223
CVEs
5
Critical
3
High
0
KEV
209
PoC
8
Unpatched C/H
0.0%
Patch Rate
0.0%
Avg EPSS
Severity Breakdown
CRITICAL
5
HIGH
3
MEDIUM
127
LOW
88
Monthly CVE Trend
Affected Products (30)
PHP
426
Simple Online Hotel Reservation System
18
Online Music Site
18
Client Details System
16
Real Estate Property Management System
16
Online Hotel Reservation System
16
Simple Food Ordering System
14
Blood Bank Management System
14
E Commerce Website
13
Online Product Reservation System
13
Student File Management System
13
Online Bidding System
13
Online Reviewer System
12
Online Class And Exam Scheduling System
12
Refugee Food Management System
12
Responsive Hotel Site
11
Voting System
10
Online Ordering System
10
Chat System
10
Hostel Management System
9
Hospital Management System
9
School Fees Payment System
9
Student Information System
8
Payroll Management System
8
Simple Forum
8
Simple Scheduling System
7
Simple Car Rental System
7
Nero Social Networking Site
7
Simple Shopping Cart
6
Simple Grading System
6
Top Risky CVEs
| CVE | Summary | Severity | CVSS | EPSS | Priority | Signals |
|---|---|---|---|---|---|---|
| CVE-2025-70152 | SQL injection in code-projects Community Project Scholars Tracking System 1.0 admin user management. Allows database compromise via admin panel. PoC available. | CRITICAL | 9.8 | 0.1% | 69 |
PoC
No patch
|
| CVE-2025-69565 | Mobile Shop Management System has file upload enabling web shell deployment. | CRITICAL | 9.8 | 0.1% | 69 |
PoC
No patch
|
| CVE-2025-69562 | Mobile Shop Management System has SQL injection in insertmessage.php. | CRITICAL | 9.8 | 0.0% | 69 |
PoC
No patch
|
| CVE-2025-69563 | Mobile Shop Management System has SQL injection in ExLogin.php. | CRITICAL | 9.8 | 0.0% | 69 |
PoC
No patch
|
| CVE-2025-69564 | Mobile Shop Management System has code injection in ExAddNewUser.php. | CRITICAL | 9.8 | 0.0% | 69 |
PoC
No patch
|
| CVE-2025-70151 | Scholars Tracking System versions up to 1.0 is affected by unrestricted upload of file with dangerous type (CVSS 8.8). | HIGH | 8.8 | 0.3% | 64 |
PoC
No patch
|
| CVE-2025-60302 | Stored cross-site scripting in code-projects Client Details System 1.0 allows an attacker who can submit customer records to persist malicious JavaScript in the username field, which then executes in the browser of any user who subsequently views that record. The CVSS scope change (S:C) indicates the payload crosses from the application's trust boundary into a victim's browser session, enabling session hijacking or credential theft against administrative users. A publicly available proof-of-concept exists, though no CISA KEV listing has been issued and the EPSS score of 0.22% (12th percentile) reflects low observed exploitation activity. | MEDIUM | 6.1 | 0.2% | 51 |
PoC
No patch
|
| CVE-2025-60304 | Stored Cross-Site Scripting in code-projects Simple Scheduling System 1.0 allows an attacker to inject arbitrary JavaScript via the Subject Description field, which executes in victims' browsers when they view the affected page. The scope change in the CVSS vector (S:C) confirms the script runs in a different security context than where the payload is injected, enabling session hijacking, credential theft, or malicious redirects against users of the application. A publicly available proof-of-concept exploit exists, though exploitation probability remains low (EPSS 0.22%) and no confirmed active exploitation is recorded. | MEDIUM | 6.1 | 0.2% | 51 |
PoC
No patch
|
| CVE-2026-0589 | Online Product Reservation System versions up to 1.0 is affected by improper authentication (CVSS 7.3). | MEDIUM | 5.5 | 0.3% | 48 |
PoC
No patch
|
| CVE-2025-12928 | A vulnerability was detected in code-projects Online Job Search Engine 1.0. Rated medium severity (CVSS 6.9), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available. | MEDIUM | 5.5 | 0.1% | 48 |
PoC
No patch
|
| CVE-2025-13170 | A vulnerability was detected in code-projects Simple Online Hotel Reservation System 1.0.php. Rated medium severity (CVSS 6.9), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available. | MEDIUM | 5.5 | 0.1% | 48 |
PoC
No patch
|
| CVE-2025-14619 | SQL injection in code-projects Student File Management System 1.0 allows remote unauthenticated attackers to manipulate database queries via the stud_no parameter in login_query.php. A public exploit is available, but EPSS indicates a low probability of widespread exploitation (0.07%); the vulnerability is not listed in CISA KEV. | MEDIUM | 5.5 | 0.1% | 48 |
PoC
No patch
|
| CVE-2025-14620 | SQL injection in Student File Management System 1.0 allows remote attackers to manipulate database queries via the Username parameter of /admin/login_query.php. The vulnerability, with publicly available exploit code, enables low-impact data extraction or modification without authentication. At the time of analysis, it is not listed in CISA's KEV, and EPSS indicates low exploitation probability. | MEDIUM | 5.5 | 0.1% | 48 |
PoC
No patch
|
| CVE-2025-14622 | SQL injection in Student File Management System 1.0 allows remote unauthenticated attackers to manipulate database queries via the firstname parameter in /admin/save_user.php. Exploit code is publicly available, but no reports of active exploitation exist at this time. The vulnerability has a CVSS 4.0 base score of 5.5 (low impact) and an EPSS score of 0.07%, indicating low exploitation probability. | MEDIUM | 5.5 | 0.1% | 48 |
PoC
No patch
|
| CVE-2025-14623 | SQL injection in Student File Management System 1.0 at /admin/update_student.php via the stud_id parameter allows remote attackers to read or modify database contents without authentication. Exploit code is publicly available, though no active exploitation has been confirmed. | MEDIUM | 5.5 | 0.1% | 48 |
PoC
No patch
|