165
CVEs
38
Critical
25
High
0
KEV
114
PoC
63
Unpatched C/H
0.0%
Patch Rate
0.5%
Avg EPSS
Severity Breakdown
CRITICAL
38
HIGH
25
MEDIUM
77
LOW
25
Monthly CVE Trend
Affected Products (30)
PHP
160
School Event Management System
28
School Attendence Monitoring System
22
Baby Care System
22
Credit Card
18
Paypal
18
Debit Card Payment
18
Aplaya Beach Resort Online Reservation System
11
Online Student File Management System
8
Online Exam Form Submission
7
Interview Management System
7
Inventory Management System
7
Online Library System
7
Young Entrepreneur E Negosyo System
6
Farm Management System
5
Pool Of Bethesda Online Reservation System
4
E Commerce System
3
Point Of Sales
3
Water Billing System
3
Simple E Commerce Bookstore
3
Online Hotel Reservation System
3
Vehicle Management System
3
Online Class Record System
3
Online Reviewer System
3
E Learning System
3
Food Ordering System
2
Online Job Portal
2
Monbela Tourist Inn Online Reservation System
2
Engineers Online Portal
2
Multi Restaurant Table Reservation System
2
Top Risky CVEs
| CVE | Summary | Severity | CVSS | EPSS | Priority | Signals |
|---|---|---|---|---|---|---|
| CVE-2021-41646 | Remote Code Execution (RCE) vulnerability exists in Sourcecodester Online Reviewer System 1.0 by uploading a maliciously crafted PHP file that bypasses the image upload filters.. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available. | CRITICAL | 9.8 | 3.7% | 73 |
PoC
No patch
|
| CVE-2021-27130 | Online Reviewer System 1.0 contains a SQL injection vulnerability through authentication bypass, which may lead to a reverse shell upload. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available. | CRITICAL | 9.8 | 0.5% | 70 |
PoC
No patch
|
| CVE-2021-25779 | Baby Care System v1.0 is vulnerable to SQL injection via the 'id' parameter on the contentsectionpage.php page. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available. | CRITICAL | 9.8 | 1.1% | 69 |
PoC
No patch
|
| CVE-2022-28420 | Baby Care System v1.0 was discovered to contain a SQL injection vulnerability via BabyCare/admin.php?id=theme&setid=. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available. | CRITICAL | 9.8 | 1.3% | 69 |
PoC
No patch
|
| CVE-2022-28421 | Baby Care System v1.0 was discovered to contain a SQL injection vulnerability via /admin.php?id=posts&action=display&value=1&postid=. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available. | CRITICAL | 9.8 | 1.2% | 69 |
PoC
No patch
|
| CVE-2022-28422 | Baby Care System v1.0 was discovered to contain a SQL injection vulnerability via /admin/posts.php&action=edit. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available. | CRITICAL | 9.8 | 1.3% | 69 |
PoC
No patch
|
| CVE-2022-28423 | Baby Care System v1.0 was discovered to contain a SQL injection vulnerability via /admin/posts.php&action=delete. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available. | CRITICAL | 9.8 | 1.3% | 69 |
PoC
No patch
|
| CVE-2022-28424 | Baby Care System v1.0 was discovered to contain a SQL injection vulnerability via /admin/posts.php&find=. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available. | CRITICAL | 9.8 | 1.3% | 69 |
PoC
No patch
|
| CVE-2022-28425 | Baby Care System v1.0 was discovered to contain a SQL injection vulnerability via /admin/pagerole.php&action=display&value=1&roleid=. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available. | CRITICAL | 9.8 | 1.2% | 69 |
PoC
No patch
|
| CVE-2022-28426 | Baby Care System v1.0 was discovered to contain a SQL injection vulnerability via /admin/pagerole.php&action=edit&roleid=. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available. | CRITICAL | 9.8 | 1.2% | 69 |
PoC
No patch
|
| CVE-2022-28427 | Baby Care System v1.0 was discovered to contain a SQL injection vulnerability via /admin/inbox.php&action=read&msgid=. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available. | CRITICAL | 9.8 | 1.2% | 69 |
PoC
No patch
|
| CVE-2022-28429 | Baby Care System v1.0 was discovered to contain a SQL injection vulnerability via /admin/inbox.php&action=delete&msgid=. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available. | CRITICAL | 9.8 | 1.2% | 69 |
PoC
No patch
|
| CVE-2022-28431 | Baby Care System v1.0 was discovered to contain a SQL injection vulnerability via /admin/siteoptions.php&social=remove&sid=2. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available. | CRITICAL | 9.8 | 1.2% | 69 |
PoC
No patch
|
| CVE-2022-28432 | Baby Care System v1.0 was discovered to contain a SQL injection vulnerability via /admin.php?id=siteoptions&social=display&value=0&sid=2. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available. | CRITICAL | 9.8 | 1.2% | 69 |
PoC
No patch
|
| CVE-2022-28433 | Baby Care System v1.0 was discovered to contain a SQL injection vulnerability via /admin/uesrs.php&action=display&value=Show&userid=. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available. | CRITICAL | 9.8 | 1.2% | 69 |
PoC
No patch
|