89
CVEs
0
Critical
0
High
0
KEV
88
PoC
0
Unpatched C/H
1.1%
Patch Rate
0.2%
Avg EPSS
Severity Breakdown
CRITICAL
0
HIGH
0
MEDIUM
18
LOW
71
Monthly CVE Trend
Affected Products (30)
PHP
215
Hospital Management System
42
Sales And Inventory System
27
School Management System
13
Construction Management System
10
Student Information Management System
10
Online Medicine Delivery System
10
Online Student Enrollment System
8
Free Hotel Reservation System
7
Electronic Judging System
7
Fees Management System
7
Web Based Internet Laboratory Management System
6
Online Enrollment System
6
Courier Management System
6
Student Transcript Processing System
4
Payroll Management System
4
Learning Management System
4
Baptism Information Management System
4
Content Management System
3
College Management System
3
Online House Rental System
3
Online Blood Bank Management System
2
Online Frozen Foods Ordering System
2
Tailoring Management System In Php With Source Code
2
Online Book Store Project
2
Payroll System
2
Leave Management System
2
Information System Society Membership System
1
Library Management System
1
University Management System
1
Top Risky CVEs
| CVE | Summary | Severity | CVSS | EPSS | Priority | Signals |
|---|---|---|---|---|---|---|
| CVE-2026-78244 | SQL injection in itsourcecode Real Estate Management System 1.0 exposes the search.php endpoint to remote unauthenticated database manipulation via the search, delivery_type, search_price, and property_type parameters. A public proof-of-concept exploit has been published on GitHub (issue #5, microwaveabi/vul), making this trivially accessible to low-skill attackers. CVSS 4.0 rates this 6.9 with low-level impact across confidentiality, integrity, and availability on the vulnerable system; no active exploitation by CISA KEV has been confirmed at time of analysis. | MEDIUM | 5.5 | 0.4% | 48 |
PoC
No patch
|
| CVE-2026-81202 | Unauthenticated remote access to the CRUD operation handler in itsourcecode Payroll System 1.0 allows any network-accessible attacker to create, read, update, or delete payroll records without credentials. The root cause is CWE-306 - the ajax.php endpoint processes the 'action' parameter and executes database operations without verifying caller identity. A public proof-of-concept exploit is available on GitHub, making exploitation trivially accessible to low-skill attackers against any internet-exposed deployment. | MEDIUM | 5.5 | 0.4% | 48 |
PoC
No patch
|
| CVE-2026-82611 | SQL injection in itsourcecode Online Medicine Delivery System 1.0 allows unauthenticated remote attackers to manipulate the U_USERNAME parameter in the Customer::cusAuthentication function at /login.php, enabling authentication bypass and potential database extraction. A public proof-of-concept exploit is available on GitHub, confirmed by the CVSS 4.0 E:P (proof-of-concept) modifier and a linked exploit write-up. No patch has been identified; this is a small PHP application likely used in academic or learning environments with limited production exposure. | MEDIUM | 5.5 | 0.3% | 48 |
PoC
No patch
|
| CVE-2026-82610 | SQL injection in itsourcecode Online Medicine Delivery System 1.0 allows unauthenticated remote attackers to manipulate database queries through the emp_email parameter on the rider login endpoint. The Employee::employeeAuthentication function at /rider/login.php incorporates unsanitized email input directly into SQL queries, enabling authentication bypass and potential data extraction. A public proof-of-concept exploit has been released with no vendor patch available, making any deployed instance immediately exploitable by low-skill attackers. | MEDIUM | 5.5 | 0.3% | 48 |
PoC
No patch
|
| CVE-2026-78171 | SQL injection in itsourcecode Sales and Inventory System 1.0 exposes the login endpoint to unauthenticated remote exploitation via the unsanitized `User` parameter in `/pages/processlogin.php`. Attackers can manipulate backend SQL queries without any prior authentication, enabling authentication bypass or database data extraction. A public proof-of-concept has been disclosed on GitHub, and the unauthenticated network attack vector (CVSS 4.0 PR:N, AV:N with E:P) makes any internet-exposed deployment immediately actionable - no public exploit identified as confirmed actively exploited (not in CISA KEV) at time of analysis. | MEDIUM | 5.5 | 0.3% | 48 |
PoC
No patch
|
| CVE-2026-78202 | Unrestricted file upload in itsourcecode Payroll System 1.0 exposes the application to potential remote code execution through the save_settings function in admin_class.php, where the img parameter accepts files without validating type or content. The CVSS 4.0 vector indicates network-accessible exploitation with no privileges required (PR:N), meaning an attacker can submit a crafted multipart request to upload a PHP webshell directly. A public proof-of-concept exploit exists per the GitHub reference and VulDB reporting; this is not confirmed in CISA KEV, but the low barrier to exploitation combined with POC availability elevates real-world risk beyond the 6.9 score implies. | MEDIUM | 5.5 | 0.3% | 48 |
PoC
No patch
|
| CVE-2026-85208 | Unrestricted file upload in itsourcecode Online Medicine Delivery System 1.0 allows unauthenticated remote attackers to upload arbitrary files - including PHP webshells - through the image parameter of the Order Management Controller endpoint. The vulnerable function doInsert in /rider/orders/controller.php?action=add performs no validation of uploaded file types, enabling direct server-side code execution. A public exploit demonstrating RCE via this file upload path has been released on GitHub and is actively circulating. | MEDIUM | 5.5 | 0.3% | 48 |
PoC
No patch
|
| CVE-2026-14688 | SQL injection in itsourcecode Online Hotel Management System 1.0 exposes the admin login endpoint to remote unauthenticated exploitation via an unsanitized `email` parameter in `/admin/login.php`. A public proof-of-concept is available on GitHub (reflected in the CVSS 4.0 E:P metric), meaning exploitation requires minimal technical skill and is accessible to opportunistic attackers. No CISA KEV listing has been identified, but the zero-authentication barrier combined with available exploit code makes this a practical risk for any internet-exposed deployment. | MEDIUM | 5.5 | 0.3% | 48 |
PoC
No patch
|
| CVE-2026-82615 | SQL injection in itsourcecode Online Medicine Delivery System 1.0 exposes unauthenticated attackers to direct database manipulation via the Password Recovery Interface. The `Customer::find_phone` function in `/passwordrecover.php` accepts the `phonenumber` parameter without sanitization, allowing arbitrary SQL to be injected into backend queries. A public proof-of-concept exploit has been disclosed on GitHub; the vulnerability is not currently listed in CISA KEV, but the low complexity and zero-authentication requirement make opportunistic exploitation trivial. | MEDIUM | 5.5 | 0.3% | 48 |
PoC
No patch
|
| CVE-2026-86268 | SQL injection in itsourcecode School Management System 1.0 allows unauthenticated remote attackers to manipulate the email parameter in User_Login.php, injecting arbitrary SQL into backend database queries at the pre-authentication login endpoint. With a public exploit available on GitHub, exploitation requires minimal skill and no credentials. The CVSS 4.0 vector confirms network-accessible, no-privilege exploitation with partial confidentiality, integrity, and availability impact against the underlying database. | MEDIUM | 5.5 | 0.3% | 48 |
PoC
No patch
|
| CVE-2026-13550 | SQL injection in itsourcecode Baptism Information Management System 1.0 exposes the `/delbaptism.php` endpoint to remote database manipulation via an unsanitized `ID` parameter. The CVSS 4.0 vector (AV:N/AC:L/PR:N/UI:N) confirms this requires no authentication or user interaction against any network-accessible instance. A public proof-of-concept exploit exists on GitHub, making this immediately weaponizable against any exposed deployment, though the application is not listed in CISA KEV and its niche footprint substantially limits aggregate exposure. | MEDIUM | 5.5 | 0.3% | 48 |
PoC
No patch
|
| CVE-2026-13551 | SQL injection in itsourcecode Baptism Information Management System 1.0 exposes database contents to remote unauthenticated attackers via the ID parameter in /editBaptism.php. A publicly available proof-of-concept exploit exists on GitHub, enabling data exfiltration or modification without any credentials or user interaction. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N/E:P) confirms low-complexity remote exploitation with no special conditions required, and no vendor-released patch has been identified. | MEDIUM | 5.5 | 0.3% | 48 |
PoC
No patch
|
| CVE-2026-82612 | SQL injection in itsourcecode Online Medicine Delivery System 1.0 exposes database contents to remote unauthenticated attackers through the `ID` parameter in the `loadResultList` function on the Product Detail Page. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) confirms exploitation requires no credentials, no special configuration, and no user interaction. A proof-of-concept exploit has been publicly disclosed on GitHub, materially lowering the bar for opportunistic attackers beyond what the moderate score alone implies. | MEDIUM | 5.5 | 0.3% | 48 |
PoC
No patch
|
| CVE-2026-82613 | SQL injection in itsourcecode Online Medicine Delivery System 1.0 exposes the Product Search Interface to remote unauthenticated database manipulation via the Search argument handled by the `loadResultList` function at `/index.php?q=product`. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) confirms no authentication, no complexity, and no user interaction are required. Publicly available exploit code exists, documented on GitHub via VulDB submission, though this product has not been added to the CISA KEV catalog and no widespread exploitation has been confirmed. | MEDIUM | 5.5 | 0.3% | 48 |
PoC
No patch
|
| CVE-2026-82614 | SQL injection in itsourcecode Online Medicine Delivery System 1.0 allows unauthenticated remote attackers to manipulate backend database queries via the Category parameter in the Product Category Filter Interface at /index.php?q=product. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) confirms exploitation requires no privileges or user interaction, and a public proof-of-concept is available on GitHub (E:P), materially lowering the exploitation barrier. Impact is rated Low across confidentiality, integrity, and availability, suggesting constrained database access rather than full system compromise; no CISA KEV listing has been identified. | MEDIUM | 5.5 | 0.3% | 48 |
PoC
No patch
|