53
CVEs
7
Critical
3
High
0
KEV
53
PoC
10
Unpatched C/H
0.0%
Patch Rate
0.0%
Avg EPSS
Severity Breakdown
CRITICAL
7
HIGH
3
MEDIUM
12
LOW
31
Monthly CVE Trend
Affected Products (30)
PHP
526
Online Computer And Laptop Store
32
Computer Laboratory Management System
30
Online Eyewear Shop
29
Clinic S Patient Management System
27
Lost And Found Information System
26
Human Resource Management System
24
Online Food Ordering System
24
Simple Online Bidding System
17
Food Ordering Management System
17
Ac Repair And Services System
16
Student Study Center Desk Management System
15
Service Provider Management System
15
Employee Task Management System
15
Employee And Visitor Gate Pass Logging System
14
Simple Customer Relationship Management System
13
Online Car Wash Booking System
13
Simple Cold Storage Management System
12
Simple Realtime Quiz System
12
Simple Student Attendance System
12
Car Driving School Management System
12
Establishment Billing Management System
11
Student Grading System
11
Online Mobile Store Management System
9
Pharmacy Point Of Sale System
9
Lot Reservation Management System
9
Simple Online Men S Salon Management System
8
Tracking Monitoring Management System
8
Stock Management System
8
Simple Company Website
7
Top Risky CVEs
| CVE | Summary | Severity | CVSS | EPSS | Priority | Signals |
|---|---|---|---|---|---|---|
| CVE-2026-26708 | Pharmacy Point of Sale System v1.0 has SQL injection in manage endpoints. | CRITICAL | 9.8 | 0.0% | 69 |
PoC
No patch
|
| CVE-2026-26704 | Pharmacy POS has a second SQL injection in view_categories. | CRITICAL | 9.8 | 0.0% | 69 |
PoC
No patch
|
| CVE-2026-26705 | Pharmacy POS has a third SQL injection in view_products. | CRITICAL | 9.8 | 0.0% | 69 |
PoC
No patch
|
| CVE-2026-26706 | Pharmacy POS has a fourth SQL injection in view_reports. | CRITICAL | 9.8 | 0.0% | 69 |
PoC
No patch
|
| CVE-2026-26707 | Pharmacy POS has a fifth SQL injection in view_sales. | CRITICAL | 9.8 | 0.0% | 69 |
PoC
No patch
|
| CVE-2026-30530 | SQL injection in SourceCodester Online Food Ordering System v1.0 allows remote attackers to execute arbitrary SQL commands through unsanitized input in the save_customer action's username parameter. The application fails to implement proper input validation or prepared statements, enabling attackers to manipulate database queries directly. Publicly available exploit code exists, and this vulnerability affects the PHP-based web application with no confirmed patch status at time of analysis. | CRITICAL | 9.8 | 0.0% | 69 |
PoC
No patch
|
| CVE-2025-70141 | Incorrect access control in SourceCodester Customer Support System 1.0 allows unauthenticated access to AJAX dispatcher, enabling full system compromise. PoC available. | CRITICAL | 9.4 | 0.4% | 67 |
PoC
No patch
|
| CVE-2026-30529 | SQL injection in SourceCodester Online Food Ordering System v1.0 allows authenticated attackers to execute arbitrary SQL commands via the username parameter in Actions.php (save_user action), due to improper input sanitization. Publicly available exploit code exists demonstrating this vulnerability. While CVSS and EPSS scores are unavailable, the authenticated requirement and public POC availability indicate moderate real-world risk for deployments with user account access. | HIGH | 8.8 | 0.0% | 64 |
PoC
No patch
|
| CVE-2025-63891 | Information Disclosure in web-accessible backup file in SourceCodester Simple Online Book Store System allows a remote unauthenticated attacker to disclose full database contents (including schema. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available. | HIGH | 7.5 | 0.1% | 58 |
PoC
No patch
|
| CVE-2026-26892 | Simple Logistic Hub Parcel\'S Management System versions up to 1.0 is affected by sql injection (CVSS 7.2). | HIGH | 7.2 | 0.0% | 56 |
PoC
No patch
|
| CVE-2026-30522 | SourceCodester Loan Management System v1.0 allows authenticated administrators to submit negative penalty rates for loan overdue payments by bypassing client-side validation through direct HTTP POST manipulation, enabling financial fraud through reversed penalty calculations that benefit borrowers instead of lenders. The vulnerability requires authenticated access but no CVSS score, EPSS probability, or formal patch status is available; however, publicly available exploit code confirms the vulnerability's technical feasibility. | MEDIUM | 6.5 | 0.0% | 52 |
PoC
No patch
|
| CVE-2025-65881 | Sourcecodester Zoo Management System v1.0 is vulnerable to Cross Site Scripting (XSS) in /classes/Login.php. | MEDIUM | 6.1 | 0.1% | 51 |
PoC
No patch
|
| CVE-2026-3746 | SQL injection in SourceCodester Simple Responsive Tourism Website 1.0 via the Username parameter in the Login.php component enables unauthenticated remote attackers to manipulate database queries and potentially extract sensitive data or modify application state. Public exploit code exists for this vulnerability, and no patch is currently available, leaving affected systems exposed to active exploitation. | MEDIUM | 5.5 | 0.1% | 48 |
PoC
No patch
|
| CVE-2025-12929 | A flaw has been found in SourceCodester Survey Application System 1.0. Rated medium severity (CVSS 6.9), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available. | MEDIUM | 5.5 | 0.1% | 48 |
PoC
No patch
|
| CVE-2025-13060 | A security vulnerability has been detected in SourceCodester Survey Application System 1.0. Rated medium severity (CVSS 6.9), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available. | MEDIUM | 5.5 | 0.1% | 48 |
PoC
No patch
|