19
CVEs
0
Critical
1
High
0
KEV
19
PoC
1
Unpatched C/H
0.0%
Patch Rate
0.0%
Avg EPSS
Severity Breakdown
CRITICAL
0
HIGH
1
MEDIUM
1
LOW
17
Monthly CVE Trend
Affected Products (16)
Top Risky CVEs
| CVE | Summary | Severity | CVSS | EPSS | Priority | Signals |
|---|---|---|---|---|---|---|
| CVE-2019-25505 | Tradebox 5.4 contains an SQL injection vulnerability that allows authenticated attackers to manipulate database queries by injecting SQL code through the symbol parameter. [CVSS 7.1 HIGH] | HIGH | 7.1 | 0.0% | 56 |
PoC
No patch
|
| CVE-2021-47769 | Isshue Shopping Cart 3.5 contains a persistent cross-site scripting vulnerability in title input fields across stock, customer, and invoice modules. [CVSS 4.8 MEDIUM] | MEDIUM | 4.8 | 0.0% | 44 |
PoC
No patch
|
| CVE-2025-13239 | A security vulnerability has been detected in Bdtask/CodeCanyon Isshue Multi Store eCommerce Shopping Cart Solution 5. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available. | LOW | 2.1 | 0.1% | 31 |
PoC
No patch
|
| CVE-2025-13179 | A vulnerability has been found in Bdtask/CodeCanyon Wholesale Inventory Control and Inventory Management System up to 20250320. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available. | LOW | 2.1 | 0.1% | 31 |
PoC
No patch
|
| CVE-2025-13177 | A vulnerability was detected in Bdtask/CodeCanyon SalesERP up to 20250728. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available. | LOW | 2.1 | 0.1% | 31 |
PoC
No patch
|
| CVE-2025-13238 | A weakness has been identified in Bdtask Flight Booking Software 4. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available. | LOW | 2.1 | 0.1% | 31 |
PoC
No patch
|
| CVE-2025-12223 | Unrestricted file upload in Bdtask Flight Booking Software up to version 3.1 via the Package Information Module endpoint /b2c/package-information allows authenticated remote attackers to upload arbitrary files with low confidentiality and integrity impact. Publicly available exploit code exists; the vulnerability carries a low CVSS score (2.1) due to requiring prior authentication and limited scope, but the ease of exploitation (AC:L, public POC) and vendor non-responsiveness elevate practical risk for deployed instances. | LOW | 2.1 | 0.1% | 31 |
PoC
No patch
|
| CVE-2026-1600 | Bhojon Restaurant Management System versions up to 20260116 contain a price manipulation vulnerability in the add-to-cart endpoint that allows authenticated attackers to bypass business logic controls. Public exploit code exists for this issue, and the vendor has not provided a patch despite early notification. While the direct impact is limited to price modification, this could enable financial fraud through order manipulation. | LOW | 2.1 | 0.0% | 31 |
PoC
No patch
|
| CVE-2026-1597 | Improper authorization in Bdtask SalesERP's administrative endpoint allows authenticated attackers to manipulate the ci_session parameter and gain unauthorized access to restricted functions. Public exploit code exists for this vulnerability, and no patch is currently available from the vendor. Affected versions through January 16, 2026 enable remote exploitation by any user with valid credentials. | LOW | 2.1 | 0.0% | 31 |
PoC
No patch
|
| CVE-2025-12288 | Authorization bypass in Bdtask Pharmacy Management System up to version 9.4 allows authenticated remote attackers to manipulate user profile data via the /user/edit_user/ endpoint, escalating privileges or modifying other users' accounts without proper access controls. The vulnerability has publicly available exploit code and affects the User Profile Handler component, though vendor response to disclosure has been absent. | LOW | 2.1 | 0.0% | 31 |
PoC
No patch
|
| CVE-2026-10172 | Unrestricted file upload in Bdtask Multi-Store Inventory Management System 1.0 enables authenticated remote attackers to upload arbitrary file types - including PHP webshells - through the Component Module's Upload function, leading to potential remote code execution on the host server. The vulnerability resides in application/modules/dashboard/controllers/Module.php where the Upload function performs insufficient file type validation. A public proof-of-concept exploit has been released on GitHub, elevating the practical risk beyond the moderate CVSS 6.3 score. No vendor patch has been identified at time of analysis. | LOW | 2.1 | 0.0% | 31 |
PoC
No patch
|
| CVE-2025-12222 | Unrestricted file upload in Bdtask Flight Booking Software up to version 3.1 allows authenticated remote attackers to upload arbitrary files via the /admin/transaction/deposit endpoint. The vulnerability requires valid user credentials (PR:L in CVSS vector) but grants attackers capability to upload files with minimal scope impact. Public exploit code is available, though the very low EPSS score (0.02%) and lack of CISA KEV listing suggest limited real-world exploitation despite disclosure. | LOW | 2.1 | 0.0% | 31 |
PoC
No patch
|
| CVE-2026-1599 | Bhojon versions up to 20260116. contains a vulnerability that allows attackers to business logic errors (CVSS 4.3). | LOW | 2.1 | 0.0% | 31 |
PoC
No patch
|
| CVE-2025-13185 | A security flaw has been discovered in Bdtask/CodeCanyon News365 up to 7.0.3. Rated medium severity (CVSS 5.1), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available. | LOW | 2.0 | 0.1% | 30 |
PoC
No patch
|
| CVE-2025-13178 | A flaw has been found in Bdtask/CodeCanyon SalesERP up to 20250728. Rated medium severity (CVSS 5.1), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available. | LOW | 2.0 | 0.0% | 30 |
PoC
No patch
|