40
CVEs
0
Critical
0
High
0
KEV
36
PoC
0
Unpatched C/H
0.0%
Patch Rate
0.0%
Avg EPSS
Severity Breakdown
CRITICAL
0
HIGH
0
MEDIUM
18
LOW
22
Monthly CVE Trend
Affected Products (30)
PHP
160
School Event Management System
28
School Attendence Monitoring System
22
Baby Care System
22
Credit Card
18
Paypal
18
Debit Card Payment
18
Aplaya Beach Resort Online Reservation System
11
Online Student File Management System
8
Online Exam Form Submission
7
Interview Management System
7
Inventory Management System
7
Online Library System
7
Young Entrepreneur E Negosyo System
6
Farm Management System
5
Pool Of Bethesda Online Reservation System
4
E Commerce System
3
Point Of Sales
3
Water Billing System
3
Simple E Commerce Bookstore
3
Online Hotel Reservation System
3
Vehicle Management System
3
Online Class Record System
3
Online Reviewer System
3
E Learning System
3
Food Ordering System
2
Online Job Portal
2
Monbela Tourist Inn Online Reservation System
2
Engineers Online Portal
2
Multi Restaurant Table Reservation System
2
Top Risky CVEs
| CVE | Summary | Severity | CVSS | EPSS | Priority | Signals |
|---|---|---|---|---|---|---|
| CVE-2025-10600 | A flaw has been found in SourceCodester Online Exam Form Submission 1.0. Rated medium severity (CVSS 6.9), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available. | MEDIUM | 5.5 | 0.1% | 48 |
PoC
No patch
|
| CVE-2025-13233 | A vulnerability has been found in itsourcecode Inventory Management System 1.0. Rated medium severity (CVSS 6.9), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available. | MEDIUM | 5.5 | 0.1% | 48 |
PoC
No patch
|
| CVE-2025-13235 | A vulnerability was determined in itsourcecode Inventory Management System 1.0. Rated medium severity (CVSS 6.9), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available. | MEDIUM | 5.5 | 0.1% | 48 |
PoC
No patch
|
| CVE-2025-13237 | A security flaw has been discovered in itsourcecode Inventory Management System 1.0. Rated medium severity (CVSS 6.9), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available. | MEDIUM | 5.5 | 0.1% | 48 |
PoC
No patch
|
| CVE-2025-13257 | A security vulnerability has been detected in itsourcecode Inventory Management System 1.0. Rated medium severity (CVSS 6.9), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available. | MEDIUM | 5.5 | 0.1% | 48 |
PoC
No patch
|
| CVE-2025-10596 | A vulnerability was found in SourceCodester Online Exam Form Submission 1.0. Rated medium severity (CVSS 6.9), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available. | MEDIUM | 5.5 | 0.0% | 48 |
PoC
No patch
|
| CVE-2025-10601 | A vulnerability has been found in SourceCodester Online Exam Form Submission 1.0. Rated medium severity (CVSS 6.9), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available. | MEDIUM | 5.5 | 0.0% | 48 |
PoC
No patch
|
| CVE-2025-11430 | SQL injection in SourceCodester Simple E-Commerce Bookstore 1.0 allows remote attackers to manipulate the 'remove' parameter in /cart.php to execute arbitrary SQL commands. A publicly available proof-of-concept exploit exists, but the EPSS exploitation probability is very low (0.03%), indicating minimal real-world exploitation risk despite the remote attack vector. No active exploitation in the wild has been confirmed (CISA KEV not listed). | MEDIUM | 5.5 | 0.0% | 48 |
PoC
No patch
|
| CVE-2025-11476 | SQL injection in Simple E-Commerce Bookstore 1.0 allows remote attackers to execute arbitrary SQL via the login_username parameter in /index.php. The vulnerability permits unauthorized access to the database, potentially leading to data exposure or authentication bypass. Public exploit code is available, but no active exploitation or vendor patch has been confirmed. | MEDIUM | 5.5 | 0.0% | 48 |
PoC
No patch
|
| CVE-2025-11477 | SQL injection in the Wedding Reservation Management System 1.0 allows remote attackers to manipulate the 'User' parameter in /global.php to execute arbitrary SQL queries. A public proof-of-concept exploit exists, but no active exploitation has been confirmed in the wild. The low EPSS score (0.03%) suggests limited real-world exploitation likelihood despite the publicly available exploit. | MEDIUM | 5.5 | 0.0% | 48 |
PoC
No patch
|
| CVE-2025-11479 | SQL injection vulnerability in SourceCodester Wedding Reservation Management System 1.0 allows remote attackers to inject malicious SQL via the 'number' parameter in the insertReservation function of function.php, potentially compromising database confidentiality and integrity. Exploit code is publicly available, and the vulnerability has a CVSS 4.0 base score of 5.5 (Medium) with a low EPSS exploitation probability of 0.03%, indicating limited real-world risk while still enabling data theft or tampering. | MEDIUM | 5.5 | 0.0% | 48 |
PoC
No patch
|
| CVE-2025-11480 | SQL injection in Simple E-Commerce Bookstore 1.0 allows remote attackers to inject SQL via the register_username parameter during user registration, potentially exposing or altering database contents. Exploit code is publicly available, but EPSS indicates a low 0.03% exploitation probability, and no active exploitation is reported. | MEDIUM | 5.5 | 0.0% | 48 |
PoC
No patch
|
| CVE-2025-12292 | SQL injection in SourceCodester Point of Sales 1.0 exposes the login endpoint (/index.php) to unauthenticated remote exploitation via a malicious Username parameter, enabling database query manipulation. A public proof-of-concept exploit has been disclosed on GitHub (CVE/issues/2), confirming the attack is reproducible. EPSS sits at 0.03% (8th percentile), indicating limited observed exploitation in the wild despite POC availability - consistent with a niche, low-footprint product; no CISA KEV listing. | MEDIUM | 5.5 | 0.0% | 48 |
PoC
No patch
|
| CVE-2025-12293 | SQL injection in SourceCodester Point of Sales 1.0 (by janobe) via the Category parameter in /category.php allows remote, unauthenticated attackers to manipulate backend database queries with no user interaction required. The CVSS 4.0 base vector (AV:N/AC:L/AT:N/PR:N/UI:N) confirms exploitation is straightforward and requires no privileges, though impact is limited (VC:L/VI:L/VA:L), indicating partial data exposure and manipulation rather than full system compromise. A publicly available proof-of-concept exists - reflected in the E:P threat modifier - yet the very low EPSS score of 0.03% (8th percentile) and absence from CISA KEV indicate no public exploit identified at time of analysis has driven widespread automated attacks. | MEDIUM | 5.5 | 0.0% | 48 |
PoC
No patch
|
| CVE-2025-12926 | A weakness has been identified in SourceCodester Farm Management System 1.0. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available. | LOW | 2.1 | 0.0% | 31 |
PoC
No patch
|