5
CVEs
1
Critical
1
High
0
KEV
5
PoC
2
Unpatched C/H
0.0%
Patch Rate
0.0%
Avg EPSS
Severity Breakdown
CRITICAL
1
HIGH
1
MEDIUM
2
LOW
1
Monthly CVE Trend
Affected Products (30)
PHP
526
Online Computer And Laptop Store
32
Computer Laboratory Management System
30
Online Eyewear Shop
29
Clinic S Patient Management System
27
Lost And Found Information System
26
Human Resource Management System
24
Online Food Ordering System
24
Simple Online Bidding System
17
Food Ordering Management System
17
Ac Repair And Services System
16
Student Study Center Desk Management System
15
Service Provider Management System
15
Employee Task Management System
15
Employee And Visitor Gate Pass Logging System
14
Simple Customer Relationship Management System
13
Online Car Wash Booking System
13
Simple Cold Storage Management System
12
Simple Realtime Quiz System
12
Simple Student Attendance System
12
Car Driving School Management System
12
Establishment Billing Management System
11
Student Grading System
11
Online Mobile Store Management System
9
Pharmacy Point Of Sale System
9
Lot Reservation Management System
9
Simple Online Men S Salon Management System
8
Tracking Monitoring Management System
8
Stock Management System
8
Simple Company Website
7
Top Risky CVEs
| CVE | Summary | Severity | CVSS | EPSS | Priority | Signals |
|---|---|---|---|---|---|---|
| CVE-2026-30530 | SQL injection in SourceCodester Online Food Ordering System v1.0 allows remote attackers to execute arbitrary SQL commands through unsanitized input in the save_customer action's username parameter. The application fails to implement proper input validation or prepared statements, enabling attackers to manipulate database queries directly. Publicly available exploit code exists, and this vulnerability affects the PHP-based web application with no confirmed patch status at time of analysis. | CRITICAL | 9.8 | 0.0% | 69 |
PoC
No patch
|
| CVE-2026-30529 | SQL injection in SourceCodester Online Food Ordering System v1.0 allows authenticated attackers to execute arbitrary SQL commands via the username parameter in Actions.php (save_user action), due to improper input sanitization. Publicly available exploit code exists demonstrating this vulnerability. While CVSS and EPSS scores are unavailable, the authenticated requirement and public POC availability indicate moderate real-world risk for deployments with user account access. | HIGH | 8.8 | 0.0% | 64 |
PoC
No patch
|
| CVE-2026-30522 | SourceCodester Loan Management System v1.0 allows authenticated administrators to submit negative penalty rates for loan overdue payments by bypassing client-side validation through direct HTTP POST manipulation, enabling financial fraud through reversed penalty calculations that benefit borrowers instead of lenders. The vulnerability requires authenticated access but no CVSS score, EPSS probability, or formal patch status is available; however, publicly available exploit code confirms the vulnerability's technical feasibility. | MEDIUM | 6.5 | 0.0% | 52 |
PoC
No patch
|
| CVE-2026-30527 | Stored XSS in SourceCodester Online Food Ordering System v1.0 allows authenticated administrators to inject malicious JavaScript via the Category Name field in the admin panel, with payloads executing in the browsers of any user viewing the Category list. Publicly available exploit code exists; the vulnerability stems from insufficient input sanitization on a critical administrative function that affects all downstream users who access affected categories. | MEDIUM | 5.4 | 0.0% | 47 |
PoC
No patch
|
| CVE-2026-9564 | Stored cross-site scripting in SourceCodester Hospitals Patient Records Management System 1.0 allows a remote, high-privileged attacker to inject malicious script via the Remarks argument on the /admin/?page=patients/view_patient endpoint, resulting in low-integrity impact when a victim administrator views the affected patient record. A public proof-of-concept exploit exists (GitHub issue), though the CVSS 4.0 base score of 1.9 and EPSS of 0.03% (8th percentile) indicate low real-world exploitation likelihood. This is not listed in the CISA KEV catalog and SSVC classifies it as non-automatable with partial technical impact. | LOW | 1.9 | 0.0% | 30 |
PoC
No patch
|