19
CVEs
0
Critical
0
High
0
KEV
17
PoC
0
Unpatched C/H
0.0%
Patch Rate
0.0%
Avg EPSS
Severity Breakdown
CRITICAL
0
HIGH
0
MEDIUM
18
LOW
1
Monthly CVE Trend
Affected Products (8)
Top Risky CVEs
| CVE | Summary | Severity | CVSS | EPSS | Priority | Signals |
|---|---|---|---|---|---|---|
| CVE-2025-14649 | SQL injection in Online Cake Ordering System 1.0 allows remote attackers to manipulate database queries through the supplier parameter in /cakeshop/supplier.php. This can lead to unauthorized data access or modification. Public exploit code is available, but no active exploitation has been reported. | MEDIUM | 5.5 | 0.1% | 48 |
PoC
No patch
|
| CVE-2025-14650 | SQL injection in itsourcecode Online Cake Ordering System 1.0 allows remote unauthenticated attackers to manipulate database queries via the 'Product' parameter of /cakeshop/product.php. Publicly available exploit code exists, though EPSS indicates low probability of widespread exploitation. No vendor patch is available. | MEDIUM | 5.5 | 0.1% | 48 |
PoC
No patch
|
| CVE-2025-14652 | SQL injection in itsourcecode Online Cake Ordering System 1.0 allows remote unauthenticated attackers to manipulate database queries via the ID parameter of the /admindetail.php?action=edit endpoint, potentially leading to low-impact data exposure or modification. A publicly available proof-of-concept exploit exists, though EPSS indicates low exploitation probability (0.05%). | MEDIUM | 5.5 | 0.1% | 48 |
PoC
No patch
|
| CVE-2025-14832 | SQL injection in itsourcecode Online Cake Ordering System 1.0 allows remote, unauthenticated attackers to inject arbitrary SQL commands via the ID argument in /updateproduct.php?action=edit. Exploit code is publicly available, but no active exploitation has been reported through CISA KEV. | MEDIUM | 5.5 | 0.1% | 48 |
PoC
No patch
|
| CVE-2025-15165 | SQL injection in Online Cake Ordering System 1.0 allows remote attackers to manipulate the ID parameter in /updatecustomer.php?action=edit to execute arbitrary SQL commands against the backend database. The vulnerability affects version 1.0 and has a publicly available proof-of-concept exploit, though EPSS data indicates a low probability of exploitation (0.04%). No authentication is required, making exposed instances trivially exploitable for low-impact data access or modification. | MEDIUM | 5.5 | 0.0% | 48 |
PoC
No patch
|
| CVE-2025-15166 | SQL injection in itsourcecode Online Cake Ordering System 1.0 allows remote attackers to manipulate database queries via the ID parameter in /updatesupplier.php?action=edit, potentially compromising data confidentiality and integrity. Public exploit code is available, though no active exploitation has been confirmed. | MEDIUM | 5.5 | 0.0% | 48 |
PoC
No patch
|
| CVE-2025-15167 | SQL injection in Online Cake Ordering System 1.0 allows remote attackers to manipulate the ID parameter in /detailtransac.php, potentially leading to unauthorized database access. A publicly available exploit exists, but no active exploitation has been confirmed. The vulnerability has a low EPSS score (0.04%) and no KEV listing, lowering real-world urgency despite its remote unauthenticated nature. | MEDIUM | 5.5 | 0.0% | 48 |
PoC
No patch
|
| CVE-2026-3042 | SQL injection in itsourcecode Event Management System 1.0 allows unauthenticated remote attackers to manipulate the ID parameter in /admin/index.php and execute arbitrary SQL queries. Public exploit code exists for this vulnerability, and no patch is currently available. Attackers can leverage this to access, modify, or delete sensitive data with confidentiality, integrity, and availability impact. | MEDIUM | 5.5 | 0.0% | 48 |
PoC
No patch
|
| CVE-2026-3068 | Document Management System versions up to 1.0 contains a vulnerability that allows attackers to sql injection (CVSS 7.3). | MEDIUM | 5.5 | 0.0% | 48 |
PoC
No patch
|
| CVE-2026-3069 | SQL injection in itsourcecode Document Management System 1.0 via the field1 parameter in /edtlbls.php enables unauthenticated remote attackers to compromise data confidentiality, integrity, and availability. Public exploit code exists for this vulnerability, and no patch is currently available. The attack requires no user interaction and can be executed over the network with minimal complexity. | MEDIUM | 5.5 | 0.0% | 48 |
PoC
No patch
|
| CVE-2026-3133 | SQL injection in itsourcecode Document Management System 1.0 login functionality allows unauthenticated remote attackers to manipulate the Username parameter and execute arbitrary SQL queries. Public exploit code exists for this vulnerability, and no patch is currently available. The attack requires only network access with no user interaction, enabling attackers to potentially read, modify, or delete sensitive data within the application. | MEDIUM | 5.5 | 0.0% | 48 |
PoC
No patch
|
| CVE-2026-2689 | SQL injection in itsourcecode Event Management System 1.0's booking management interface allows unauthenticated remote attackers to manipulate database queries via the ID parameter in /admin/manage_booking.php. Public exploit code exists for this vulnerability, enabling potential unauthorized data access and modification. No patch is currently available to address this high-severity flaw affecting PHP-based deployments. | MEDIUM | 5.5 | 0.0% | 48 |
PoC
No patch
|
| CVE-2026-2690 | SQL injection in itsourcecode Event Management System 1.0's admin login endpoint allows unauthenticated remote attackers to manipulate the Username parameter and execute arbitrary database queries. Public exploit code exists for this vulnerability, enabling attackers to potentially extract sensitive data or compromise system integrity. No patch is currently available for affected PHP installations. | MEDIUM | 5.5 | 0.0% | 48 |
PoC
No patch
|
| CVE-2026-2691 | SQL injection in itsourcecode Event Management System 1.0 allows unauthenticated remote attackers to manipulate the ID parameter in /admin/manage_register.php, potentially leading to unauthorized data access, modification, or deletion. Public exploit code exists for this vulnerability, and no patch is currently available, creating significant risk for unpatched deployments. | MEDIUM | 5.5 | 0.0% | 48 |
PoC
No patch
|
| CVE-2026-3153 | SQL injection in itsourcecode Document Management System 1.0 via the Username parameter in /register.php allows unauthenticated remote attackers to execute arbitrary SQL queries. Public exploit code exists for this vulnerability, and no patch is currently available. Affected systems face potential data theft, modification, and denial of service through successful exploitation. | MEDIUM | 5.5 | 0.0% | 48 |
PoC
No patch
|