66
CVEs
0
Critical
0
High
0
KEV
61
PoC
0
Unpatched C/H
0.0%
Patch Rate
0.3%
Avg EPSS
Severity Breakdown
CRITICAL
0
HIGH
0
MEDIUM
44
LOW
22
Monthly CVE Trend
Affected Products (30)
PHP
234
Class And Exam Timetabling System
48
Pharmacy Sales And Inventory System
23
Pizzafy Ecommerce System
22
Sales And Inventory System
12
Simple Online Food Ordering System
11
Syllabus Aligned Learning Management Examination System
7
Multi Vendor Online Grocery Management System
6
Hospitals Patient Records Management System
6
Onlne Examination Learning Management System
6
Simple Doctors Appointment System
6
Inventory Management System
6
Cet Automated Grading System With Ai Predictive Analytics
5
Photo Share Website
5
Online Voting System
5
Laboratory Management System
5
Sup Online Shopping
5
Online Book Store System
4
Simple Pos And Inventory System
4
Indian Invoicing System
4
Student Grades Management System
4
Simple And Nice Shopping Cart Script
4
Online Food Ordering System
3
Simple Traffic Offense System
3
Leave Application System
3
School Registration And Fee System
3
Online Faculty Clearance System
3
Inventory System
3
Pet Grooming Management Software
3
Stock Management System
3
Top Risky CVEs
| CVE | Summary | Severity | CVSS | EPSS | Priority | Signals |
|---|---|---|---|---|---|---|
| CVE-2026-86292 | Missing authentication in SourceCodester Simple Traffic Offense System 1.0 allows unauthenticated remote attackers to create arbitrary user accounts by manipulating the `position` argument in `saveuser.php`. The user-creation endpoint fails to enforce any authentication gate (CWE-306), exposing it to direct network exploitation with no prerequisites. A public proof-of-concept exploit exists, raising the practical risk beyond what the moderate CVSS 4.0 score of 6.9 might suggest. | MEDIUM | 5.5 | 0.5% | 48 |
PoC
No patch
|
| CVE-2026-90526 | SQL injection in SourceCodester School Registration and Fee System 1.0 allows unauthenticated remote attackers to read, modify, or delete database contents via the Category parameter in /bilal/save_class.php. A public proof-of-concept exploit has been disclosed on GitHub, lowering the skill threshold for exploitation. No KEV listing exists, but the combination of unauthenticated network access and a publicly available exploit makes this an active concern for any deployed instance. | MEDIUM | 5.5 | 0.4% | 48 |
PoC
No patch
|
| CVE-2026-78247 | SQL injection in SourceCodester Simple Online Food Ordering System 1.0 exposes the `/fos/admin/ajax.php?action=confirm_order` endpoint to arbitrary database query manipulation via the unsanitized `ID` parameter. A public proof-of-concept exploit is available on GitHub, materially elevating exploitation risk beyond the base CVSS 4.0 score of 6.9, though no CISA KEV listing has been confirmed at time of analysis. Any internet-exposed deployment running this PHP application is at immediate risk of database enumeration and data exfiltration by unauthenticated remote attackers. | MEDIUM | 5.5 | 0.4% | 48 |
PoC
No patch
|
| CVE-2026-86209 | Unauthenticated SQL injection in SourceCodester Class and Exam Timetabling System 1.0 allows remote attackers to manipulate the database through the ID parameter in /delete_user.php. The vulnerability requires no privileges or user interaction, and a public proof-of-concept exploit has been published on GitHub. Impact is limited by the CVSS 4.0 assessment (VC:L/VI:L/VA:L), suggesting partial data read/write rather than full database compromise, though chained exploitation could escalate impact. | MEDIUM | 5.5 | 0.4% | 48 |
PoC
No patch
|
| CVE-2026-86210 | SQL injection in SourceCodester Class and Exam Timetabling System 1.0 exposes the `/delete_user_account.php` endpoint to unauthenticated remote exploitation via an unsanitized `id` parameter. The flaw allows attackers to read, modify, or delete underlying database records without any authentication credential. A public proof-of-concept exploit is available via GitHub, materially elevating practical risk beyond what the moderate CVSS 4.0 score of 6.9 might suggest at face value. | MEDIUM | 5.5 | 0.4% | 48 |
PoC
No patch
|
| CVE-2026-90516 | SQL injection in SourceCodester School Registration and Fee System 1.0 allows remote unauthenticated attackers to manipulate database queries via the `period` parameter of `/bilal/normal/pay_report.php`. A public proof-of-concept exploit has been published on GitHub (vuldb.com/submit/912055, github.com/zuojiu567/cve/issues/3), lowering the bar for exploitation significantly. No vendor patch has been identified at time of analysis, leaving deployments exposed with no vendor-supplied remediation path. | MEDIUM | 5.5 | 0.4% | 48 |
PoC
No patch
|
| CVE-2026-86208 | SQL injection in SourceCodester Class and Exam Timetabling System 1.0 exposes the /delete_teacher.php endpoint to unauthenticated remote database manipulation via an unsanitized ID parameter (CWE-89). A proof-of-concept exploit has been publicly released on GitHub, making opportunistic exploitation straightforward for low-skilled attackers. Attackers with network access to the application can extract, modify, or delete records from the underlying database without supplying credentials. | MEDIUM | 5.5 | 0.3% | 48 |
PoC
No patch
|
| CVE-2026-75014 | SQL injection in SourceCodester Pet Grooming Management Software 1.0 exposes the /admin/get_barcode_data.php endpoint to remote attackers who can manipulate the unsanitized 'barcode' parameter to read, alter, or corrupt the underlying database. The CVSS 4.0 vector assigns no authentication or user-interaction requirement, and a publicly available proof-of-concept lowers the exploitation bar to script-level effort. No CISA KEV listing exists, but the combination of a network-exposed attack surface and published exploit code makes this a higher practical priority than the nominal Medium score implies for any internet-facing deployment. | MEDIUM | 5.5 | 0.3% | 48 |
PoC
No patch
|
| CVE-2026-76048 | SQL injection in SourceCodester Simple Online Food Ordering System 1.0 exposes the unauthenticated admin login endpoint /admin/ajax.php?action=login to remote exploitation via the unsanitized Username parameter. A publicly available proof-of-concept exploit has been published on GitHub, reducing the bar for exploitation to near-zero skill level. The CVSS 4.0 vector confirms no authentication, privileges, or user interaction are required, though impact is limited to partial confidentiality, integrity, and availability compromise of the underlying database. | MEDIUM | 5.5 | 0.3% | 48 |
PoC
No patch
|
| CVE-2026-76049 | SQL injection in SourceCodester Simple Online Food Ordering System 1.0 exposes backend database contents through the unsanitized ID parameter of the /admin/ajax.php?action=save_menu endpoint, permitting remote attackers to read, modify, or delete application data. The CVSS 4.0 vector assigns PR:N, suggesting the admin-area endpoint may be reachable without authentication - a pattern common in SourceCodester educational applications - though this should be independently verified. A publicly available proof-of-concept exploit exists on GitHub (no public exploit identified as confirmed actively exploited by CISA KEV at time of analysis), meaningfully lowering the barrier to opportunistic attacks against any internet-exposed deployment. | MEDIUM | 5.5 | 0.3% | 48 |
PoC
No patch
|
| CVE-2026-76050 | SQL injection in SourceCodester Simple Online Food Ordering System 1.0 exposes the `/admin/ajax.php?action=delete_menu` endpoint to remote unauthenticated database manipulation via an unsanitized `id` parameter. Per the CVSS 4.0 vector (PR:N, UI:N, AV:N), no authentication or user interaction is required, enabling any network-reachable attacker to read, modify, or delete database contents. A public proof-of-concept exploit exists on GitHub, making this immediately actionable; no patch has been identified at time of analysis. | MEDIUM | 5.5 | 0.3% | 48 |
PoC
No patch
|
| CVE-2026-86277 | Unauthenticated IDOR (Insecure Direct Object Reference) in SourceCodester Syllabus-Aligned Learning Management & Examination System 1.0 allows remote attackers to delete arbitrary exam records by manipulating the `ID` parameter in `delete_exam.php` without any authorization check. Any network-accessible attacker can iterate over exam IDs to destroy examination data belonging to other users or system administrators. A public proof-of-concept exploit has been disclosed on GitHub, lowering the bar for opportunistic abuse. | MEDIUM | 5.5 | 0.3% | 48 |
PoC
No patch
|
| CVE-2026-86276 | Hard-coded database credentials embedded in db.php of SourceCodester Syllabus-Aligned Learning Management & Examination System 1.0 allow unauthenticated remote attackers to obtain and reuse valid database credentials without any prior authentication. The credentials, baked directly into the PHP source file, are exposed to any party who can read or retrieve that file over the network. Publicly available exploit code has been published per the VulDB submission and a GitHub vulnerability report covering the same product, elevating this beyond a theoretical risk. | MEDIUM | 5.5 | 0.3% | 48 |
PoC
No patch
|
| CVE-2026-86275 | Unauthenticated privilege escalation in SourceCodester Syllabus-Aligned Learning Management & Examination System 1.0 allows remote attackers to register as privileged users - including administrator - by manipulating the `role` parameter in the `register` function of `auth.php`. Because the application fails to enforce server-side role validation during self-registration, any unauthenticated user can tamper the role field to claim elevated privileges at account creation time. A public proof-of-concept exploit is available on GitHub, lowering the bar for opportunistic exploitation. | MEDIUM | 5.5 | 0.3% | 48 |
PoC
No patch
|
| CVE-2026-86222 | SQL injection in SourceCodester Class and Exam Timetabling System 1.0 exposes the `course` parameter in `/admin/modal_add_course2.php` to unauthenticated remote attackers who can manipulate the underlying MySQL database. The vulnerability is rooted in direct, unsanitized input concatenation into a `mysqli_query()` call, yielding bounded but real read, write, and partial availability impact. A proof-of-concept exploit has been publicly disclosed on GitHub, materially lowering the exploitation barrier. | MEDIUM | 5.5 | 0.3% | 48 |
PoC
No patch
|