118
CVEs
0
Critical
0
High
0
KEV
110
PoC
0
Unpatched C/H
0.0%
Patch Rate
0.3%
Avg EPSS
Severity Breakdown
CRITICAL
0
HIGH
0
MEDIUM
75
LOW
43
Monthly CVE Trend
Affected Products (30)
PHP
222
Class And Exam Timetabling System
48
Pharmacy Sales And Inventory System
23
Pizzafy Ecommerce System
22
Sales And Inventory System
12
Simple Online Food Ordering System
11
Syllabus Aligned Learning Management Examination System
7
Hospitals Patient Records Management System
6
Onlne Examination Learning Management System
6
Simple Doctors Appointment System
6
Multi Vendor Online Grocery Management System
6
Photo Share Website
5
Cet Automated Grading System With Ai Predictive Analytics
5
Sup Online Shopping
5
Online Voting System
5
Laboratory Management System
5
Online Book Store System
4
Simple Pos And Inventory System
4
Indian Invoicing System
4
Student Grades Management System
4
Simple And Nice Shopping Cart Script
4
Leave Application System
3
Inventory System
3
Simple Traffic Offense System
3
Stock Management System
3
Pet Grooming Management Software
3
School Registration And Fee System
2
Simple E Learning System
2
Restaurant Management System
2
Inventory Management System
2
Top Risky CVEs
| CVE | Summary | Severity | CVSS | EPSS | Priority | Signals |
|---|---|---|---|---|---|---|
| CVE-2026-86292 | Missing authentication in SourceCodester Simple Traffic Offense System 1.0 allows unauthenticated remote attackers to create arbitrary user accounts by manipulating the `position` argument in `saveuser.php`. The user-creation endpoint fails to enforce any authentication gate (CWE-306), exposing it to direct network exploitation with no prerequisites. A public proof-of-concept exploit exists, raising the practical risk beyond what the moderate CVSS 4.0 score of 6.9 might suggest. | MEDIUM | 5.5 | 0.5% | 48 |
PoC
No patch
|
| CVE-2026-14641 | SQL injection in SourceCodester Class and Exam Timetabling System 1.0 exposes the `/edit_course.php` endpoint to unauthenticated remote database manipulation via a malicious `id` parameter. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) confirms zero-barrier remote exploitation with no authentication or user interaction required, and a public proof-of-concept exploit has been disclosed on GitHub. No active exploitation is confirmed in CISA KEV, though the combination of a public POC and fully unauthenticated attack path elevates practical risk for any internet-exposed deployment. | MEDIUM | 5.5 | 0.4% | 48 |
PoC
No patch
|
| CVE-2026-13485 | SQL injection in SourceCodester Class and Exam Timetabling System 1.0 exposes the `/preview.php` endpoint to remote unauthenticated exploitation via the unsanitized `course_year_section` parameter, allowing arbitrary SQL query execution against the backend database. A public proof-of-concept exploit has been published on GitHub, materially lowering the barrier to exploitation. Impact is rated low-to-partial across confidentiality, integrity, and availability, bounded by the database account's privileges, and no vendor patch has been identified at time of analysis. | MEDIUM | 5.5 | 0.4% | 48 |
PoC
No patch
|
| CVE-2026-13486 | SQL injection in SourceCodester Class and Exam Timetabling System 1.0 allows unauthenticated remote attackers to manipulate the `course_year_section` parameter on the `/preview6.php` endpoint, enabling unauthorized read and write access to the underlying database. The CVSS 4.0 vector (AV:N/AC:L/PR:N/UI:N) confirms exploitation requires no authentication and no special conditions, and a public proof-of-concept has been disclosed on GitHub. While not listed in CISA KEV, the trivially low attack complexity combined with POC availability raises the realistic exploitation risk above what the 5.5 medium score alone implies. | MEDIUM | 5.5 | 0.4% | 48 |
PoC
No patch
|
| CVE-2026-14642 | SQL injection in SourceCodester Class and Exam Timetabling System 1.0 exposes the database to remote unauthenticated attackers via the unvalidated ID parameter in /edit_class2.php. The CVSS 4.0 vector (AV:N/AC:L/PR:N/UI:N) confirms trivial, unauthenticated remote exploitation requiring no special conditions. Publicly available exploit code (E:P) lowers the bar to exploitation further, though the product's niche deployment footprint significantly limits real-world blast radius. No KEV listing; no patch identified at time of analysis. | MEDIUM | 5.5 | 0.4% | 48 |
PoC
No patch
|
| CVE-2026-14652 | SQL injection in SourceCodester Simple and Nice Shopping Cart Script 1.0 exposes the admin login interface to remote unauthenticated attackers through unsanitized input in the Username parameter of /admin/login.php. The CVSS 4.0 score of 6.9 (Medium) reflects limited per-request impact (VC:L/VI:L/VA:L), but a publicly available proof-of-concept exploit (E:P) on GitHub substantially lowers the exploitation bar for opportunistic attackers. No KEV listing exists at time of analysis; however, the trivial attack complexity (AC:L, AT:N, PR:N, UI:N) combined with public exploit code makes any internet-facing deployment of this script an immediate remediation priority. | MEDIUM | 5.5 | 0.4% | 48 |
PoC
No patch
|
| CVE-2026-14653 | SQL injection in SourceCodester Simple and Nice Shopping Cart Script 1.0 enables remote, unauthenticated attackers to manipulate database queries through the user_id parameter in /admin/mensproductdeletequery.php, exposing partial confidentiality, integrity, and availability of the underlying database. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) indicates no authentication or special conditions are required for exploitation over the network. A public exploit has been disclosed on GitHub, elevating the practical risk above the raw score suggests - though this is not confirmed as actively exploited by CISA KEV at time of analysis. | MEDIUM | 5.5 | 0.4% | 48 |
PoC
No patch
|
| CVE-2026-16227 | SQL injection in SourceCodester Class and Exam Timetabling System 1.0 exposes the `/edit_subject.php` endpoint to unauthenticated remote exploitation via the unsanitized `id` parameter. The CVSS 4.0 vector (AV:N/AC:L/PR:N/UI:N) confirms zero-barrier network access with no authentication or user interaction required against default installations. A public proof-of-concept exploit has been disclosed on GitHub, substantially lowering the skill threshold for exploitation; however, this vulnerability is not currently listed in CISA KEV, so confirmed active exploitation has not been established. | MEDIUM | 5.5 | 0.4% | 48 |
PoC
No patch
|
| CVE-2026-16228 | SQL injection in SourceCodester Class and Exam Timetabling System 1.0 exposes the /edit_schoolyr.php endpoint to unauthenticated remote database manipulation via an unsanitized ID parameter. The CVSS 4.0 vector (AV:N/AC:L/PR:N/UI:N) confirms no authentication or complexity barrier, and publicly available exploit code exists, referenced on GitHub. While KEV listing is absent and per-CIA impact is rated Low across all pillars, the combination of zero-barrier remote access and a live POC makes this a credible threat for any internet-exposed instance. | MEDIUM | 5.5 | 0.4% | 48 |
PoC
No patch
|
| CVE-2026-16484 | SQL injection in SourceCodester Class and Exam Timetabling System 1.0 allows remote unauthenticated attackers to manipulate backend database queries through the unsanitized ID parameter in /edit_subjecta.php. The flaw (CWE-89) enables both data extraction and potential data modification against the timetabling database. A public proof-of-concept exploit is available on GitHub, and no special configuration is required beyond the application being network-accessible. | MEDIUM | 5.5 | 0.4% | 48 |
PoC
No patch
|
| CVE-2026-78247 | SQL injection in SourceCodester Simple Online Food Ordering System 1.0 exposes the `/fos/admin/ajax.php?action=confirm_order` endpoint to arbitrary database query manipulation via the unsanitized `ID` parameter. A public proof-of-concept exploit is available on GitHub, materially elevating exploitation risk beyond the base CVSS 4.0 score of 6.9, though no CISA KEV listing has been confirmed at time of analysis. Any internet-exposed deployment running this PHP application is at immediate risk of database enumeration and data exfiltration by unauthenticated remote attackers. | MEDIUM | 5.5 | 0.4% | 48 |
PoC
No patch
|
| CVE-2026-86209 | Unauthenticated SQL injection in SourceCodester Class and Exam Timetabling System 1.0 allows remote attackers to manipulate the database through the ID parameter in /delete_user.php. The vulnerability requires no privileges or user interaction, and a public proof-of-concept exploit has been published on GitHub. Impact is limited by the CVSS 4.0 assessment (VC:L/VI:L/VA:L), suggesting partial data read/write rather than full database compromise, though chained exploitation could escalate impact. | MEDIUM | 5.5 | 0.4% | 48 |
PoC
No patch
|
| CVE-2026-86210 | SQL injection in SourceCodester Class and Exam Timetabling System 1.0 exposes the `/delete_user_account.php` endpoint to unauthenticated remote exploitation via an unsanitized `id` parameter. The flaw allows attackers to read, modify, or delete underlying database records without any authentication credential. A public proof-of-concept exploit is available via GitHub, materially elevating practical risk beyond what the moderate CVSS 4.0 score of 6.9 might suggest at face value. | MEDIUM | 5.5 | 0.4% | 48 |
PoC
No patch
|
| CVE-2026-86208 | SQL injection in SourceCodester Class and Exam Timetabling System 1.0 exposes the /delete_teacher.php endpoint to unauthenticated remote database manipulation via an unsanitized ID parameter (CWE-89). A proof-of-concept exploit has been publicly released on GitHub, making opportunistic exploitation straightforward for low-skilled attackers. Attackers with network access to the application can extract, modify, or delete records from the underlying database without supplying credentials. | MEDIUM | 5.5 | 0.3% | 48 |
PoC
No patch
|
| CVE-2026-15703 | SQL injection in SourceCodester Simple and Nice Shopping Cart Script 1.0 enables remote attackers to manipulate backend database queries via the unsanitized `user_id` parameter in `/admin/userproductdeletequery.php`. A publicly available proof-of-concept exploit exists on GitHub, and SSVC confirms the attack is automatable with partial impact across confidentiality, integrity, and availability. Despite the public POC, EPSS stands at only 0.33% (25th percentile), reflecting the product's negligible enterprise deployment footprint rather than a benign technical profile. | MEDIUM | 5.5 | 0.3% | 48 |
PoC
No patch
|