56
CVEs
0
Critical
0
High
0
KEV
55
PoC
0
Unpatched C/H
0.0%
Patch Rate
0.1%
Avg EPSS
Severity Breakdown
CRITICAL
0
HIGH
0
MEDIUM
8
LOW
48
Monthly CVE Trend
Affected Products (30)
PHP
132
Membership Management System
19
Real Estate Management System
19
Online Classroom
13
Gym Management System
11
Apartment Visitor Management System
9
Human Resource Management System
7
Leave Management System
7
Complaint Management System
6
Student Attendance Management System
5
Internet Banking System
5
House Rental Management System
5
Pos And Inventory Management System
4
Online Job Portal
4
Simple Banking System
4
Online Food Ordering System
3
Simple Online Leave Management System
3
Restaurant Pos System
3
Patient Record Management System
3
Bus Ticket Booking System
3
Simple Inventory System
3
Ecommerce Website
3
Payroll System
3
Car Rental System
2
Ingredients Stock Management System
2
University Management System
2
Food Ordering System
2
Simple Hospital Management System
2
Student Grading System
2
Online Leave Application
2
Top Risky CVEs
| CVE | Summary | Severity | CVSS | EPSS | Priority | Signals |
|---|---|---|---|---|---|---|
| CVE-2026-77019 | SQL injection in CodeAstro Apartment Visitor Management System 1.0 exposes the unauthenticated password-reset endpoint (/apartment-visitor/forgotpw.php) to remote database manipulation via the `secode` parameter. A publicly available proof-of-concept exploit exists, lowering the bar for exploitation. Affected deployments risk partial database read and write access without any prior authentication, as confirmed by the CVSS 4.0 vector (PR:N, UI:N). No KEV listing exists, and exploitation is expected to remain opportunistic and targeted to organizations running this niche PHP application. | MEDIUM | 5.5 | 0.4% | 48 |
PoC
No patch
|
| CVE-2026-77020 | SQL injection in CodeAstro Apartment Visitor Management System 1.0 allows remote unauthenticated attackers to manipulate backend database queries through the email parameter of the password-recovery.php script. The CVSS 4.0 vector (AV:N/AC:L/PR:N/UI:N) confirms no authentication or special configuration is required, and a public proof-of-concept exploit is available on GitHub, lowering the skill threshold for opportunistic attacks. No active exploitation has been confirmed in CISA KEV at time of analysis, and impact is rated partial across confidentiality, integrity, and availability (VC:L/VI:L/VA:L). | MEDIUM | 5.5 | 0.4% | 48 |
PoC
No patch
|
| CVE-2026-14640 | SQL injection in CodeAstro Apartment Visitor Management System 1.0 exposes the login endpoint at /index.php to unauthenticated remote attackers who can manipulate the Username parameter to execute arbitrary SQL queries against the backend database. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) confirms zero prerequisites for exploitation, and the E:P modifier reflects a publicly available proof-of-concept on GitHub. No CISA KEV listing was found at time of analysis, but the combination of an exposed login surface, no authentication barrier, and live POC code materially elevates practical risk beyond the medium CVSS score of 6.9. | MEDIUM | 5.5 | 0.3% | 48 |
PoC
No patch
|
| CVE-2026-16765 | SQL injection in CodeAstro Online Classroom 1.0 exposes the admin login endpoint `/OnlineClassroom/loginlinkadmin.php` to unauthenticated remote attackers who can manipulate the `aid` parameter to alter backend SQL queries. The practical impact extends beyond the CVSS 4.0 score of 5.5 because the vulnerable file is the admin authentication gateway, meaning successful exploitation can bypass login controls entirely and expose or manipulate the underlying database. A public proof-of-concept exploit has been disclosed on GitHub; no public exploit identified at time of analysis as a KEV-confirmed active exploitation campaign, though the barrier to exploitation is now minimal. | MEDIUM | 5.5 | 0.3% | 48 |
PoC
No patch
|
| CVE-2026-11582 | SQL injection in CodeAstro Student Attendance Management System 1.0 allows remote unauthenticated attackers to manipulate the Username parameter at /attendance-php/index.php to inject arbitrary SQL. Publicly available exploit code exists per VulDB reference, raising the practical risk despite the moderate 7.3 CVSS score. No CISA KEV listing and no EPSS score were supplied, so exploitation appears opportunistic against this small-vendor PHP application rather than mass-targeted. | MEDIUM | 5.5 | 0.0% | 48 |
PoC
No patch
|
| CVE-2026-7071 | CodeAstro Online Job Portal 1.0 exposes file and directory information through the /users/user-cvs/ endpoint via remote unauthenticated access, allowing attackers to enumerate and retrieve sensitive resume and user data. The vulnerability has publicly available exploit code and affects all versions of the application via the CPE cpe:2.3:a:codeastro:online_job_portal:*:*:*:*:*:*:*:*. CVSS 5.5 with confirmed public exploit availability and EPSS exploitation probability indicates moderate real-world risk for deployments accessible over the network. | MEDIUM | 5.5 | 0.0% | 48 |
PoC
No patch
|
| CVE-2026-8132 | SQL injection in CodeAstro Leave Management System 1.0 allows remote unauthenticated attackers to manipulate the txt_username parameter in /login.php, enabling database queries to be executed with low confidentiality and integrity impact. Publicly available exploit code exists for this vulnerability, increasing real-world exploitation risk despite the moderate CVSS score of 5.5. | MEDIUM | 5.5 | 0.0% | 48 |
PoC
No patch
|
| CVE-2026-77681 | Unrestricted file upload in CodeAstro Online Job Portal 1.0 allows authenticated remote attackers to upload arbitrary files via the Name argument in /users/update-profile.php. Exploitation requires a valid user account, after which an attacker can bypass file type restrictions on profile update functionality. A publicly available proof-of-concept exists per the GitHub reference, though no active exploitation has been confirmed by CISA KEV. The unusually low official CVSS 4.0 score of 2.1 (VC:L/VI:L/VA:L) appears inconsistent with CWE-434 in a PHP application, where unrestricted upload frequently enables server-side code execution - security teams should independently verify the actual upload destination and execution context. | LOW | 2.1 | 0.4% | 31 |
PoC
No patch
|
| CVE-2026-13549 | Authorization bypass in CodeAstro Complaint Management System 1.0 exposes the deletereport endpoint to unauthenticated arbitrary deletion of complaint reports and associated files. The deletereport function in application/controllers/Report.php accepts a caller-supplied report identifier without verifying ownership or authorization, enabling any remote user to delete any report by manipulating that identifier. A public proof-of-concept exploit is available on GitHub; no CISA KEV listing exists at time of analysis, indicating no confirmed widespread active exploitation. | LOW | 2.1 | 0.3% | 31 |
PoC
No patch
|
| CVE-2026-13535 | SQL injection in CodeAstro Human Resource Management System 1.0 allows low-privileged remote attackers to manipulate database queries via the ID argument passed to the GetFileInfo function within the View Endpoint. The vulnerability resides in hrsystem/application/models/Employee_model.php and can result in unauthorized read and write access to the underlying database. A public exploit has been published on GitHub, elevating practical risk despite the authentication requirement and moderate CVSS 4.0 score of 5.3. | LOW | 2.1 | 0.2% | 31 |
PoC
No patch
|
| CVE-2026-14766 | SQL injection in CodeAstro Apartment Visitor Management System 1.0 exposes the `/apartment-visitor/search-result.php` endpoint to remote exploitation via the `searchdata` POST parameter, allowing low-privileged authenticated attackers to read, modify, or partially disrupt underlying database contents. A public proof-of-concept exploit exists on GitHub, lowering the skill barrier for opportunistic attacks against any internet-facing deployment. No CISA KEV listing has been confirmed, and the CVSS 4.0 score of 5.3 reflects a limited partial-impact scope; however, the POC's availability meaningfully elevates real-world exploitation probability above what the score alone suggests. | LOW | 2.1 | 0.2% | 31 |
PoC
No patch
|
| CVE-2026-14796 | SQL injection in CodeAstro Apartment Visitor Management System 1.0 exposes backend database contents to authenticated low-privileged remote attackers via the unsanitized `fromdate` parameter in `/apartment-visitor/report.php`. The CVSS 4.0 vector confirms network-accessible exploitation requiring only low-privilege credentials. Publicly available exploit code has been published on GitHub (github.com/lilukun337/cve/issues/7), though no active exploitation has been confirmed by CISA KEV. The injection enables read and limited write access to the underlying database, with a moderate combined impact score of 5.3. | LOW | 2.1 | 0.2% | 31 |
PoC
No patch
|
| CVE-2026-14799 | SQL injection in CodeAstro Ecommerce Website 1.0 exposes the `/customer/my_account.php?my_wishlist` endpoint to database manipulation via the unsanitized `delete_wishlist` parameter, allowing remote attackers with a valid customer account to read or modify backend database contents. The CVSS 4.0 vector (PR:L) confirms exploitation requires an authenticated customer session, constraining the attack surface to registered users. A public proof-of-concept exploit has been released, no public exploit identified as confirmed actively exploited (not in CISA KEV), though the low barrier to exploitation once authenticated elevates practical risk. | LOW | 2.1 | 0.2% | 31 |
PoC
No patch
|
| CVE-2026-13525 | SQL injection in CodeAstro Human Resource Management System 1.0 allows a low-privileged authenticated remote attacker to manipulate the `emid` parameter in the Update_Earn_Leave endpoint, triggering time-based blind SQL injection against the underlying database. The vulnerability resides in the `emselectByCode` function within `application/models/Employee_model.php`, where unsanitized input is passed directly into SQL query construction. A public proof-of-concept exploit is available on GitHub; no active exploitation has been confirmed by CISA KEV at time of analysis. | LOW | 2.1 | 0.2% | 31 |
PoC
No patch
|
| CVE-2026-14689 | SQL injection in CodeAstro Apartment Visitor Management System 1.0 enables remote, low-privilege authenticated attackers to manipulate backend database queries via the `apartmentno` parameter in `/apartment-visitor/add-apartment.php`. The CVSS 4.0 score of 2.1 reflects a constrained impact scope (low C/I/A on the vulnerable system, no downstream system impact), but the presence of a publicly available proof-of-concept lowers the exploitation bar significantly. Real-world impact could extend beyond the CVSS score if the database user holds elevated permissions, potentially enabling unauthorized data extraction or record manipulation across the application's dataset. No public exploit identified via CISA KEV; no vendor patch identified at time of analysis. | LOW | 2.1 | 0.2% | 31 |
PoC
No patch
|