L/PR:N/UI:P, with the independent assessment using CVSS 3.1 AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N), reflecting integrity-limited impact with no confidentiality or availability loss. Overall this is a low-to-moderate risk issue: it requires victim interaction and an internet-reachable deployment of an obscure PHP application unlikely to be exposed in production.
Stored cross-site scripting in SourceCodester Drug Recommendation System 1.0 allows an authenticated user with access to the User Management add_user function to inject malicious script via the txtname, txtemail, or txtpassword parameters, which then executes in the browser of any user who views the affected page. Publicly available exploit code exists, though exploitation requires authentication (PR:L per the assessed CVSS 3.1 vector) and victim interaction (UI:P), and the target is a niche application with essentially no production deployment, making the real-world risk low. The assessed impact is limited to browser-context integrity (VI:L) with no confidentiality or availability effect.
Stored cross-site scripting in the admin symptom-management form (drug_recommender/Admin/add_symptom) of SourceCodester Drug Recommendation System 1.0 lets a user supply malicious content through the txtname argument that is later rendered in a browser without proper output encoding. The attack is remote but gated behind a high-privilege administrator account (CVSS PR:H) and requires a victim to view the affected admin page (UI:P/UI:R), which effectively restricts exploitation to the admin context - closer to self-XSS than a cross-privilege attack - and makes this a low real-world priority despite a public exploit. Publicly available exploit code exists (a GitHub PoC walkthrough linked from the CVE record); there is no indication of confirmed active exploitation (not in CISA KEV), and the independent assessment rates the overall real-world risk as low.
SQL injection in SourceCodester Drug Recommendation System 1.0 lets a remote attacker manipulate the SQL query behind /drug_recommender/Admin/edit_user.php by tampering with the ID parameter, enabling unauthorized read and modification of backend data. The vulnerability carries a publicly available exploit (proof-of-concept published on GitHub), so exploitation is trivial for anyone who can reach the endpoint, though no confirmed active exploitation (CISA KEV) has been reported. Scoring is split: the CNA/VulDB vector rates it CVSS 4.0 at 6.9 with PR:N, while our independent assessment scores it CVSS 3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N, because the /Admin/ path strongly suggests an authenticated administrative session is normally required, which markedly reduces the realistic attack surface and real-world priority despite the alarming-looking technical impact.
SQL injection in SourceCodester Drug Recommendation System 1.0 allows remote attackers to manipulate the ID parameter in /Admin/edit_symptom.php, causing the application to execute attacker-influenced SQL against its backend database and potentially read or alter symptom records. Publicly available exploit code exists, but there is no CISA KEV confirmation of active exploitation; independent assessment treats this as a lower real-world priority because the /Admin/ endpoint is normally protected by an admin login and the product's deployment base is very small. The vendor's CVSS 4.0 vector rates it 6.9 with PR:N, while the independent CVSS 3.1 assessment requires admin-level authentication (PR:L) and assigns high confidentiality and integrity impact with limited availability impact.
SQL injection in SourceCodester Online Reviewer Management System 1.0 allows remote attackers to manipulate the ID parameter of /reviewer_0/admins/assessments/subject/btn_functions.php?action=remove and execute attacker-controlled SQL against the application's backend database, potentially exposing or altering stored records. Publicly available exploit code exists (a public proof-of-concept referenced from VulDB and a public GitHub issue), which lowers the skill barrier, but there is no confirmed actively exploited (CISA KEV) status and no EPSS estimate was supplied. Impact is bounded rather than catastrophic: the vendor vector rates confidentiality, integrity and availability impact as low (VC:L/VI:L/VA:L, E:P), and our independent assessment scores it CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L - a classic low-real-priority SQL injection for a niche PHP project despite a mid-range base score, with the main open question being whether the administrative script is actually reachable without a valid admin session.
SQL injection in SourceCodester Online Reviewer Management System 1.0 lets remote attackers inject arbitrary SQL through the courseID argument handled by /reviewer_0/admins/assessments/course/btn_functions.php, giving read access to backend data and limited ability to modify or disrupt it (integrity and availability impact rated Low, confidentiality High in our independent assessment). Publicly available exploit code exists - a proof-of-concept has been published via the GitHub issue referenced by VulDB - and the vendor-supplied CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) claims unauthenticated, no-interaction exploitation. Despite the 6.9 score, real-world risk is bounded: exploitation requires that the script be reachable, and because it lives under an /admins/ directory, practical unauthenticated access depends on the deployment lacking a session or authorization guard on that path, a common but unverified trait of SourceCodester projects. No CISA KEV entry or confirmed in-the-wild exploitation was identified at time of analysis.
SQL injection in SourceCodester Online Reviewer Management System 1.0 allows remote attackers to alter SQL queries through the Course parameter of /reviewer_0/admins/assessments/course/btn_functions.php, enabling data disclosure along with limited integrity and availability impact. Publicly available exploit code exists via a GitHub PoC issue, but there is no evidence of active exploitation, and the feed CVSS 4.0 score of 6.9 overstates practical risk. The independent assessment rates this as LOW priority because the affected product is a niche educational PHP application with a single known version, negligible internet-facing deployment, and an unverified access-control prerequisite, consistent with an assessed CVSS 3.1 vector of AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:L.
SQL injection in the login handler of SourceCodester Inventory and Monitoring System 1.0 lets remote unauthenticated attackers inject arbitrary SQL through the Username argument of /index.php, potentially reading and altering database contents. The flaw requires no credentials, no user interaction, and no non-default configuration, and publicly available exploit code exists; there is no indication of confirmed active exploitation (no CISA KEV listing). Note the scoring split: the CNA's CVSS 4.0 vector rates 5.5 with limited (VC:L/VI:L/VA:L) impact, while our independent assessment treats confidentiality and integrity as High (CVSS 3.1 9.8); real-world risk is in practice bounded less by any technical prerequisite than by the product's small deployment footprint.
SQL injection in SourceCodester Inventory and Monitoring System 1.0 allows remote attackers to manipulate database queries through the difficulty_id parameter of the /admins/assessments/databank/btn_functions.php?action=add endpoint. Publicly available exploit code exists, and the vendor-supplied CVSS 4.0 score of 6.9 treats the flaw as remotely reachable without authentication (PR:N); however, our independent assessment rates it CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N because the /admins/ path implies an administrative function that typically sits behind a login, so a valid staff or admin session may be required, which materially lowers realistic risk. Impact is limited to low-confidentiality and low-integrity effects on the backend database; there is no evidence of active exploitation, and the affected product is a niche PHP application with a very small deployment footprint, making broad opportunistic targeting unlikely.
Cross-site scripting (XSS) in the Category Update function (/admin/update_category.php) of SourceCodester Online Food Ordering System 1.0 allows an authenticated administrator to inject script payloads that execute in the browser when the manipulated category page is rendered, requiring user interaction. Publicly available exploit code exists, but the high-privilege prerequisite (admin access) and limited integrity-only impact make this a low-severity admin self-XSS scenario; no active exploitation (CISA KEV) is indicated.
Unrestricted file upload in SourceCodester Online Faculty Clearance System 1.0 allows authenticated remote attackers to upload arbitrary files - including PHP webshells - via the profile picture upload endpoint at production/edit_picture.php, leading to remote code execution on the host server. The vulnerability stems from PHP's move_uploaded_file() being called without validating file type or extension. A public proof-of-concept exploit exists (GitHub issue linked from VulDB). No KEV listing; EPSS data not provided in source intelligence.
Unauthenticated remote SQL injection in SourceCodester Online Faculty Clearance System 1.0 allows an attacker to inject arbitrary SQL through the ID argument of /delete_faculty1.php, exposing or destroying records in the underlying database. The CVSS 4.0 vector rates network-reachable, low-complexity, no-privilege, no-interaction exploitation with low confidentiality, integrity and availability impact (base 5.5), and publicly available exploit code exists, so unpatched internet-facing instances are immediately at risk. No CISA KEV entry or EPSS score was supplied, so there is no confirmed evidence of active exploitation in the wild at time of analysis.
Unauthenticated SQL injection in SourceCodester Online Faculty Clearance System 1.0 allows remote attackers to inject arbitrary SQL through the ID argument of /delete_requirement.php, giving them read and write access to the application's clearance records. Publicly available exploit code exists (GitHub OnlyCMJB/cve issue 2), and the flaw is tracked by VulDB and ENISA EUVD, but CISA KEV does not list it as actively exploited. Because this is a demo-grade PHP application distributed as downloadable source with no vendor patch channel identified, exposure is concentrated among institutions that deployed it as-is on an internet-facing web server.
Unrestricted file upload in SourceCodester College Notes Gallery Management System 1.0 allows an authenticated remote attacker to upload arbitrary file types through the profile image parameter at /dashboard/userprofile.php. Because the application is PHP-based, this flaw (CWE-434) creates a realistic path to remote code execution if a PHP webshell is uploaded to a web-accessible directory. A public proof-of-concept exploit exists on GitHub, lowering the bar for exploitation. No active exploitation (CISA KEV) has been reported, and the affected product is a small educational PHP application with limited production footprint.
SQL injection in SourceCodester/katojkalemba Online Food Ordering System 1.0 allows remote unauthenticated attackers to manipulate the `id` parameter in `/web/order.php` to inject arbitrary SQL, achieving partial read and write access to the underlying database. The CVSS 4.0 vector carries an E:P modifier confirming public exploit code is available, lowering the barrier to exploitation significantly. No vendor patch has been identified at time of analysis, and no CISA KEV listing exists.
SQL injection in SourceCodester Online Food Ordering System 1.0 allows any unauthenticated remote attacker to manipulate the database through the unsanitized `ID` parameter of `/web/category-foods.php`. A public exploit has been released, enabling database extraction, record modification, or deletion without any authentication. No vendor patch has been identified at time of analysis.
Unauthenticated SQL injection in the login handler (/College/login.php) of SourceCodester College Notes Gallery Management System 1.0 allows remote attackers to inject arbitrary SQL through the 'User' parameter. Publicly available exploit code exists (disclosed via a GitHub issue referenced by VulDB), and successful abuse can bypass authentication and expose or corrupt the backend database. The CVSS 4.0 base score is 5.5 with the E:P threat metric, reflecting limited but real confidentiality, integrity, and availability impact.
Authorization bypass via Insecure Direct Object Reference (IDOR) in SourceCodester Inventory Management System 1.0 allows authenticated remote attackers to access arbitrary invoice records by manipulating the ID parameter in invoice.php. The flaw is classified as CWE-639 (Authorization Bypass Through User-Controlled Key), meaning the application trusts a user-supplied identifier to gate access without server-side ownership verification. A publicly available proof-of-concept exploit exists on GitHub; no public KEV or active exploitation has been confirmed at the time of analysis.
Stored cross-site scripting in SourceCodester Inventory Management System 1.0 allows an authenticated remote attacker to inject malicious scripts via the Product_Name parameter handled by /api/products_handler.php in the Product Management Module. When other authenticated users subsequently view affected product listings, the injected payload executes in their browsers, enabling session hijacking, credential theft, or UI redressing. A public proof-of-concept exploit is available on GitHub, lowering the bar for exploitation by non-expert attackers.
Cross-site scripting in SourceCodester Inventory Management System 1.0 allows authenticated remote attackers to inject and execute arbitrary client-side scripts via the `/api/vendors_handler.php` Vendor Management endpoint. A public proof-of-concept exploit has been published on GitHub (gist by fhewm98), confirming the issue is reproducible. Exploitation requires low-privilege authentication and victim interaction, limiting blast radius, but successful attacks can hijack sessions, redirect users, or perform unauthorized actions on behalf of the victim.
Reflected or stored cross-site scripting in SourceCodester Inventory Management System 1.0 allows an authenticated remote attacker to inject malicious JavaScript via the Customer_Name parameter in the Customer Management Module's /api/customers_handler.php endpoint. When a second user (such as an administrator) loads the affected customer record, the payload executes in their browser, enabling session hijacking or unauthorized actions on their behalf. A public proof-of-concept exploit is available on GitHub; no active exploitation (KEV) has been confirmed.
SQL injection in SourceCodester School Registration and Fee System 1.0 allows unauthenticated remote attackers to read, modify, or delete database contents via the Category parameter in /bilal/save_class.php. A public proof-of-concept exploit has been disclosed on GitHub, lowering the skill threshold for exploitation. No KEV listing exists, but the combination of unauthenticated network access and a publicly available exploit makes this an active concern for any deployed instance.
SQL injection in SourceCodester School Registration and Fee System 1.0 allows remote unauthenticated attackers to manipulate database queries via the `period` parameter of `/bilal/normal/pay_report.php`. A public proof-of-concept exploit has been published on GitHub (vuldb.com/submit/912055, github.com/zuojiu567/cve/issues/3), lowering the bar for exploitation significantly. No vendor patch has been identified at time of analysis, leaving deployments exposed with no vendor-supplied remediation path.
SQL injection in SourceCodester School Registration and Fee System 1.0 exposes the student deletion endpoint (/bilal/normal/delete_stud.php) to remote unauthenticated attackers through an unsanitized PHP array parameter `selector[]`. A proof-of-concept exploit is publicly available via GitHub, enabling attackers to read or manipulate the underlying MySQL/MariaDB database. The CVSS 4.0 score of 6.9 (Medium) reflects per-axis Low impact across confidentiality, integrity, and availability, consistent with a PHP application database rather than a critical infrastructure system; no KEV listing indicates no confirmed mass exploitation at time of analysis.
Cross-site scripting in SourceCodester Simple Traffic Offense System 1.0 allows remote attackers to inject arbitrary JavaScript via the site_name and site_desc parameters of the save-settings.php Settings Update Endpoint. The injected payload is stored server-side and executes in the browser of any user who subsequently loads the affected page. A public proof-of-concept exploit has been disclosed on GitHub (issue #3 in tan1540684326-QAQ/cve), confirming the vulnerability is reproducible.
Unauthenticated remote user deletion is possible in SourceCodester Simple Traffic Offense System 1.0 via the delete-user.php endpoint, which processes a user-supplied ID parameter without any session or privilege check. An attacker with HTTP access to the application can delete arbitrary user accounts without logging in, impacting data integrity and application availability. A publicly available proof-of-concept exploit exists on GitHub (no public exploit identified at time of analysis applies to KEV only - PoC is confirmed); the vulnerability is not listed in CISA KEV.
Missing authentication in SourceCodester Simple Traffic Offense System 1.0 allows unauthenticated remote attackers to create arbitrary user accounts by manipulating the `position` argument in `saveuser.php`. The user-creation endpoint fails to enforce any authentication gate (CWE-306), exposing it to direct network exploitation with no prerequisites. A public proof-of-concept exploit exists, raising the practical risk beyond what the moderate CVSS 4.0 score of 6.9 might suggest.
SQL injection in SourceCodester Online Voting System 1.0 allows unauthenticated remote attackers to read and manipulate the application database through the /voting/ajax.php?action=save_category endpoint. The Category parameter is passed directly into a backend SQL query without sanitization or parameterization, enabling classic error-based or UNION-based injection. A public proof-of-concept exploit is available on GitHub, making opportunistic exploitation trivially reproducible with no authentication required.
Cross-site request forgery in SourceCodester Syllabus-Aligned Learning Management & Examination System 1.0 allows a remote unauthenticated attacker to perform unauthorized state-changing actions on behalf of an authenticated victim by tricking them into visiting a malicious page. The vulnerability stems from missing CSRF tokens on one or more application functions, as documented in a public exploit report filed under VULN-08-CSRF-Missing-Tokens. A proof-of-concept exploit is publicly available on GitHub, though no active exploitation has been confirmed by CISA KEV.
Cleartext storage of sensitive database credentials and user data in SourceCodester Syllabus-Aligned Learning Management & Examination System 1.0 exposes plaintext secrets via the `cict_portal.sql` file. The SQL dump file, commonly placed within the web-accessible directory in SourceCodester PHP projects, can be retrieved directly over the network without authentication, leaking whatever credentials or personal data it contains. A public proof-of-concept exploit is available on GitHub, confirmed by VulDB and the referenced researcher report, raising the practical exploitation risk above what the moderate CVSS 4.0 score of 6.9 might suggest at first glance.
Session fixation in SourceCodester Syllabus-Aligned Learning Management & Examination System 1.0 allows unauthenticated remote attackers to pre-plant a session identifier via the auth_process.php login endpoint, then hijack the authenticated session after a victim logs in. The auth_process.php component fails to regenerate the session ID upon successful authentication, enabling full account takeover of any user who can be socially engineered into authenticating through a crafted link. A public exploit PoC exists on GitHub; no vendor patch has been released.
Cross-site scripting in SourceCodester Syllabus-Aligned Learning Management & Examination System 1.0 allows remote unauthenticated attackers to inject arbitrary JavaScript via the msg, title, or content parameters in manage_subjects.php. A public proof-of-concept on GitHub documents both reflected and stored XSS variants, confirming the vulnerability is exploitable and the details are widely available. No vendor-released patch has been identified, and no active exploitation has been confirmed via CISA KEV.
Unauthenticated IDOR (Insecure Direct Object Reference) in SourceCodester Syllabus-Aligned Learning Management & Examination System 1.0 allows remote attackers to delete arbitrary exam records by manipulating the `ID` parameter in `delete_exam.php` without any authorization check. Any network-accessible attacker can iterate over exam IDs to destroy examination data belonging to other users or system administrators. A public proof-of-concept exploit has been disclosed on GitHub, lowering the bar for opportunistic abuse.
Hard-coded database credentials embedded in db.php of SourceCodester Syllabus-Aligned Learning Management & Examination System 1.0 allow unauthenticated remote attackers to obtain and reuse valid database credentials without any prior authentication. The credentials, baked directly into the PHP source file, are exposed to any party who can read or retrieve that file over the network. Publicly available exploit code has been published per the VulDB submission and a GitHub vulnerability report covering the same product, elevating this beyond a theoretical risk.
Unauthenticated privilege escalation in SourceCodester Syllabus-Aligned Learning Management & Examination System 1.0 allows remote attackers to register as privileged users - including administrator - by manipulating the `role` parameter in the `register` function of `auth.php`. Because the application fails to enforce server-side role validation during self-registration, any unauthenticated user can tamper the role field to claim elevated privileges at account creation time. A public proof-of-concept exploit is available on GitHub, lowering the bar for opportunistic exploitation.
SQL injection in SourceCodester Class and Exam Timetabling System 1.0 allows remote attackers to manipulate database queries via the room_name parameter passed to the mysqli_query() call in /admin/modal_add_room.php. Exploitation yields limited data disclosure and modification (VC:L/VI:L per CVSS 4.0), consistent with a classic unsanitized input flaw in a PHP/MySQL stack. A public proof-of-concept is available on GitHub, no vendor patch has been identified, and no active exploitation (CISA KEV) has been confirmed.
Unauthenticated SQL injection in SourceCodester Class and Exam Timetabling System 1.0 exposes the application to full database read and write via the `fname` parameter in `/admin/modal_add_product.php`. The underlying `mysqli_query` call accepts unsanitized user input, allowing remote attackers to craft malicious SQL payloads without any authentication. A public exploit has been disclosed on GitHub, materially increasing the likelihood of opportunistic exploitation.
SQL injection in SourceCodester Class and Exam Timetabling System 1.0 allows remote unauthenticated attackers to manipulate backend database queries via the unsanitized `course` parameter passed directly to mysqli_query in /admin/modal_add_coursea.php. The vulnerability carries limited but confirmed data exposure and integrity risk (VC:L/VI:L/VA:L per CVSS 4.0). A public proof-of-concept exploit was published to GitHub, lowering the bar for exploitation significantly. No vendor patch has been identified.
SQL injection in SourceCodester Class and Exam Timetabling System 1.0 exposes the `course` parameter in `/admin/modal_add_course2.php` to unauthenticated remote attackers who can manipulate the underlying MySQL database. The vulnerability is rooted in direct, unsanitized input concatenation into a `mysqli_query()` call, yielding bounded but real read, write, and partial availability impact. A proof-of-concept exploit has been publicly disclosed on GitHub, materially lowering the exploitation barrier.
SQL injection in SourceCodester Class and Exam Timetabling System 1.0 exposes the database to unauthenticated remote attackers via the `course` parameter passed to `mysqli_query()` in `/admin/modal_add_course1.php`. An attacker can craft a malicious HTTP request to read, modify, or delete database contents without prior authentication, as confirmed by a publicly available proof-of-concept exploit. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N) reflects straightforward remote exploitation with no special conditions, though limited CIA impact scores (VC:L/VI:L/VA:L) suggest partial rather than full database compromise.
SQL injection in SourceCodester Class and Exam Timetabling System 1.0 allows unauthenticated remote attackers to execute arbitrary SQL against the application database through the unvalidated `course` parameter in `/admin/modal_add_course.php`. The `mysqli_query` function receives attacker-controlled input without parameterization or sanitization, enabling full database extraction, credential theft, and record manipulation. A public proof-of-concept exploit is available on GitHub; no vendor patch has been identified at time of analysis.
SQL injection in SourceCodester Class and Exam Timetabling System 1.0 exposes the `/delete_user_account.php` endpoint to unauthenticated remote exploitation via an unsanitized `id` parameter. The flaw allows attackers to read, modify, or delete underlying database records without any authentication credential. A public proof-of-concept exploit is available via GitHub, materially elevating practical risk beyond what the moderate CVSS 4.0 score of 6.9 might suggest at face value.
Unauthenticated SQL injection in SourceCodester Class and Exam Timetabling System 1.0 allows remote attackers to manipulate the database through the ID parameter in /delete_user.php. The vulnerability requires no privileges or user interaction, and a public proof-of-concept exploit has been published on GitHub. Impact is limited by the CVSS 4.0 assessment (VC:L/VI:L/VA:L), suggesting partial data read/write rather than full database compromise, though chained exploitation could escalate impact.
SQL injection in SourceCodester Class and Exam Timetabling System 1.0 exposes the /delete_teacher.php endpoint to unauthenticated remote database manipulation via an unsanitized ID parameter (CWE-89). A proof-of-concept exploit has been publicly released on GitHub, making opportunistic exploitation straightforward for low-skilled attackers. Attackers with network access to the application can extract, modify, or delete records from the underlying database without supplying credentials.