10
CVEs
0
Critical
0
High
0
KEV
10
PoC
0
Unpatched C/H
0.0%
Patch Rate
0.1%
Avg EPSS
Severity Breakdown
CRITICAL
0
HIGH
0
MEDIUM
7
LOW
3
Monthly CVE Trend
Affected Products (30)
PHP
202
Advanced Library Management System
17
Online Examination System
16
Online Time Table Generator
15
Life Insurance Management System
14
Travel Management System
13
Online Food Ordering System
13
Visitor Management System
9
Online Lawyer Management System
8
Online Admission System
7
Hospital Management System In Php
7
Online Matrimonial Project
7
Student Project Allocation System
6
Online Doctor Appointment Booking System Php And Mysql
6
Car Rental Project
5
Online Movie Ticket Booking System
5
Online Art Gallery Shop
5
Online Food Ordering Script
4
House Rental And Property Listing Project
4
Online Hotel Booking
4
Expense Management System
4
Online Shopping System
4
Leave Management System
3
Online Voting System Project
3
Online Job Portal
3
Railway Reservation System
3
Doctor Appointment System
3
Open Redirect
3
Asset Management System
2
Lawyer Management System
2
Top Risky CVEs
| CVE | Summary | Severity | CVSS | EPSS | Priority | Signals |
|---|---|---|---|---|---|---|
| CVE-2026-8785 | SQL injection in projectworlds Hospital Management System in PHP 1.0 enables unauthenticated remote attackers to extract or modify patient data through the appointment_no parameter in update_info.php. The vulnerability has publicly available exploit code and affects the getAllPatientDetail function, with the vendor notified but unresponsive. | MEDIUM | 5.5 | 0.0% | 48 |
PoC
No patch
|
| CVE-2026-4540 | SQL injection in projectworlds Online Notes Sharing System 1.0 allows unauthenticated remote attackers to manipulate the Benutzer parameter in /login.php, enabling unauthorized data access, modification, or denial of service. Public exploit code exists for this vulnerability, and no patch is currently available. | MEDIUM | 5.5 | 0.0% | 48 |
PoC
No patch
|
| CVE-2026-5368 | SQL injection in projectworlds Car Rental Project 1.0 login.php allows unauthenticated remote attackers to bypass authentication, extract sensitive database contents, and potentially modify or delete data via the 'uname' parameter. Publicly available exploit code exists (GitHub POC published), significantly lowering the barrier to exploitation. EPSS data not available, but the combination of network-accessible attack vector, no authentication requirement, and public exploit makes this a practical threat for internet-facing deployments of this vulnerable application. | MEDIUM | 5.5 | 0.0% | 48 |
PoC
No patch
|
| CVE-2026-5634 | SQL injection in projectworlds Car Rental Project 1.0 allows remote attackers to execute arbitrary SQL queries via the fname parameter in /book_car.php, enabling unauthenticated database manipulation with potential confidentiality and integrity impact. The vulnerability has publicly available exploit code and a moderate CVSS score of 6.9, indicating practical exploitability despite low attack complexity. | MEDIUM | 5.5 | 0.0% | 48 |
PoC
No patch
|
| CVE-2026-5637 | SQL injection in projectworlds Car Rental System 1.0 allows unauthenticated remote attackers to execute arbitrary SQL commands via the Message parameter in /message_admin.php. Publicly available exploit code exists, significantly lowering the barrier to exploitation. The vulnerability enables unauthorized data access, modification, and potential denial of service against the administrative messaging interface. CVSS 7.3 severity reflects network-accessible attack vector with low complexity and no authentication requirement. | MEDIUM | 5.5 | 0.0% | 48 |
PoC
No patch
|
| CVE-2026-5645 | SQL injection in projectworlds Car Rental System 1.0 allows unauthenticated remote attackers to manipulate database queries via the mpesa parameter in /pay.php. The vulnerability carries a CVSS score of 7.3 with network-based exploitation requiring low complexity and no user interaction. Publicly available exploit code exists (GitHub POC published), significantly lowering the barrier to exploitation, though no CISA KEV listing confirms active widespread exploitation at time of analysis. | MEDIUM | 5.5 | 0.0% | 48 |
PoC
No patch
|
| CVE-2026-9364 | SQL injection in Online Art Gallery Shop 1.0 allows unauthenticated remote attackers to manipulate database queries through the social_linked parameter in /admin/adminHome.php. The vulnerability has publicly available exploit code and a CVSS score of 7.3, indicating high severity with the ability to impact confidentiality, integrity, and availability of the application. | MEDIUM | 5.5 | 0.0% | 48 |
PoC
No patch
|
| CVE-2026-86238 | Reflected cross-site scripting in projectworlds Online Examination System 1.0 allows unauthenticated remote attackers to inject arbitrary JavaScript via the Name and Subject parameters of feedback.php. Exploitation delivers malicious script payload to any user whose browser renders the tampered response, enabling session hijacking, credential theft, or defacement within the application context. A public proof-of-concept exploit is available on GitHub; no CISA KEV listing has been identified at time of analysis. | LOW | 2.1 | 0.4% | 31 |
PoC
No patch
|
| CVE-2026-4596 | A stored or reflected cross-site scripting (XSS) vulnerability exists in projectworlds Lawyer Management System version 1.0, specifically in the /lawyers.php file where the first_Name parameter is inadequately sanitized. An authenticated attacker can inject malicious JavaScript that executes in the context of other users' browsers, potentially stealing session tokens or performing unauthorized actions. A public proof-of-concept exploit is available, and exploitation requires only low complexity with user interaction (UI:R), though the attack vector is network-accessible and does not require high privileges. | LOW | 2.0 | 0.0% | 30 |
PoC
No patch
|
| CVE-2026-4626 | A stored cross-site scripting (XSS) vulnerability exists in projectworlds Lawyer Management System version 1.0 within the /lawyer_booking.php file, where the Description parameter fails to sanitize user input before rendering. An authenticated attacker can inject malicious JavaScript that executes in the context of other users' browsers, potentially leading to session hijacking, credential theft, or unauthorized actions. A proof-of-concept exploit has been publicly disclosed on GitHub, and the vulnerability carries a CVSS score of 3.5 with evidence of public exploitation. | LOW | 2.0 | 0.0% | 30 |
PoC
No patch
|