261
CVEs
0
Critical
4
High
0
KEV
246
PoC
4
Unpatched C/H
0.0%
Patch Rate
0.2%
Avg EPSS
Severity Breakdown
CRITICAL
0
HIGH
4
MEDIUM
136
LOW
121
Monthly CVE Trend
Affected Products (30)
PHP
227
Class And Exam Timetabling System
48
Pharmacy Sales And Inventory System
23
Pizzafy Ecommerce System
22
Sales And Inventory System
12
Simple Online Food Ordering System
11
Syllabus Aligned Learning Management Examination System
7
Multi Vendor Online Grocery Management System
6
Onlne Examination Learning Management System
6
Inventory Management System
6
Hospitals Patient Records Management System
6
Simple Doctors Appointment System
6
Photo Share Website
5
Online Voting System
5
Sup Online Shopping
5
Laboratory Management System
5
Cet Automated Grading System With Ai Predictive Analytics
5
Simple And Nice Shopping Cart Script
4
Online Book Store System
4
Simple Pos And Inventory System
4
Indian Invoicing System
4
Student Grades Management System
4
Leave Application System
3
Inventory System
3
Simple Traffic Offense System
3
School Registration And Fee System
3
Pet Grooming Management Software
3
Stock Management System
3
Simple E Learning System
2
Restaurant Management System
2
Top Risky CVEs
| CVE | Summary | Severity | CVSS | EPSS | Priority | Signals |
|---|---|---|---|---|---|---|
| CVE-2019-18414 | Sourcecodester Restaurant Management System 1.0 is affected by an admin/staff-exec.php Cross Site Request Forgery vulnerability due to a lack of CSRF protection. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available. | HIGH | 8.8 | 0.5% | 64 |
PoC
No patch
|
| CVE-2019-18417 | Sourcecodester Restaurant Management System 1.0 allows an authenticated attacker to upload arbitrary files that can result in code execution. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available. | HIGH | 8.8 | 1.7% | 64 |
PoC
No patch
|
| CVE-2024-33306 | SourceCodester Laboratory Management System 1.0 is vulnerable to Cross Site Scripting (XSS) via "First Name" parameter in Create User. Rated high severity (CVSS 7.4), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available. | HIGH | 7.4 | 0.7% | 57 |
PoC
No patch
|
| CVE-2024-34231 | A cross-site scripting (XSS) vulnerability in Sourcecodester Laboratory Management System v1.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the System. Rated high severity (CVSS 7.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available. | HIGH | 7.1 | 0.5% | 56 |
PoC
No patch
|
| CVE-2024-33305 | SourceCodester Laboratory Management System 1.0 is vulnerable to Cross Site Scripting (XSS) via "Middle Name" parameter in Create User. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available. | MEDIUM | 6.1 | 0.4% | 50 |
PoC
No patch
|
| CVE-2024-34230 | A cross-site scripting (XSS) vulnerability in Sourcecodester Laboratory Management System v1.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the System. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available. | MEDIUM | 6.1 | 0.5% | 50 |
PoC
No patch
|
| CVE-2026-86292 | Missing authentication in SourceCodester Simple Traffic Offense System 1.0 allows unauthenticated remote attackers to create arbitrary user accounts by manipulating the `position` argument in `saveuser.php`. The user-creation endpoint fails to enforce any authentication gate (CWE-306), exposing it to direct network exploitation with no prerequisites. A public proof-of-concept exploit exists, raising the practical risk beyond what the moderate CVSS 4.0 score of 6.9 might suggest. | MEDIUM | 5.5 | 0.5% | 48 |
PoC
No patch
|
| CVE-2026-90526 | SQL injection in SourceCodester School Registration and Fee System 1.0 allows unauthenticated remote attackers to read, modify, or delete database contents via the Category parameter in /bilal/save_class.php. A public proof-of-concept exploit has been disclosed on GitHub, lowering the skill threshold for exploitation. No KEV listing exists, but the combination of unauthenticated network access and a publicly available exploit makes this an active concern for any deployed instance. | MEDIUM | 5.5 | 0.4% | 48 |
PoC
No patch
|
| CVE-2026-14641 | SQL injection in SourceCodester Class and Exam Timetabling System 1.0 exposes the `/edit_course.php` endpoint to unauthenticated remote database manipulation via a malicious `id` parameter. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) confirms zero-barrier remote exploitation with no authentication or user interaction required, and a public proof-of-concept exploit has been disclosed on GitHub. No active exploitation is confirmed in CISA KEV, though the combination of a public POC and fully unauthenticated attack path elevates practical risk for any internet-exposed deployment. | MEDIUM | 5.5 | 0.4% | 48 |
PoC
No patch
|
| CVE-2026-13485 | SQL injection in SourceCodester Class and Exam Timetabling System 1.0 exposes the `/preview.php` endpoint to remote unauthenticated exploitation via the unsanitized `course_year_section` parameter, allowing arbitrary SQL query execution against the backend database. A public proof-of-concept exploit has been published on GitHub, materially lowering the barrier to exploitation. Impact is rated low-to-partial across confidentiality, integrity, and availability, bounded by the database account's privileges, and no vendor patch has been identified at time of analysis. | MEDIUM | 5.5 | 0.4% | 48 |
PoC
No patch
|
| CVE-2026-13486 | SQL injection in SourceCodester Class and Exam Timetabling System 1.0 allows unauthenticated remote attackers to manipulate the `course_year_section` parameter on the `/preview6.php` endpoint, enabling unauthorized read and write access to the underlying database. The CVSS 4.0 vector (AV:N/AC:L/PR:N/UI:N) confirms exploitation requires no authentication and no special conditions, and a public proof-of-concept has been disclosed on GitHub. While not listed in CISA KEV, the trivially low attack complexity combined with POC availability raises the realistic exploitation risk above what the 5.5 medium score alone implies. | MEDIUM | 5.5 | 0.4% | 48 |
PoC
No patch
|
| CVE-2026-14642 | SQL injection in SourceCodester Class and Exam Timetabling System 1.0 exposes the database to remote unauthenticated attackers via the unvalidated ID parameter in /edit_class2.php. The CVSS 4.0 vector (AV:N/AC:L/PR:N/UI:N) confirms trivial, unauthenticated remote exploitation requiring no special conditions. Publicly available exploit code (E:P) lowers the bar to exploitation further, though the product's niche deployment footprint significantly limits real-world blast radius. No KEV listing; no patch identified at time of analysis. | MEDIUM | 5.5 | 0.4% | 48 |
PoC
No patch
|
| CVE-2026-14652 | SQL injection in SourceCodester Simple and Nice Shopping Cart Script 1.0 exposes the admin login interface to remote unauthenticated attackers through unsanitized input in the Username parameter of /admin/login.php. The CVSS 4.0 score of 6.9 (Medium) reflects limited per-request impact (VC:L/VI:L/VA:L), but a publicly available proof-of-concept exploit (E:P) on GitHub substantially lowers the exploitation bar for opportunistic attackers. No KEV listing exists at time of analysis; however, the trivial attack complexity (AC:L, AT:N, PR:N, UI:N) combined with public exploit code makes any internet-facing deployment of this script an immediate remediation priority. | MEDIUM | 5.5 | 0.4% | 48 |
PoC
No patch
|
| CVE-2026-14653 | SQL injection in SourceCodester Simple and Nice Shopping Cart Script 1.0 enables remote, unauthenticated attackers to manipulate database queries through the user_id parameter in /admin/mensproductdeletequery.php, exposing partial confidentiality, integrity, and availability of the underlying database. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) indicates no authentication or special conditions are required for exploitation over the network. A public exploit has been disclosed on GitHub, elevating the practical risk above the raw score suggests - though this is not confirmed as actively exploited by CISA KEV at time of analysis. | MEDIUM | 5.5 | 0.4% | 48 |
PoC
No patch
|
| CVE-2026-16227 | SQL injection in SourceCodester Class and Exam Timetabling System 1.0 exposes the `/edit_subject.php` endpoint to unauthenticated remote exploitation via the unsanitized `id` parameter. The CVSS 4.0 vector (AV:N/AC:L/PR:N/UI:N) confirms zero-barrier network access with no authentication or user interaction required against default installations. A public proof-of-concept exploit has been disclosed on GitHub, substantially lowering the skill threshold for exploitation; however, this vulnerability is not currently listed in CISA KEV, so confirmed active exploitation has not been established. | MEDIUM | 5.5 | 0.4% | 48 |
PoC
No patch
|