60
CVEs
10
Critical
2
High
0
KEV
60
PoC
12
Unpatched C/H
0.0%
Patch Rate
0.0%
Avg EPSS
Severity Breakdown
CRITICAL
10
HIGH
2
MEDIUM
22
LOW
26
Monthly CVE Trend
Affected Products (28)
PHP
110
Simple Pizza Ordering System
18
Church Donation System
14
Intern Membership Management System
13
Online Event Judging System
10
Simple Flight Ticket Booking System
9
Simple Stock System
6
Food Ordering Review System
5
Simple Student Alumni System
5
Computer Book Store
5
Simple Food Order System
4
Traffic Offense Reporting System
4
Computer Laboratory System
4
Staff Audit System
4
Student Web Portal
3
Simple Leave Manager
2
Question Paper Generator
2
Prison Management System
2
Agro School Management System
2
Movie Ticketing System
2
Java
1
Simple Gym Management System
1
Rental Management System
1
Computer Science Time Table System
1
Fruit Shop Management System
1
Daily Time Recording System
1
Student Result Manager
1
Online Exam Mastering System
1
Top Risky CVEs
| CVE | Summary | Severity | CVSS | EPSS | Priority | Signals |
|---|---|---|---|---|---|---|
| CVE-2025-60307 | Authentication bypass via SQL injection in code-projects Computer Laboratory System 1.0 allows a remote unauthenticated attacker to log in as a valid user by submitting a crafted 'universal password' in the login form's Password field. The injected SQL manipulates the login query so the authentication check always evaluates true, granting access without valid credentials. Publicly available exploit code exists (PoC published on GitHub), though the low EPSS score (0.42%, 34th percentile) and absence from CISA KEV indicate no confirmed active exploitation at time of analysis. | CRITICAL | 9.8 | 0.4% | 69 |
PoC
No patch
|
| CVE-2025-69559 | Computer Book Store v1.0 has file upload in admin_add.php. | CRITICAL | 9.8 | 0.1% | 69 |
PoC
No patch
|
| CVE-2026-26694 | Simple Student Alumni System v1.0 has SQL injection in modal_view.php. | CRITICAL | 9.8 | 0.0% | 69 |
PoC
No patch
|
| CVE-2026-26695 | Simple Student Alumni System v1.0 has SQL injection in record_search.php. | CRITICAL | 9.8 | 0.0% | 69 |
PoC
No patch
|
| CVE-2026-26696 | Simple Student Alumni System v1.0 has a third SQL injection. | CRITICAL | 9.8 | 0.0% | 69 |
PoC
No patch
|
| CVE-2026-26709 | Simple Gym Management System v1.0 has SQL injection in trainer search. | CRITICAL | 9.8 | 0.0% | 69 |
PoC
No patch
|
| CVE-2026-26710 | Simple Food Order System v1.0 has SQL injection in edit-order. | CRITICAL | 9.8 | 0.0% | 69 |
PoC
No patch
|
| CVE-2026-26711 | Simple Food Order System v1.0 has SQL injection in view-ticket. | CRITICAL | 9.8 | 0.0% | 69 |
PoC
No patch
|
| CVE-2026-26712 | Simple Food Order System v1.0 has SQL injection in view-ticket-admin. | CRITICAL | 9.8 | 0.0% | 69 |
PoC
No patch
|
| CVE-2026-26713 | Simple Food Order System v1.0 has SQL injection in cancel-order. | CRITICAL | 9.8 | 0.0% | 69 |
PoC
No patch
|
| CVE-2026-2158 | SQL injection in the Student Web Portal 1.0 /check_user.php endpoint allows unauthenticated remote attackers to manipulate the Username parameter and execute arbitrary database queries. The vulnerability enables attackers to read, modify, or delete sensitive data with public exploit code readily available. This affects PHP-based installations of the Student Web Portal with no patch currently available. | HIGH | 7.3 | 0.0% | 57 |
PoC
No patch
|
| CVE-2025-56295 | code-projects Computer Laboratory System 1.0 has a file upload vulnerability. Rated high severity (CVSS 7.3), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available. | HIGH | 7.3 | 0.0% | 57 |
PoC
No patch
|
| CVE-2025-13323 | A security flaw has been discovered in code-projects Simple Pizza Ordering System 1.0. Rated medium severity (CVSS 6.9), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available. | MEDIUM | 5.5 | 0.1% | 48 |
PoC
No patch
|
| CVE-2025-13583 | A weakness has been identified in code-projects Question Paper Generator 1.0. Rated medium severity (CVSS 6.9), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available. | MEDIUM | 5.5 | 0.1% | 48 |
PoC
No patch
|
| CVE-2025-14590 | SQL injection vulnerability in code-projects Prison Management System 2.0 allows remote attackers to manipulate the keyname parameter in /admin/search1.php, potentially leading to low-impact data exposure and modification. The vulnerability is publicly known with exploit code available, but no active exploitation has been reported. EPSS predicts a 0.05% chance of exploitation. | MEDIUM | 5.5 | 0.1% | 48 |
PoC
No patch
|