3
CVEs
0
Critical
0
High
0
KEV
3
PoC
0
Unpatched C/H
0.0%
Patch Rate
0.4%
Avg EPSS
Severity Breakdown
CRITICAL
0
HIGH
0
MEDIUM
2
LOW
1
Monthly CVE Trend
Affected Products (30)
PHP
132
Membership Management System
19
Real Estate Management System
19
Online Classroom
13
Gym Management System
11
Apartment Visitor Management System
9
Human Resource Management System
7
Leave Management System
7
Complaint Management System
6
Student Attendance Management System
5
Internet Banking System
5
House Rental Management System
5
Pos And Inventory Management System
4
Online Job Portal
4
Simple Banking System
4
Online Food Ordering System
3
Simple Online Leave Management System
3
Restaurant Pos System
3
Patient Record Management System
3
Bus Ticket Booking System
3
Simple Inventory System
3
Ecommerce Website
3
Payroll System
3
Car Rental System
2
Ingredients Stock Management System
2
University Management System
2
Food Ordering System
2
Simple Hospital Management System
2
Student Grading System
2
Online Leave Application
2
Top Risky CVEs
| CVE | Summary | Severity | CVSS | EPSS | Priority | Signals |
|---|---|---|---|---|---|---|
| CVE-2026-77019 | SQL injection in CodeAstro Apartment Visitor Management System 1.0 exposes the unauthenticated password-reset endpoint (/apartment-visitor/forgotpw.php) to remote database manipulation via the `secode` parameter. A publicly available proof-of-concept exploit exists, lowering the bar for exploitation. Affected deployments risk partial database read and write access without any prior authentication, as confirmed by the CVSS 4.0 vector (PR:N, UI:N). No KEV listing exists, and exploitation is expected to remain opportunistic and targeted to organizations running this niche PHP application. | MEDIUM | 5.5 | 0.4% | 48 |
PoC
No patch
|
| CVE-2026-77020 | SQL injection in CodeAstro Apartment Visitor Management System 1.0 allows remote unauthenticated attackers to manipulate backend database queries through the email parameter of the password-recovery.php script. The CVSS 4.0 vector (AV:N/AC:L/PR:N/UI:N) confirms no authentication or special configuration is required, and a public proof-of-concept exploit is available on GitHub, lowering the skill threshold for opportunistic attacks. No active exploitation has been confirmed in CISA KEV at time of analysis, and impact is rated partial across confidentiality, integrity, and availability (VC:L/VI:L/VA:L). | MEDIUM | 5.5 | 0.4% | 48 |
PoC
No patch
|
| CVE-2026-77681 | Unrestricted file upload in CodeAstro Online Job Portal 1.0 allows authenticated remote attackers to upload arbitrary files via the Name argument in /users/update-profile.php. Exploitation requires a valid user account, after which an attacker can bypass file type restrictions on profile update functionality. A publicly available proof-of-concept exists per the GitHub reference, though no active exploitation has been confirmed by CISA KEV. The unusually low official CVSS 4.0 score of 2.1 (VC:L/VI:L/VA:L) appears inconsistent with CWE-434 in a PHP application, where unrestricted upload frequently enables server-side code execution - security teams should independently verify the actual upload destination and execution context. | LOW | 2.1 | 0.4% | 31 |
PoC
No patch
|