134
CVEs
0
Critical
0
High
0
KEV
120
PoC
0
Unpatched C/H
0.0%
Patch Rate
0.3%
Avg EPSS
Severity Breakdown
CRITICAL
0
HIGH
0
MEDIUM
88
LOW
46
Monthly CVE Trend
Affected Products (30)
PHP
286
Class And Exam Timetabling System
48
Pharmacy Sales And Inventory System
23
Pizzafy Ecommerce System
22
Drug Recommendation System
14
Online Reviewer Management System
13
Sales And Inventory System
12
Simple Online Food Ordering System
11
Performance Indicator System
10
Syllabus Aligned Learning Management Examination System
7
Inventory Management System
6
Multi Vendor Online Grocery Management System
6
Inventory System
6
Hospitals Patient Records Management System
6
Onlne Examination Learning Management System
6
Simple Doctors Appointment System
6
Sup Online Shopping
5
Online Voting System
5
Cet Automated Grading System With Ai Predictive Analytics
5
Photo Share Website
5
Laboratory Management System
5
Simple Pos And Inventory System
4
Simple Student Information System
4
Online Food Ordering System
4
Indian Invoicing System
4
Student Grades Management System
4
Online Book Store System
4
Simple And Nice Shopping Cart Script
4
Simple Traffic Offense System
3
Online Faculty Clearance System
3
Top Risky CVEs
| CVE | Summary | Severity | CVSS | EPSS | Priority | Signals |
|---|---|---|---|---|---|---|
| CVE-2026-86292 | Missing authentication in SourceCodester Simple Traffic Offense System 1.0 allows unauthenticated remote attackers to create arbitrary user accounts by manipulating the `position` argument in `saveuser.php`. The user-creation endpoint fails to enforce any authentication gate (CWE-306), exposing it to direct network exploitation with no prerequisites. A public proof-of-concept exploit exists, raising the practical risk beyond what the moderate CVSS 4.0 score of 6.9 might suggest. | MEDIUM | 5.5 | 0.5% | 48 |
PoC
No patch
|
| CVE-2026-109605 | Improper authorization in SourceCodester Simple Cafe Billing System 1.0 allows remote unauthenticated attackers to manipulate the 'Type' parameter in the save_user action of admin_class.php, enabling unauthorized modification of user roles within the User Management component. The vulnerability is network-exploitable (CVSS 4.0 base 5.5, CVSS 3.1 AV:N/AC:L/PR:N/UI:N) with no authentication or user interaction required, and publicly available exploit code exists; active exploitation has not been confirmed (not in CISA KEV). The application's narrow deployment footprint limits real-world exposure. | MEDIUM | 5.5 | 0.5% | 48 |
PoC
No patch
|
| CVE-2026-90526 | SQL injection in SourceCodester School Registration and Fee System 1.0 allows unauthenticated remote attackers to read, modify, or delete database contents via the Category parameter in /bilal/save_class.php. A public proof-of-concept exploit has been disclosed on GitHub, lowering the skill threshold for exploitation. No KEV listing exists, but the combination of unauthenticated network access and a publicly available exploit makes this an active concern for any deployed instance. | MEDIUM | 5.5 | 0.4% | 48 |
PoC
No patch
|
| CVE-2026-95924 | SQL injection in SourceCodester Online Reviewer Management System 1.0 lets remote attackers inject arbitrary SQL through the difficulty_id parameter on the /reviewer_0/admins/assessments/databank/btn_functions.php endpoint when action=add, allowing partial read, modification, and disruption of the underlying database. The vendor-supplied CVSS 4.0 score is 6.9 with a vector claiming no privileges or user interaction required (PR:N/UI:N), but the vulnerable path sits inside the /admins/ administrative area, which in typical deployments is only reachable behind an authenticated administrator session - an independent assessment re-rates it as CVSS 3.1 AV:N/AC:L/PR:L/UI:N with low confidentiality, integrity, and availability impact. Publicly available exploit code exists and has been published alongside the disclosure, and there is no indication of confirmed active exploitation (no CISA KEV listing), while exploitation is further constrained by how few instances of this obscure PHP application are deployed and internet-reachable. | MEDIUM | 5.5 | 0.4% | 48 |
PoC
No patch
|
| CVE-2026-95926 | SQL injection in SourceCodester Online Reviewer Management System 1.0 lets an attacker who can reach the administrative assessment endpoint inject arbitrary SQL through the test_id parameter of /reviewer_0/admins/assessments/pretest/btn_functions.php?action=update, exposing and potentially altering stored review and assessment data. Publicly available exploit code exists (a proof-of-concept is published in the GitHub issue referenced by VulDB), and the vendor has not shipped a fixed version. Because the vulnerable path sits under /admins/, exploitation in practice most likely requires a valid administrative session, making reachability of the admin area and credential strength the primary limiting factors; the CVSS 4.0 score of 6.9 treats it as PR:N, our own assessment rates it CVSS:3.1 AV:N/AC:L/PR:L/UI:N with high confidentiality and low integrity impact. | MEDIUM | 5.5 | 0.4% | 48 |
PoC
No patch
|
| CVE-2026-95927 | SQL injection in SourceCodester Online Reviewer Management System 1.0 allows attackers to manipulate the test_id parameter in /reviewer_0/admins/assessments/pretest/exam-delete.php, potentially reading or altering database contents. Publicly available exploit code exists, but practical exploitation requires reaching the administrative interface and likely a valid admin session despite the CVSS 4.0 vector indicating no privileges; the product's rare deployment footprint further limits real-world risk. This is a classic high-nominal/low-real-risk finding with limited confidentiality, integrity, and availability impact. | MEDIUM | 5.5 | 0.4% | 48 |
PoC
No patch
|
| CVE-2026-78247 | SQL injection in SourceCodester Simple Online Food Ordering System 1.0 exposes the `/fos/admin/ajax.php?action=confirm_order` endpoint to arbitrary database query manipulation via the unsanitized `ID` parameter. A public proof-of-concept exploit is available on GitHub, materially elevating exploitation risk beyond the base CVSS 4.0 score of 6.9, though no CISA KEV listing has been confirmed at time of analysis. Any internet-exposed deployment running this PHP application is at immediate risk of database enumeration and data exfiltration by unauthenticated remote attackers. | MEDIUM | 5.5 | 0.4% | 48 |
PoC
No patch
|
| CVE-2026-78248 | Unauthenticated SQL injection in SourceCodester Simple Online Food Ordering System 1.0 allows remote attackers to manipulate backend database queries via the unsanitized `Name` parameter in `/fos/admin/ajax.php?action=save_settings`. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) confirms zero-barrier remote exploitation with no authentication or special conditions required. A public proof-of-concept exploit has been disclosed on GitHub, lowering the operational bar for opportunistic attackers targeting exposed instances. | MEDIUM | 5.5 | 0.4% | 48 |
PoC
No patch
|
| CVE-2026-86209 | Unauthenticated SQL injection in SourceCodester Class and Exam Timetabling System 1.0 allows remote attackers to manipulate the database through the ID parameter in /delete_user.php. The vulnerability requires no privileges or user interaction, and a public proof-of-concept exploit has been published on GitHub. Impact is limited by the CVSS 4.0 assessment (VC:L/VI:L/VA:L), suggesting partial data read/write rather than full database compromise, though chained exploitation could escalate impact. | MEDIUM | 5.5 | 0.4% | 48 |
PoC
No patch
|
| CVE-2026-86210 | SQL injection in SourceCodester Class and Exam Timetabling System 1.0 exposes the `/delete_user_account.php` endpoint to unauthenticated remote exploitation via an unsanitized `id` parameter. The flaw allows attackers to read, modify, or delete underlying database records without any authentication credential. A public proof-of-concept exploit is available via GitHub, materially elevating practical risk beyond what the moderate CVSS 4.0 score of 6.9 might suggest at face value. | MEDIUM | 5.5 | 0.4% | 48 |
PoC
No patch
|
| CVE-2026-90516 | SQL injection in SourceCodester School Registration and Fee System 1.0 allows remote unauthenticated attackers to manipulate database queries via the `period` parameter of `/bilal/normal/pay_report.php`. A public proof-of-concept exploit has been published on GitHub (vuldb.com/submit/912055, github.com/zuojiu567/cve/issues/3), lowering the bar for exploitation significantly. No vendor patch has been identified at time of analysis, leaving deployments exposed with no vendor-supplied remediation path. | MEDIUM | 5.5 | 0.4% | 48 |
PoC
No patch
|
| CVE-2026-108964 | SQL injection in SourceCodester Performance Indicator System 1.0 lets an attacker inject arbitrary SQL through the 'prodcategory' parameter handled by /opils/admin/addproduct.php, allowing manipulation of the underlying database contents and disclosure of stored data. The vulnerable endpoint sits under /admin/, so realistic exploitation most likely requires either a valid administrative session or an add-product page that lacks an adequate session check, which the independent assessment captures by scoring the issue PR:L rather than PR:N; the vendor-style vector instead lists PR:N, and that authentication requirement remains the key unconfirmed limiting factor. Publicly available exploit code exists for this issue, raising the likelihood of opportunistic scanning and abuse, though impact is bounded to low confidentiality, integrity and availability effects (CVSS 3.1 base 6.9, AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L) and no CISA KEV listing indicates confirmed active exploitation. | MEDIUM | 5.5 | 0.4% | 48 |
PoC
No patch
|
| CVE-2026-108966 | SQL injection in SourceCodester Performance Indicator System 1.0 allows remote attackers to manipulate the Category argument in /opils/staff/product.php and alter database queries, yielding low impact to confidentiality, integrity, and availability. Publicly available exploit code exists; no CISA KEV confirmation is present, and authentication requirements are not confirmed because the supplied vector marks PR:N while the independent assessment suggests the staff endpoint may require login. Real-world risk leans low because the product has a rare deployment footprint and the assessed impact is limited, despite the medium CVSS 4.0 base score of 6.9. | MEDIUM | 5.5 | 0.4% | 48 |
PoC
No patch
|
| CVE-2026-108967 | SQL injection in the 'credit' parameter handled by /opils/staff/edit_credit.php in SourceCodester Performance Indicator System 1.0 lets remote attackers inject arbitrary SQL into backend database queries, with limited confidentiality, integrity, and availability impact as reflected in the 6.9 score and the assessed CVSS:3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L). Publicly available exploit code exists - a proof-of-concept write-up was published in a GitHub issue linked from the CVE record - but there is no confirmed active exploitation (CISA KEV) at time of analysis. The supplied CVSS 4.0 vector asserts PR:N (no privileges required), yet the endpoint sits under a /staff/ administrative path, so defenders should verify whether their deployment requires a staff session; the dominant real-world limiter remains deployment scarcity of this niche PHP application. | MEDIUM | 5.5 | 0.4% | 48 |
PoC
No patch
|
| CVE-2026-108968 | SQL injection in SourceCodester Performance Indicator System 1.0 lets a remote attacker manipulate the ID argument of /opils/staff/sales_history.php and inject arbitrary SQL into the application's database queries. Publicly available exploit code exists, and the provided CVSS 4.0 vector rates the issue 5.5 (AV:N/AC:L/PR:N/UI:N), though the /staff/ path indicates the endpoint may sit behind a staff-authenticated area, which would constrain real-world exploitation. Overall real-world priority is low because the product is rarely deployed and no CISA KEV or active-exploitation reporting is present in the supplied data. | MEDIUM | 5.5 | 0.4% | 48 |
PoC
No patch
|