25
CVEs
1
Critical
0
High
0
KEV
23
PoC
1
Unpatched C/H
0.0%
Patch Rate
0.2%
Avg EPSS
Severity Breakdown
CRITICAL
1
HIGH
0
MEDIUM
12
LOW
12
Monthly CVE Trend
Affected Products (5)
Top Risky CVEs
| CVE | Summary | Severity | CVSS | EPSS | Priority | Signals |
|---|---|---|---|---|---|---|
| CVE-2024-40110 | Sourcecodester Poultry Farm Management System v1.0 contains an Unauthenticated Remote Code Execution (RCE) vulnerability via the productimage parameter at /farm/product.php. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available. | CRITICAL | 9.8 | 1.9% | 69 |
PoC
No patch
|
| CVE-2024-40402 | A SQL injection vulnerability was found in 'ajax.php' of Sourcecodester Simple Library Management System 1.0. Rated medium severity (CVSS 6.3), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available. | MEDIUM | 6.3 | 0.4% | 52 |
PoC
No patch
|
| CVE-2025-5712 | Critical SQL injection vulnerability in SourceCodester Open Source Clinic Management System 1.0 affecting the /appointment.php file's patient parameter. An unauthenticated remote attacker can exploit this to execute arbitrary SQL queries, potentially compromising data confidentiality, integrity, and availability. The exploit has been publicly disclosed with proof-of-concept availability, significantly elevating real-world exploitation risk. | MEDIUM | 5.5 | 0.0% | 48 |
PoC
No patch
|
| CVE-2025-5716 | A remote code execution vulnerability in A vulnerability classified as critical (CVSS 7.3). Risk factors: public PoC available. | MEDIUM | 5.5 | 0.0% | 48 |
PoC
No patch
|
| CVE-2025-5758 | Critical SQL injection vulnerability in SourceCodester Open Source Clinic Management System v1.0, specifically in the /doctor.php file where the 'doctorname' parameter is insufficiently sanitized. An unauthenticated remote attacker can exploit this to execute arbitrary SQL queries, potentially leading to unauthorized data access, modification, or deletion of sensitive healthcare information. The vulnerability has public exploit disclosure and may be actively exploited. | MEDIUM | 5.5 | 0.0% | 48 |
PoC
No patch
|
| CVE-2025-5755 | SourceCodester Open Source Clinic Management System version 1.0 contains a critical SQL injection vulnerability in the /email_config.php file affecting the 'email' parameter. An unauthenticated remote attacker can exploit this to execute arbitrary SQL commands, potentially leading to unauthorized data access, modification, or system compromise. Public disclosure and exploit code availability significantly elevate real-world risk. | MEDIUM | 5.5 | 0.0% | 48 |
PoC
No patch
|
| CVE-2025-11397 | SQL injection in the login page of SourceCodester Hotel and Lodge Management System 1.0 allows remote unauthenticated attackers to manipulate the database via the email parameter. A public proof-of-concept exploit is available, but no active exploitation has been confirmed and the EPSS score is very low (0.03%), indicating the vulnerability is unlikely to be widely targeted. | MEDIUM | 5.5 | 0.0% | 48 |
PoC
No patch
|
| CVE-2025-11471 | SQL injection in SourceCodester Hotel and Lodge Management System 1.0 allows remote attackers to manipulate database queries via the ID parameter in the /edit_customer.php endpoint. Exploit code is publicly available, though EPSS suggests low exploitation probability (0.03%). The vulnerability can lead to unauthorized data modification or exfiltration with low impact on confidentiality, integrity, and availability. | MEDIUM | 5.5 | 0.0% | 48 |
PoC
No patch
|
| CVE-2025-11472 | SQL injection in SourceCodester Hotel and Lodge Management System 1.0 allows unauthenticated remote attackers to manipulate the ID parameter of /edit_room.php, leading to unauthorized database access or modification. A proof-of-concept exploit is publicly available, though active exploitation is not confirmed. The vulnerability affects the default installation without any special configuration changes. | MEDIUM | 5.5 | 0.0% | 48 |
PoC
No patch
|
| CVE-2025-11473 | Remote SQL injection in SourceCodester Hotel and Lodge Management System 1.0 allows attackers to manipulate database queries via the currsymbol parameter in /edit_curr.php. Exploit code is publicly available, but no active exploitation has been confirmed, and EPSS indicates a low exploitation probability (0.03%). | MEDIUM | 5.5 | 0.0% | 48 |
PoC
No patch
|
| CVE-2024-4809 | A vulnerability has been found in SourceCodester Open Source Clinic Management System 1.0 and classified as critical. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available. | MEDIUM | 5.3 | 1.2% | 46 |
PoC
No patch
|
| CVE-2025-5728 | Unrestricted file upload in SourceCodester Open Source Clinic Management System 1.0 allows remote authenticated attackers to upload arbitrary files via the website_image parameter in /manage_website.php. Public exploit code exists, but no active exploitation has been confirmed. EPSS score is low (0.10%), indicating limited exploitation likelihood. | LOW | 2.1 | 0.1% | 31 |
PoC
No patch
|
| CVE-2025-11398 | Unrestricted file upload vulnerability in SourceCodester Hotel and Lodge Management System 1.0 allows authenticated remote attackers to upload arbitrary files via manipulation of the image parameter in /profile.php, with publicly available exploit code and low real-world risk despite network accessibility due to authentication requirement and minimal impact scope. | LOW | 2.1 | 0.0% | 31 |
PoC
No patch
|
| CVE-2025-11399 | SQL injection in SourceCodester Hotel and Lodge Management System 1.0 allows authenticated remote attackers to execute arbitrary SQL queries via the floorno parameter in /pages/save_room.php, affecting data confidentiality and integrity with limited scope. CVSS score of 2.1 reflects low severity due to authentication requirement and limited impact, though publicly available exploit code exists and EPSS suggests minimal real-world exploitation probability at 0.03%. | LOW | 2.1 | 0.0% | 31 |
PoC
No patch
|
| CVE-2025-11400 | SQL injection in SourceCodester Hotel and Lodge Management System 1.0 allows authenticated remote attackers to manipulate the ID parameter in /del_room.php, enabling database query modification with limited confidentiality and integrity impact. Publicly available exploit code exists; however, EPSS score of 0.03% indicates minimal real-world exploitation probability despite low attack complexity, suggesting this is primarily a security researcher proof-of-concept rather than an active threat. | LOW | 2.1 | 0.0% | 31 |
PoC
No patch
|