17
CVEs
0
Critical
0
High
0
KEV
15
PoC
0
Unpatched C/H
0.0%
Patch Rate
0.0%
Avg EPSS
Severity Breakdown
CRITICAL
0
HIGH
0
MEDIUM
6
LOW
11
Monthly CVE Trend
Affected Products (5)
Top Risky CVEs
| CVE | Summary | Severity | CVSS | EPSS | Priority | Signals |
|---|---|---|---|---|---|---|
| CVE-2025-11397 | SQL injection in the login page of SourceCodester Hotel and Lodge Management System 1.0 allows remote unauthenticated attackers to manipulate the database via the email parameter. A public proof-of-concept exploit is available, but no active exploitation has been confirmed and the EPSS score is very low (0.03%), indicating the vulnerability is unlikely to be widely targeted. | MEDIUM | 5.5 | 0.0% | 48 |
PoC
No patch
|
| CVE-2025-11471 | SQL injection in SourceCodester Hotel and Lodge Management System 1.0 allows remote attackers to manipulate database queries via the ID parameter in the /edit_customer.php endpoint. Exploit code is publicly available, though EPSS suggests low exploitation probability (0.03%). The vulnerability can lead to unauthorized data modification or exfiltration with low impact on confidentiality, integrity, and availability. | MEDIUM | 5.5 | 0.0% | 48 |
PoC
No patch
|
| CVE-2025-11472 | SQL injection in SourceCodester Hotel and Lodge Management System 1.0 allows unauthenticated remote attackers to manipulate the ID parameter of /edit_room.php, leading to unauthorized database access or modification. A proof-of-concept exploit is publicly available, though active exploitation is not confirmed. The vulnerability affects the default installation without any special configuration changes. | MEDIUM | 5.5 | 0.0% | 48 |
PoC
No patch
|
| CVE-2025-11473 | Remote SQL injection in SourceCodester Hotel and Lodge Management System 1.0 allows attackers to manipulate database queries via the currsymbol parameter in /edit_curr.php. Exploit code is publicly available, but no active exploitation has been confirmed, and EPSS indicates a low exploitation probability (0.03%). | MEDIUM | 5.5 | 0.0% | 48 |
PoC
No patch
|
| CVE-2025-11398 | Unrestricted file upload vulnerability in SourceCodester Hotel and Lodge Management System 1.0 allows authenticated remote attackers to upload arbitrary files via manipulation of the image parameter in /profile.php, with publicly available exploit code and low real-world risk despite network accessibility due to authentication requirement and minimal impact scope. | LOW | 2.1 | 0.0% | 31 |
PoC
No patch
|
| CVE-2025-11399 | SQL injection in SourceCodester Hotel and Lodge Management System 1.0 allows authenticated remote attackers to execute arbitrary SQL queries via the floorno parameter in /pages/save_room.php, affecting data confidentiality and integrity with limited scope. CVSS score of 2.1 reflects low severity due to authentication requirement and limited impact, though publicly available exploit code exists and EPSS suggests minimal real-world exploitation probability at 0.03%. | LOW | 2.1 | 0.0% | 31 |
PoC
No patch
|
| CVE-2025-11400 | SQL injection in SourceCodester Hotel and Lodge Management System 1.0 allows authenticated remote attackers to manipulate the ID parameter in /del_room.php, enabling database query modification with limited confidentiality and integrity impact. Publicly available exploit code exists; however, EPSS score of 0.03% indicates minimal real-world exploitation probability despite low attack complexity, suggesting this is primarily a security researcher proof-of-concept rather than an active threat. | LOW | 2.1 | 0.0% | 31 |
PoC
No patch
|
| CVE-2025-11401 | SQL injection in SourceCodester Hotel and Lodge Management System 1.0 allows authenticated remote attackers to manipulate the currcode parameter in /pages/save_curr.php, enabling arbitrary SQL query execution with limited confidentiality and integrity impact. CVSS 2.1 reflects the authentication requirement (PR:L) and restricted scope, but publicly available exploit code exists despite low EPSS score (0.03%), suggesting this is a low-priority threat suitable only for defense-in-depth and secure coding reviews rather than emergency patching. | LOW | 2.1 | 0.0% | 31 |
PoC
No patch
|
| CVE-2025-11402 | SQL injection in SourceCodester Hotel and Lodge Management System 1.0 allows authenticated remote attackers to manipulate the ID parameter in /del_curr.php, enabling database query modification with low confidentiality, integrity, and availability impact. Publicly available exploit code exists; however, the EPSS score of 0.03% indicates low real-world exploitation probability despite public disclosure, suggesting limited practical risk in typical deployments. | LOW | 2.1 | 0.0% | 31 |
PoC
No patch
|
| CVE-2025-11403 | SQL injection in SourceCodester Hotel and Lodge Management System 1.0 allows authenticated remote attackers to manipulate the ID parameter in /del_booking.php, enabling unauthorized database queries with limited impact on confidentiality and integrity. Publicly available exploit code exists, but the EPSS score of 0.03% indicates minimal real-world exploitation probability despite low attack complexity, likely due to authentication requirement and limited scope of impact. | LOW | 2.1 | 0.0% | 31 |
PoC
No patch
|
| CVE-2025-11404 | SQL injection in SourceCodester Hotel and Lodge Management System 1.0 allows authenticated remote attackers to manipulate the percentage argument in /pages/save_tax.php, enabling database query modification with limited confidentiality and integrity impact. Publicly available exploit code exists, though EPSS score of 0.03% suggests low real-world exploitation probability despite the SQL injection capability. | LOW | 2.1 | 0.0% | 31 |
PoC
No patch
|
| CVE-2025-11405 | SQL injection in SourceCodester Hotel and Lodge Management System 1.0 allows authenticated remote attackers to execute arbitrary SQL commands via the ID parameter in /del_tax.php. The vulnerability has a low CVSS score (2.1) due to authentication requirements and limited technical impact, but publicly available exploit code exists and the EPSS score of 0.03% indicates minimal real-world exploitation probability despite public POC availability. | LOW | 2.1 | 0.0% | 31 |
PoC
No patch
|
| CVE-2025-11469 | SQL injection in SourceCodester Hotel and Lodge Management System 1.0 allows authenticated remote attackers to manipulate the Contact parameter in /pages/save_customer.php, enabling data exfiltration or modification with limited scope impact. Publicly available exploit code exists and the vulnerability carries a low CVSS score (2.1) due to requirement for prior authentication and limited technical impact, though the public exploit availability increases practical exploitation risk for unpatched instances. | LOW | 2.1 | 0.0% | 31 |
PoC
No patch
|
| CVE-2025-11474 | SQL injection in SourceCodester Hotel and Lodge Management System 1.0 allows authenticated remote attackers to manipulate the Name parameter in /edit_booking.php, resulting in limited confidentiality and integrity impact. The vulnerability has public exploit code available but carries exceptionally low EPSS exploitation probability (0.03%, 8th percentile), suggesting minimal real-world threat despite network accessibility and low attack complexity. | LOW | 2.1 | 0.0% | 31 |
PoC
No patch
|
| CVE-2025-11470 | Unrestricted file upload in SourceCodester Hotel and Lodge Management System version 1.0 allows high-privileged authenticated attackers to upload arbitrary files via the website_image or back_login_image parameters in /manage_website.php, potentially enabling remote code execution. Publicly available exploit code exists, though the low CVSS score of 2.0 reflects the requirement for high-level administrative privileges to trigger the vulnerability. | LOW | 2.0 | 0.1% | 30 |
PoC
No patch
|