121
CVEs
12
Critical
11
High
0
KEV
116
PoC
23
Unpatched C/H
0.0%
Patch Rate
0.1%
Avg EPSS
Severity Breakdown
CRITICAL
12
HIGH
11
MEDIUM
59
LOW
39
Monthly CVE Trend
Affected Products (28)
PHP
110
Simple Pizza Ordering System
18
Church Donation System
14
Intern Membership Management System
13
Online Event Judging System
10
Simple Flight Ticket Booking System
9
Simple Stock System
6
Food Ordering Review System
5
Simple Student Alumni System
5
Computer Book Store
5
Simple Food Order System
4
Traffic Offense Reporting System
4
Computer Laboratory System
4
Staff Audit System
4
Student Web Portal
3
Simple Leave Manager
2
Question Paper Generator
2
Prison Management System
2
Agro School Management System
2
Movie Ticketing System
2
Java
1
Simple Gym Management System
1
Rental Management System
1
Computer Science Time Table System
1
Fruit Shop Management System
1
Daily Time Recording System
1
Student Result Manager
1
Online Exam Mastering System
1
Top Risky CVEs
| CVE | Summary | Severity | CVSS | EPSS | Priority | Signals |
|---|---|---|---|---|---|---|
| CVE-2025-25914 | SQL injection vulnerability in Online Exam Mastering System v.1.0 allows a remote attacker to execute arbitrary code via the fid parameter. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available. | CRITICAL | 9.8 | 1.0% | 70 |
PoC
No patch
|
| CVE-2025-60307 | Authentication bypass via SQL injection in code-projects Computer Laboratory System 1.0 allows a remote unauthenticated attacker to log in as a valid user by submitting a crafted 'universal password' in the login form's Password field. The injected SQL manipulates the login query so the authentication check always evaluates true, granting access without valid credentials. Publicly available exploit code exists (PoC published on GitHub), though the low EPSS score (0.42%, 34th percentile) and absence from CISA KEV indicate no confirmed active exploitation at time of analysis. | CRITICAL | 9.8 | 0.4% | 69 |
PoC
No patch
|
| CVE-2025-69559 | Computer Book Store v1.0 has file upload in admin_add.php. | CRITICAL | 9.8 | 0.1% | 69 |
PoC
No patch
|
| CVE-2026-26694 | Simple Student Alumni System v1.0 has SQL injection in modal_view.php. | CRITICAL | 9.8 | 0.0% | 69 |
PoC
No patch
|
| CVE-2026-26695 | Simple Student Alumni System v1.0 has SQL injection in record_search.php. | CRITICAL | 9.8 | 0.0% | 69 |
PoC
No patch
|
| CVE-2026-26696 | Simple Student Alumni System v1.0 has a third SQL injection. | CRITICAL | 9.8 | 0.0% | 69 |
PoC
No patch
|
| CVE-2026-26709 | Simple Gym Management System v1.0 has SQL injection in trainer search. | CRITICAL | 9.8 | 0.0% | 69 |
PoC
No patch
|
| CVE-2026-26710 | Simple Food Order System v1.0 has SQL injection in edit-order. | CRITICAL | 9.8 | 0.0% | 69 |
PoC
No patch
|
| CVE-2026-26711 | Simple Food Order System v1.0 has SQL injection in view-ticket. | CRITICAL | 9.8 | 0.0% | 69 |
PoC
No patch
|
| CVE-2026-26712 | Simple Food Order System v1.0 has SQL injection in view-ticket-admin. | CRITICAL | 9.8 | 0.0% | 69 |
PoC
No patch
|
| CVE-2026-26713 | Simple Food Order System v1.0 has SQL injection in cancel-order. | CRITICAL | 9.8 | 0.0% | 69 |
PoC
No patch
|
| CVE-2024-25251 | code-projects Agro-School Management System 1.0 is suffers from Incorrect Access Control. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available. | HIGH | 8.8 | 0.7% | 64 |
PoC
No patch
|
| CVE-2025-6361 | CVE-2025-6361 is a critical SQL injection vulnerability in code-projects Simple Pizza Ordering System version 1.0, affecting the /adds.php file's userid parameter. An unauthenticated remote attacker can exploit this vulnerability without user interaction to execute arbitrary SQL queries, potentially leading to unauthorized data access, modification, or deletion of the application database. The vulnerability has a CVSS score of 7.3 (High) and represents an immediate risk to any organization running this unpatched system in production. | HIGH | 7.3 | 0.1% | 57 |
PoC
No patch
|
| CVE-2025-6362 | CVE-2025-6362 is a critical SQL injection vulnerability in code-projects Simple Pizza Ordering System version 1.0, specifically in the /editpro.php file where the ID parameter is improperly validated. An unauthenticated remote attacker can exploit this vulnerability to execute arbitrary SQL queries, potentially leading to unauthorized data access, modification, or system compromise. The vulnerability has a CVSS score of 7.3 (High) and requires no user interaction or authentication, making it a significant risk for deployments of this application. | HIGH | 7.3 | 0.1% | 57 |
PoC
No patch
|
| CVE-2025-6363 | CVE-2025-6363 is a critical SQL injection vulnerability in code-projects Simple Pizza Ordering System version 1.0, specifically in the /adding-exec.php file where the 'ingname' parameter is improperly sanitized. An unauthenticated remote attacker can exploit this vulnerability to execute arbitrary SQL queries, potentially leading to unauthorized data access, modification, or deletion of database records. With a CVSS score of 7.3 and network-based attack vector requiring no user interaction, this vulnerability poses significant risk to affected deployments, though real-world exploitation likelihood depends on whether POC code and active exploitation attempts are documented. | HIGH | 7.3 | 0.1% | 57 |
PoC
No patch
|