31
CVEs
0
Critical
0
High
0
KEV
31
PoC
0
Unpatched C/H
0.0%
Patch Rate
0.3%
Avg EPSS
Severity Breakdown
CRITICAL
0
HIGH
0
MEDIUM
21
LOW
10
Monthly CVE Trend
Affected Products (30)
PHP
575
Exam Form Submission
28
Simple Laundry System
24
Patient Record Management System
23
Inventory Management System
21
Library System
20
Online Shoe Store
20
Blood Bank System
17
Employee Management System
17
Simple Admin Panel
14
Online Restaurant Management System
14
Pharmacy Management System
14
Vehicle Showroom Management System
12
Content Management System
11
Modern Bag
11
Blood Bank Management System
11
Point Of Sales And Inventory Management System
10
Blood Bank
9
Simple School Management System
9
Vehicle Management
9
Simple It Discussion Forum
9
Fighting Cock Information System
9
Online Class And Exam Scheduling System
8
Restaurant Reservation System
8
Chat System
8
Crime Reporting System
7
Human Resource Integrated System
7
Crud Operation System
7
Online Music Site
6
Task Manager
6
Top Risky CVEs
| CVE | Summary | Severity | CVSS | EPSS | Priority | Signals |
|---|---|---|---|---|---|---|
| CVE-2026-85517 | Sensitive database exposure in code-projects Vehicle Management System 1.0 allows unauthenticated remote attackers to download the raw SQL database backup file at /vehicle_management.sql directly over HTTP, leaking the full application database contents. The backup file is stored in or under the web root with no access controls, making it trivially accessible to any internet-connected attacker. A public proof-of-concept is available, and no vendor patch has been identified at time of analysis. | MEDIUM | 5.5 | 0.5% | 48 |
PoC
No patch
|
| CVE-2026-76799 | Direct HTTP access to an exposed SQL database backup file in code-projects Login Registration System 1.0 allows unauthenticated remote attackers to download the raw database dump at /loginsystem/database/login_registration_system.sql, disclosing user credentials, schema details, and any sensitive data stored in the application database. This is a CWE-552 file exposure defect - the backup artifact is stored within the web-accessible document root with no access controls. No exploitation beyond a standard HTTP GET request is required. A public proof-of-concept exploit exists; no KEV listing at time of analysis. | MEDIUM | 5.5 | 0.4% | 48 |
PoC
No patch
|
| CVE-2026-86168 | SQL injection in code-projects Content Management System 1.0 allows unauthenticated remote attackers to manipulate database queries via the user_name parameter in /login.php. Because the vulnerable endpoint is the authentication form itself, successful exploitation can achieve authentication bypass - granting admin-level access without credentials - as well as full database enumeration. A public proof-of-concept exploit has been published to GitHub, materially lowering the bar for exploitation. | MEDIUM | 5.5 | 0.3% | 48 |
PoC
No patch
|
| CVE-2026-86180 | SQL injection in the Login component of code-projects Task Management System In PHP 1.0 exposes the application's database to unauthenticated remote attackers via the `email` parameter in `/index.php`. The root cause is unsanitized user input passed directly into a SQL query (CWE-89), enabling authentication bypass and arbitrary data extraction. A public proof-of-concept writeup has been published on GitHub, significantly lowering the exploitation barrier; no vendor patch has been identified. | MEDIUM | 5.5 | 0.3% | 48 |
PoC
No patch
|
| CVE-2026-75778 | SQL injection in code-projects Task Management System 1.0 exposes the login endpoint at /index.php to unauthenticated remote exploitation via the email parameter. The vulnerable function Operation::select_with_multiple_condition fails to sanitize user input before constructing SQL queries, enabling authentication bypass or database enumeration. A public proof-of-concept exploit is available per VulDB and a linked GitHub issue, materially lowering the skill threshold for exploitation; no confirmed CISA KEV listing exists at time of analysis. | MEDIUM | 5.5 | 0.3% | 48 |
PoC
No patch
|
| CVE-2026-75986 | SQL injection in code-projects Online Job Portal System 1.0 exposes the unauthenticated Password Recovery endpoint (/ForPass.php) to remote exploitation via the txtUserName parameter. The flaw requires no credentials and no user interaction, meaning any network-reachable instance can be targeted directly. A public proof-of-concept exploit has been disclosed via GitHub, confirming the attack is reproducible; no vendor patch has been identified at time of analysis. | MEDIUM | 5.5 | 0.3% | 48 |
PoC
No patch
|
| CVE-2026-76764 | SQL injection in code-projects Employee Management System 1.0 allows remote unauthenticated attackers to manipulate backend database queries via the `mailuid` parameter at the Admin Login Endpoint (`/process/aprocess.php`). Successful exploitation can result in authentication bypass, credential extraction, or partial data manipulation depending on database user privileges. A public proof-of-concept exploit is available, materially lowering the technical barrier for opportunistic attacks. | MEDIUM | 5.5 | 0.3% | 48 |
PoC
No patch
|
| CVE-2026-86179 | Unauthenticated remote access to an exposed SQL database backup file in code-projects Daily Expense Manager 1.0 allows any network attacker to retrieve sensitive application data. The file `/Daily-Expense-Manager/exp_ak.sql` - a raw database dump - is served directly from the web root without access control, disclosing potentially credentials, user records, and expense data. No public exploitation via CISA KEV, but a public exploit writeup is available on GitHub confirming the exposure path. | MEDIUM | 5.5 | 0.3% | 48 |
PoC
No patch
|
| CVE-2026-86519 | Direct web-accessible SQL backup file exposure in code-projects Student Crud Operation 1.0 allows unauthenticated remote attackers to download the raw database dump `/card_activation.sql` from the web root. The file likely contains database schema and card activation records, exposing sensitive application data without any authentication. No public exploit identified at time of analysis is incorrect - publicly available exploit code exists per the referenced GitHub writeup, though no CISA KEV listing is present. | MEDIUM | 5.5 | 0.3% | 48 |
PoC
No patch
|
| CVE-2026-82624 | Direct remote access to an unprotected SQL database backup file in code-projects Simple Inventory System 1.0 allows unauthenticated attackers to retrieve the full contents of the inventory database without any credentials or user interaction. The file inventorymanagement.sql is stored within the web-accessible directory and is directly downloadable via HTTP. A publicly documented proof-of-concept on GitHub confirms trivial exploitability of this exposure. | MEDIUM | 5.5 | 0.3% | 48 |
PoC
No patch
|
| CVE-2026-86217 | Unauthenticated remote download of a raw SQL database backup in code-projects Hotel and Tourism Reservation in PHP 1.0 exposes the full application database to any internet-connected attacker. The file /ht/hotel_db%20(1).sql is placed inside the web root without access restrictions, making it directly retrievable over HTTP with no credentials. A publicly available proof-of-concept exploit exists; the database dump likely contains guest PII, booking records, and potentially hashed or plaintext admin credentials. | MEDIUM | 5.5 | 0.3% | 48 |
PoC
No patch
|
| CVE-2026-86302 | Hospital Information System 1.0 by code-projects exposes its raw SQL database backup file at the web-accessible path `/HIS/his.sql`, allowing unauthenticated remote attackers to download the full database dump over HTTP with no prerequisites. The vulnerability (CWE-200) stems from placing the database export file inside the application's web root without access controls. A public proof-of-concept exploit document is available on GitHub, confirming practical exploitability; no KEV listing has been issued at time of analysis. | MEDIUM | 5.5 | 0.3% | 48 |
PoC
No patch
|
| CVE-2026-85402 | Unauthenticated SQL injection in code-projects Doctor Appointment System 1.0 exposes the `/patient/booking.php` endpoint to remote database manipulation via the unsanitized `doc_id` parameter. Attackers with network access can extract patient records, appointment data, and stored credentials, or modify database contents without any authentication. Public exploit code exists on GitHub, significantly lowering the bar for exploitation; no vendor patch has been identified at time of analysis. | MEDIUM | 5.5 | 0.3% | 48 |
PoC
No patch
|
| CVE-2026-76990 | SQL injection in code-projects Simple Inventory System 1.0 allows remote unauthenticated attackers to manipulate backend database queries via the ID parameter in /delete.php. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) confirms no authentication or user interaction is required, enabling exploitation from the network. A public proof-of-concept exploit has been disclosed via GitHub, making this immediately actionable for opportunistic attackers targeting deployments of this PHP application. | MEDIUM | 5.5 | 0.3% | 48 |
PoC
No patch
|
| CVE-2026-78143 | SQL injection in code-projects Barangay Resident Profiling Management System 1.0 allows unauthenticated remote attackers to manipulate database queries via the Search argument in residents.php. The Resident Search Functionality fails to sanitize user-supplied input before constructing SQL statements, enabling read, write, or denial-of-service impact against the underlying database. A public proof-of-concept exploit is available on GitHub, lowering the bar for opportunistic exploitation; however, the product's extremely limited real-world deployment significantly constrains actual attack surface. | MEDIUM | 5.5 | 0.3% | 48 |
PoC
No patch
|