54
CVEs
0
Critical
0
High
0
KEV
53
PoC
0
Unpatched C/H
1.9%
Patch Rate
0.2%
Avg EPSS
Severity Breakdown
CRITICAL
0
HIGH
0
MEDIUM
15
LOW
39
Monthly CVE Trend
Affected Products (30)
PHP
217
Hospital Management System
42
Sales And Inventory System
27
School Management System
13
Online Medicine Delivery System
10
Construction Management System
10
Student Information Management System
10
Online Student Enrollment System
8
Free Hotel Reservation System
7
Fees Management System
7
Electronic Judging System
7
Courier Management System
6
Online Enrollment System
6
Web Based Internet Laboratory Management System
6
Baptism Information Management System
4
Student Transcript Processing System
4
Payroll Management System
4
Learning Management System
4
Content Management System
3
College Management System
3
Leave Management System
3
Online House Rental System
3
Tailoring Management System In Php With Source Code
2
Online Frozen Foods Ordering System
2
Online Book Store Project
2
Online Blood Bank Management System
2
Payroll System
2
Information System Society Membership System
1
Loan Management System
1
Library Management System
1
Top Risky CVEs
| CVE | Summary | Severity | CVSS | EPSS | Priority | Signals |
|---|---|---|---|---|---|---|
| CVE-2026-78244 | SQL injection in itsourcecode Real Estate Management System 1.0 exposes the search.php endpoint to remote unauthenticated database manipulation via the search, delivery_type, search_price, and property_type parameters. A public proof-of-concept exploit has been published on GitHub (issue #5, microwaveabi/vul), making this trivially accessible to low-skill attackers. CVSS 4.0 rates this 6.9 with low-level impact across confidentiality, integrity, and availability on the vulnerable system; no active exploitation by CISA KEV has been confirmed at time of analysis. | MEDIUM | 5.5 | 0.4% | 48 |
PoC
No patch
|
| CVE-2026-81202 | Unauthenticated remote access to the CRUD operation handler in itsourcecode Payroll System 1.0 allows any network-accessible attacker to create, read, update, or delete payroll records without credentials. The root cause is CWE-306 - the ajax.php endpoint processes the 'action' parameter and executes database operations without verifying caller identity. A public proof-of-concept exploit is available on GitHub, making exploitation trivially accessible to low-skill attackers against any internet-exposed deployment. | MEDIUM | 5.5 | 0.4% | 48 |
PoC
No patch
|
| CVE-2026-82611 | SQL injection in itsourcecode Online Medicine Delivery System 1.0 allows unauthenticated remote attackers to manipulate the U_USERNAME parameter in the Customer::cusAuthentication function at /login.php, enabling authentication bypass and potential database extraction. A public proof-of-concept exploit is available on GitHub, confirmed by the CVSS 4.0 E:P (proof-of-concept) modifier and a linked exploit write-up. No patch has been identified; this is a small PHP application likely used in academic or learning environments with limited production exposure. | MEDIUM | 5.5 | 0.3% | 48 |
PoC
No patch
|
| CVE-2026-82610 | SQL injection in itsourcecode Online Medicine Delivery System 1.0 allows unauthenticated remote attackers to manipulate database queries through the emp_email parameter on the rider login endpoint. The Employee::employeeAuthentication function at /rider/login.php incorporates unsanitized email input directly into SQL queries, enabling authentication bypass and potential data extraction. A public proof-of-concept exploit has been released with no vendor patch available, making any deployed instance immediately exploitable by low-skill attackers. | MEDIUM | 5.5 | 0.3% | 48 |
PoC
No patch
|
| CVE-2026-78171 | SQL injection in itsourcecode Sales and Inventory System 1.0 exposes the login endpoint to unauthenticated remote exploitation via the unsanitized `User` parameter in `/pages/processlogin.php`. Attackers can manipulate backend SQL queries without any prior authentication, enabling authentication bypass or database data extraction. A public proof-of-concept has been disclosed on GitHub, and the unauthenticated network attack vector (CVSS 4.0 PR:N, AV:N with E:P) makes any internet-exposed deployment immediately actionable - no public exploit identified as confirmed actively exploited (not in CISA KEV) at time of analysis. | MEDIUM | 5.5 | 0.3% | 48 |
PoC
No patch
|
| CVE-2026-78202 | Unrestricted file upload in itsourcecode Payroll System 1.0 exposes the application to potential remote code execution through the save_settings function in admin_class.php, where the img parameter accepts files without validating type or content. The CVSS 4.0 vector indicates network-accessible exploitation with no privileges required (PR:N), meaning an attacker can submit a crafted multipart request to upload a PHP webshell directly. A public proof-of-concept exploit exists per the GitHub reference and VulDB reporting; this is not confirmed in CISA KEV, but the low barrier to exploitation combined with POC availability elevates real-world risk beyond the 6.9 score implies. | MEDIUM | 5.5 | 0.3% | 48 |
PoC
No patch
|
| CVE-2026-85208 | Unrestricted file upload in itsourcecode Online Medicine Delivery System 1.0 allows unauthenticated remote attackers to upload arbitrary files - including PHP webshells - through the image parameter of the Order Management Controller endpoint. The vulnerable function doInsert in /rider/orders/controller.php?action=add performs no validation of uploaded file types, enabling direct server-side code execution. A public exploit demonstrating RCE via this file upload path has been released on GitHub and is actively circulating. | MEDIUM | 5.5 | 0.3% | 48 |
PoC
No patch
|
| CVE-2026-82615 | SQL injection in itsourcecode Online Medicine Delivery System 1.0 exposes unauthenticated attackers to direct database manipulation via the Password Recovery Interface. The `Customer::find_phone` function in `/passwordrecover.php` accepts the `phonenumber` parameter without sanitization, allowing arbitrary SQL to be injected into backend queries. A public proof-of-concept exploit has been disclosed on GitHub; the vulnerability is not currently listed in CISA KEV, but the low complexity and zero-authentication requirement make opportunistic exploitation trivial. | MEDIUM | 5.5 | 0.3% | 48 |
PoC
No patch
|
| CVE-2026-86268 | SQL injection in itsourcecode School Management System 1.0 allows unauthenticated remote attackers to manipulate the email parameter in User_Login.php, injecting arbitrary SQL into backend database queries at the pre-authentication login endpoint. With a public exploit available on GitHub, exploitation requires minimal skill and no credentials. The CVSS 4.0 vector confirms network-accessible, no-privilege exploitation with partial confidentiality, integrity, and availability impact against the underlying database. | MEDIUM | 5.5 | 0.3% | 48 |
PoC
No patch
|
| CVE-2026-82612 | SQL injection in itsourcecode Online Medicine Delivery System 1.0 exposes database contents to remote unauthenticated attackers through the `ID` parameter in the `loadResultList` function on the Product Detail Page. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) confirms exploitation requires no credentials, no special configuration, and no user interaction. A proof-of-concept exploit has been publicly disclosed on GitHub, materially lowering the bar for opportunistic attackers beyond what the moderate score alone implies. | MEDIUM | 5.5 | 0.3% | 48 |
PoC
No patch
|
| CVE-2026-82613 | SQL injection in itsourcecode Online Medicine Delivery System 1.0 exposes the Product Search Interface to remote unauthenticated database manipulation via the Search argument handled by the `loadResultList` function at `/index.php?q=product`. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) confirms no authentication, no complexity, and no user interaction are required. Publicly available exploit code exists, documented on GitHub via VulDB submission, though this product has not been added to the CISA KEV catalog and no widespread exploitation has been confirmed. | MEDIUM | 5.5 | 0.3% | 48 |
PoC
No patch
|
| CVE-2026-82614 | SQL injection in itsourcecode Online Medicine Delivery System 1.0 allows unauthenticated remote attackers to manipulate backend database queries via the Category parameter in the Product Category Filter Interface at /index.php?q=product. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) confirms exploitation requires no privileges or user interaction, and a public proof-of-concept is available on GitHub (E:P), materially lowering the exploitation barrier. Impact is rated Low across confidentiality, integrity, and availability, suggesting constrained database access rather than full system compromise; no CISA KEV listing has been identified. | MEDIUM | 5.5 | 0.3% | 48 |
PoC
No patch
|
| CVE-2026-85187 | SQL injection in itsourcecode Online Medicine Delivery System 1.0 allows remote attackers to manipulate the ID argument passed to Order::pupdate in the rider order-confirmation endpoint, enabling arbitrary database queries. The vulnerable parameter is processed without sanitization at /rider/orders/controller.php?action=edit&actions=confirm. A public proof-of-concept has been disclosed on GitHub; no KEV listing and no vendor patch are available at time of analysis. | MEDIUM | 5.5 | 0.3% | 48 |
PoC
No patch
|
| CVE-2026-78246 | Unauthenticated SQL injection in itsourcecode Online Clinic Management System 1.0 exposes the Admin Login endpoint (success/login.php) to remote exploitation via the Username parameter. Any network-reachable attacker can manipulate SQL queries without credentials or user interaction, enabling authentication bypass and arbitrary database read/write. A public exploit POC has been disclosed on GitHub (microwaveabi/vul issue #63), substantially lowering the barrier to exploitation; no CISA KEV listing has been confirmed at time of analysis. | MEDIUM | 5.5 | 0.3% | 48 |
PoC
No patch
|
| CVE-2026-78112 | SQL injection in itsourcecode Hospital Management System Project in PHP 1.0 allows low-privilege authenticated remote attackers to manipulate database queries via the `delid` parameter in `/viewservicetype.php`. Publicly available exploit code exists, reported and disclosed through VulDB. Successful exploitation yields partial confidentiality, integrity, and availability impact against the application database, with no lateral scope change to external systems confirmed. | LOW | 2.1 | 0.3% | 31 |
PoC
No patch
|