642
CVEs
20
Critical
20
High
0
KEV
577
PoC
40
Unpatched C/H
0.0%
Patch Rate
0.3%
Avg EPSS
Severity Breakdown
CRITICAL
20
HIGH
20
MEDIUM
469
LOW
133
Monthly CVE Trend
Affected Products (30)
PHP
576
Exam Form Submission
28
Simple Laundry System
24
Patient Record Management System
23
Inventory Management System
21
Library System
20
Online Shoe Store
20
Blood Bank System
17
Employee Management System
17
Simple Admin Panel
14
Pharmacy Management System
14
Online Restaurant Management System
14
Vehicle Showroom Management System
12
Modern Bag
11
Blood Bank Management System
11
Content Management System
11
Point Of Sales And Inventory Management System
10
Simple School Management System
9
Simple It Discussion Forum
9
Vehicle Management
9
Blood Bank
9
Fighting Cock Information System
9
Restaurant Reservation System
8
Online Class And Exam Scheduling System
8
Chat System
8
Crime Reporting System
7
Human Resource Integrated System
7
Crud Operation System
7
Online Music Site
6
Hospital Information System
6
Top Risky CVEs
| CVE | Summary | Severity | CVSS | EPSS | Priority | Signals |
|---|---|---|---|---|---|---|
| CVE-2024-57487 | In Code-Projects Online Car Rental System 1.0, the file upload feature does not validate file extensions or MIME types allowing an attacker to upload a PHP shell without any restrictions and execute. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Epss exploitation probability 45.1% and no vendor patch available. | MEDIUM | 6.5 | 45.1% | 113 |
PoC
No patch
|
| CVE-2025-60306 | Privilege escalation in code-projects Simple Car Rental System 1.0 lets an authenticated low-privilege user forge a high-privilege (administrator) session and invoke sensitive operations reserved for privileged accounts. The flaw is a broken access-control / authentication-bypass issue (CWE-284) with a publicly available exploit, though it is not listed in CISA KEV and carries a low EPSS probability (0.38%, 30th percentile), indicating limited real-world exploitation to date. Any user able to authenticate at a basic level can effectively take over administrative functionality. | CRITICAL | 9.9 | 0.4% | 70 |
PoC
No patch
|
| CVE-2023-1416 | A vulnerability classified as critical has been found in Simple Art Gallery 1.0. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available. | CRITICAL | 9.8 | 0.8% | 69 |
PoC
No patch
|
| CVE-2023-1499 | A vulnerability classified as critical was found in code-projects Simple Art Gallery 1.0. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available. | CRITICAL | 9.8 | 0.7% | 69 |
PoC
No patch
|
| CVE-2023-37627 | Code-projects Online Restaurant Management System 1.0 is vulnerable to SQL Injection. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available. | CRITICAL | 9.8 | 0.9% | 69 |
PoC
No patch
|
| CVE-2023-48078 | SQL Injection vulnerability in add.php in Simple CRUD Functionality v1.0 allows attackers to run arbitrary SQL commands via the 'title' parameter. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available. | CRITICAL | 9.8 | 0.8% | 69 |
PoC
No patch
|
| CVE-2024-25307 | Code-projects Cinema Seat Reservation System 1.0 allows SQL Injection via the 'id' parameter at "/Cinema-Reservation/booking.php?id=1.". Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available. | CRITICAL | 9.8 | 0.7% | 69 |
PoC
No patch
|
| CVE-2024-25220 | Task Manager App v1.0 was discovered to contain a SQL injection vulnerability via the taskID parameter at /TaskManager/EditTask.php. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available. | CRITICAL | 9.8 | 0.7% | 69 |
PoC
No patch
|
| CVE-2024-25222 | Task Manager App v1.0 was discovered to contain a SQL injection vulnerability via the projectID parameter at /TaskManager/EditProject.php. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available. | CRITICAL | 9.8 | 0.7% | 69 |
PoC
No patch
|
| CVE-2024-25223 | Simple Admin Panel App v1.0 was discovered to contain a SQL injection vulnerability via the orderID parameter at /adminView/viewEachOrder.php. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available. | CRITICAL | 9.8 | 0.6% | 69 |
PoC
No patch
|
| CVE-2024-1827 | A vulnerability was found in code-projects Library System 1.0 and classified as critical.php. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available. | CRITICAL | 9.8 | 0.7% | 69 |
PoC
No patch
|
| CVE-2024-1828 | A vulnerability was found in code-projects Library System 1.0. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available. | CRITICAL | 9.8 | 0.7% | 69 |
PoC
No patch
|
| CVE-2024-1829 | A vulnerability was found in code-projects Library System 1.0. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available. | CRITICAL | 9.8 | 0.8% | 69 |
PoC
No patch
|
| CVE-2024-1830 | A vulnerability was found in code-projects Library System 1.0. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available. | CRITICAL | 9.8 | 0.8% | 69 |
PoC
No patch
|
| CVE-2024-34955 | Code-projects Budget Management 1.0 is vulnerable to SQL Injection via the delete parameter. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available. | CRITICAL | 9.8 | 0.6% | 69 |
PoC
No patch
|