245
CVEs
1
Critical
1
High
0
KEV
240
PoC
2
Unpatched C/H
0.0%
Patch Rate
0.1%
Avg EPSS
Severity Breakdown
CRITICAL
1
HIGH
1
MEDIUM
129
LOW
114
Monthly CVE Trend
Affected Products (30)
PHP
575
Exam Form Submission
28
Simple Laundry System
24
Patient Record Management System
23
Inventory Management System
21
Library System
20
Online Shoe Store
20
Blood Bank System
17
Employee Management System
17
Simple Admin Panel
14
Online Restaurant Management System
14
Pharmacy Management System
14
Vehicle Showroom Management System
12
Content Management System
11
Modern Bag
11
Blood Bank Management System
11
Point Of Sales And Inventory Management System
10
Blood Bank
9
Simple School Management System
9
Vehicle Management
9
Simple It Discussion Forum
9
Fighting Cock Information System
9
Online Class And Exam Scheduling System
8
Restaurant Reservation System
8
Chat System
8
Crime Reporting System
7
Human Resource Integrated System
7
Crud Operation System
7
Online Music Site
6
Task Manager
6
Top Risky CVEs
| CVE | Summary | Severity | CVSS | EPSS | Priority | Signals |
|---|---|---|---|---|---|---|
| CVE-2025-60306 | Privilege escalation in code-projects Simple Car Rental System 1.0 lets an authenticated low-privilege user forge a high-privilege (administrator) session and invoke sensitive operations reserved for privileged accounts. The flaw is a broken access-control / authentication-bypass issue (CWE-284) with a publicly available exploit, though it is not listed in CISA KEV and carries a low EPSS probability (0.38%, 30th percentile), indicating limited real-world exploitation to date. Any user able to authenticate at a basic level can effectively take over administrative functionality. | CRITICAL | 9.9 | 0.4% | 70 |
PoC
No patch
|
| CVE-2026-7503 | Buffer overflow in TOTOLINK A800R router firmware 4.1.2cu.5137 enables authenticated remote attackers to achieve arbitrary code execution with high privileges. The vulnerability exists in the setWiFiMultipleConfig function of the wireless configuration module (wireless.so) within the cstecgi.cgi web interface, exploitable via malformed wepkey2 parameter. Public proof-of-concept exploit code is available on GitHub. EPSS data not provided, CISA KEV status not listed, indicating exploitation is demonstrated but not yet observed in widespread campaigns. | HIGH | 7.4 | 0.0% | 57 |
PoC
No patch
|
| CVE-2026-19345 | Missing authorization in code-projects Task Management System 1.0 allows remote unauthenticated attackers to manipulate task records by sending crafted requests to /user/UpdateTaskStatus.php with arbitrary task_id and val parameters. The server performs no permission check before processing the status update, enabling any network-reachable party to alter task data belonging to any user. A public proof-of-concept exploit exists per VulDB and a GitHub issue report, making opportunistic abuse straightforward despite the absence of a CISA KEV listing. | MEDIUM | 5.5 | 0.5% | 48 |
PoC
No patch
|
| CVE-2026-85517 | Sensitive database exposure in code-projects Vehicle Management System 1.0 allows unauthenticated remote attackers to download the raw SQL database backup file at /vehicle_management.sql directly over HTTP, leaking the full application database contents. The backup file is stored in or under the web root with no access controls, making it trivially accessible to any internet-connected attacker. A public proof-of-concept is available, and no vendor patch has been identified at time of analysis. | MEDIUM | 5.5 | 0.5% | 48 |
PoC
No patch
|
| CVE-2026-14660 | SQL injection in code-projects Online Job Portal 1.0 exposes the login.php endpoint to remote unauthenticated exploitation via the txtUser and txtPass parameters, enabling attackers to manipulate backend SQL queries without any credentials or user interaction. A public proof-of-concept exploit is documented on GitHub, significantly lowering the barrier to attack for any internet-exposed instance. No patch has been identified from the vendor at time of analysis; the wildcard CPE suggests all versions are affected. | MEDIUM | 5.5 | 0.4% | 48 |
PoC
No patch
|
| CVE-2026-19344 | SQL injection in code-projects Task Management System 1.0 exposes unauthenticated remote attackers a path to manipulate database queries through the task_id parameter in /user/comment_count_user.php. The flaw is a textbook CWE-89 input-neutralization failure in a PHP application with no authentication barrier, and exploit code has been publicly disclosed via GitHub. No CISA KEV listing exists at time of analysis, but the zero-authentication network attack vector combined with available proof-of-concept code significantly lowers the exploitation bar. | MEDIUM | 5.5 | 0.4% | 48 |
PoC
No patch
|
| CVE-2026-19342 | Authentication bypass in code-projects Task Management System 1.0 exposes the login endpoint at /index.php to remote unauthenticated attackers who can manipulate the Password parameter to circumvent credential verification entirely. The flaw is classified under CWE-287 (Improper Authentication) and affects all known versions of this PHP application per the wildcard CPE string. A public proof-of-concept exploit is available on GitHub, and no vendor-released patch has been identified at time of analysis. | MEDIUM | 5.5 | 0.4% | 48 |
PoC
No patch
|
| CVE-2026-76799 | Direct HTTP access to an exposed SQL database backup file in code-projects Login Registration System 1.0 allows unauthenticated remote attackers to download the raw database dump at /loginsystem/database/login_registration_system.sql, disclosing user credentials, schema details, and any sensitive data stored in the application database. This is a CWE-552 file exposure defect - the backup artifact is stored within the web-accessible document root with no access controls. No exploitation beyond a standard HTTP GET request is required. A public proof-of-concept exploit exists; no KEV listing at time of analysis. | MEDIUM | 5.5 | 0.4% | 48 |
PoC
No patch
|
| CVE-2026-14648 | Unauthenticated SQL injection in code-projects Online Voting System 0.x-1.0 exposes the admin login endpoint to full authentication bypass and database extraction. The vulnerability resides in the `test_input` function within `/authentication.php`, where the `adminUserName` and `adminPassword` parameters are passed unsanitized into SQL queries, enabling classic injection attacks against the login form. A public proof-of-concept exploit has been published on GitHub; no vendor patch has been identified at time of analysis. | MEDIUM | 5.5 | 0.3% | 48 |
PoC
No patch
|
| CVE-2026-86168 | SQL injection in code-projects Content Management System 1.0 allows unauthenticated remote attackers to manipulate database queries via the user_name parameter in /login.php. Because the vulnerable endpoint is the authentication form itself, successful exploitation can achieve authentication bypass - granting admin-level access without credentials - as well as full database enumeration. A public proof-of-concept exploit has been published to GitHub, materially lowering the bar for exploitation. | MEDIUM | 5.5 | 0.3% | 48 |
PoC
No patch
|
| CVE-2026-86180 | SQL injection in the Login component of code-projects Task Management System In PHP 1.0 exposes the application's database to unauthenticated remote attackers via the `email` parameter in `/index.php`. The root cause is unsanitized user input passed directly into a SQL query (CWE-89), enabling authentication bypass and arbitrary data extraction. A public proof-of-concept writeup has been published on GitHub, significantly lowering the exploitation barrier; no vendor patch has been identified. | MEDIUM | 5.5 | 0.3% | 48 |
PoC
No patch
|
| CVE-2026-75778 | SQL injection in code-projects Task Management System 1.0 exposes the login endpoint at /index.php to unauthenticated remote exploitation via the email parameter. The vulnerable function Operation::select_with_multiple_condition fails to sanitize user input before constructing SQL queries, enabling authentication bypass or database enumeration. A public proof-of-concept exploit is available per VulDB and a linked GitHub issue, materially lowering the skill threshold for exploitation; no confirmed CISA KEV listing exists at time of analysis. | MEDIUM | 5.5 | 0.3% | 48 |
PoC
No patch
|
| CVE-2026-75986 | SQL injection in code-projects Online Job Portal System 1.0 exposes the unauthenticated Password Recovery endpoint (/ForPass.php) to remote exploitation via the txtUserName parameter. The flaw requires no credentials and no user interaction, meaning any network-reachable instance can be targeted directly. A public proof-of-concept exploit has been disclosed via GitHub, confirming the attack is reproducible; no vendor patch has been identified at time of analysis. | MEDIUM | 5.5 | 0.3% | 48 |
PoC
No patch
|
| CVE-2026-76764 | SQL injection in code-projects Employee Management System 1.0 allows remote unauthenticated attackers to manipulate backend database queries via the `mailuid` parameter at the Admin Login Endpoint (`/process/aprocess.php`). Successful exploitation can result in authentication bypass, credential extraction, or partial data manipulation depending on database user privileges. A public proof-of-concept exploit is available, materially lowering the technical barrier for opportunistic attacks. | MEDIUM | 5.5 | 0.3% | 48 |
PoC
No patch
|
| CVE-2026-86179 | Unauthenticated remote access to an exposed SQL database backup file in code-projects Daily Expense Manager 1.0 allows any network attacker to retrieve sensitive application data. The file `/Daily-Expense-Manager/exp_ak.sql` - a raw database dump - is served directly from the web root without access control, disclosing potentially credentials, user records, and expense data. No public exploitation via CISA KEV, but a public exploit writeup is available on GitHub confirming the exposure path. | MEDIUM | 5.5 | 0.3% | 48 |
PoC
No patch
|