19
CVEs
1
Critical
0
High
0
KEV
17
PoC
1
Unpatched C/H
0.0%
Patch Rate
0.1%
Avg EPSS
Severity Breakdown
CRITICAL
1
HIGH
0
MEDIUM
10
LOW
8
Monthly CVE Trend
Affected Products (30)
PHP
54
Employee Management System
5
Daily Habit Tracker
5
Student Grades Management System
5
Faq Management System
4
Modern Image Gallery App
3
User Registration And Login System
3
Computer Inventory System
3
Sticky Notes App
3
Accounts Manager App
3
File Manager App
3
Food Menu Manager
2
School Task Manager
2
Travel Journal Using Php And Mysql With Source Code
2
Online Food Menu
2
Testimonial Page Manager
2
Todo List In Kanban Board
2
Crud Without Page Reload Refresh
2
Contact Manager With Export To Vcf
2
Ai Powered To Do List App
1
Api Key Manager App
1
Faq Bot With Ai Assistant
1
Barangay Population Monitoring System
1
Product Review Rating System
1
School Visitor Log E Book
1
Ai Font Matcher
1
Matching Type Test
1
Real Estate Property Listing App
1
Math Game
1
Product Inventory With Export To Excel
1
Top Risky CVEs
| CVE | Summary | Severity | CVSS | EPSS | Priority | Signals |
|---|---|---|---|---|---|---|
| CVE-2025-70457 | Sourcecodester Modern Image Gallery App v1.0 has an arbitrary file upload in the gallery endpoint allowing unauthenticated remote code execution. | CRITICAL | 9.8 | 0.3% | 69 |
PoC
No patch
|
| CVE-2025-63892 | A vulnerability was determined in SourceCodester Student Grades Management System 1.0. Rated medium severity (CVSS 6.8), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available. | MEDIUM | 6.8 | 0.1% | 54 |
PoC
No patch
|
| CVE-2026-3695 | SourceCodester Modern Image Gallery App 1.0 contains a path traversal vulnerability in the /delete.php file that allows unauthenticated remote attackers to manipulate the filename parameter and access or delete arbitrary files. Public exploit code exists for this vulnerability, and no patch is currently available. The vulnerability can lead to information disclosure or file deletion on affected systems. | MEDIUM | 5.5 | 0.0% | 48 |
PoC
No patch
|
| CVE-2025-64070 | Sourcecodester Student Grades Management System v1.0 is vulnerable to Cross Site Scripting (XSS) in the Add New Subject Description field. | MEDIUM | 5.4 | 0.0% | 47 |
PoC
No patch
|
| CVE-2025-70458 | A DOM-based Cross-Site Scripting (XSS) vulnerability exists in the DomainCheckerApp class within domain/script.js of Sourcecodester Domain Availability Checker v1.0. [CVSS 5.4 MEDIUM] | MEDIUM | 5.4 | 0.0% | 47 |
PoC
No patch
|
| CVE-2026-3163 | Website Link Extractor versions up to 1.0 is affected by server-side request forgery (ssrf) (CVSS 6.3). | LOW | 2.1 | 0.0% | 31 |
PoC
No patch
|
| CVE-2026-3070 | Reflected XSS in SourceCodester Modern Image Gallery App 1.0 allows unauthenticated remote attackers to inject malicious scripts through the filename parameter in upload.php. Public exploit code exists for this vulnerability, though it requires user interaction to succeed. No patch is currently available. | LOW | 2.1 | 0.0% | 31 |
PoC
No patch
|
| CVE-2026-3302 | Cross-site scripting (XSS) in SourceCodester Doctor Appointment System 1.0 allows unauthenticated remote attackers to inject malicious scripts via the Email parameter in the /register.php Sign Up Page. Public exploit code exists for this vulnerability, increasing the risk of active exploitation. The lack of an available patch leaves affected systems vulnerable to session hijacking and credential theft. | LOW | 2.1 | 0.0% | 31 |
PoC
No patch
|
| CVE-2025-14530 | Unrestricted file upload in SourceCodester Real Estate Property Listing App 1.0 allows high-privileged authenticated users to upload arbitrary files via the image parameter in /admin/property.php, potentially leading to remote code execution. The vulnerability affects only administrators or high-privilege accounts due to PR:H requirements, but public exploit code exists and EPSS scoring indicates low real-world exploitation probability (0.07th percentile). | LOW | 2.0 | 0.1% | 30 |
PoC
No patch
|
| CVE-2025-13349 | A vulnerability has been found in SourceCodester Student Grades Management System 1.0.php of the component Add New Grade Page. Rated medium severity (CVSS 5.1), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available. | LOW | 2.0 | 0.1% | 30 |
PoC
No patch
|
| CVE-2025-12332 | Stored cross-site scripting (XSS) vulnerability in SourceCodester Student Grades Management System 1.0 allows authenticated administrators with high privileges to inject malicious scripts via the delete_user function in /admin.php, which execute in the context of other users' browsers when they interact with affected content. The vulnerability requires user interaction and administrative privileges to exploit, resulting in low integrity impact with a CVSS score of 1.9. Publicly available exploit code exists, though the very low EPSS score (0.05%, 14th percentile) suggests limited real-world exploitation despite POC availability. | LOW | 1.9 | 0.0% | 30 |
PoC
No patch
|
| CVE-2025-11485 | Stored cross-site scripting (XSS) in SourceCodester Student Grades Management System 1.0 allows authenticated administrators with high privileges to inject malicious scripts via the first_name or last_name parameters in the Manage Users Page (/admin.php), which are then executed when viewed by other users. The vulnerability requires administrator authentication and user interaction (page view), limiting real-world impact despite public exploit availability. EPSS exploitation probability is extremely low (0.03%, 9th percentile), reflecting the restrictive access controls (PR:H) and user interaction requirement (UI:P) despite network-accessible delivery. | LOW | 1.9 | 0.0% | 30 |
PoC
No patch
|
| CVE-2026-0580 | A vulnerability was found in SourceCodester API Key Manager App 1.0. Affected by this vulnerability is an unknown functionality of the component Import Key Handler. [CVSS 3.5 LOW] | LOW | 2.0 | 0.0% | 10 |
No patch
|
| CVE-2025-26258 | Sourcecodester Employee Management System v1.0 is vulnerable to Cross Site Scripting (XSS) via 'Add Designation.'. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available. | MEDIUM | 6.1 | 0.0% | – |
No patch
|
| CVE-2025-63713 | Cross-Site Scripting (XSS) vulnerability in SourceCodester "MatchMaster" 1.0 allows remote attackers to inject arbitrary web script or HTML via crafted input in the custom test creation feature. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available. | MEDIUM | 6.1 | 0.1% | – |
PoC
No patch
|