Threat database

CVE-2026-6165 is a medium-severity SQL injection vulnerability in code-projects Vehicle Showroom Management System version 1.0. The flaw exists in the /util/Login_check.php file where manipulation of the ID argument can lead to SQL injection. This vulnerability can be exploited remotely without authentication. Public exploit code is available, increasing the risk of attack. No official patch or remediation guidance has been provided by the vendor as of the publication date.

CVE-2026-6164 is a medium-severity SQL injection vulnerability in code-projects Lost and Found Thing Management version 1.0. The flaw exists in the /addcat.php file where manipulation of the 'cata' argument can lead to SQL injection. This vulnerability can be exploited remotely without authentication. Although an exploit has been publicly released, there is no official patch or remediation guidance available at this time.

A vulnerability was identified in code-projects Lost and Found Thing Management 1.0. Affected by this issue is some unknown functionality of the file /catageory.php. Such manipulation of the argument cat leads to sql injection. It is possible to launch the attack remotely. The exploit is publicly available and might be used.

CVE-2026-6161 is a medium severity SQL injection vulnerability in code-projects Simple ChatBox version 1.0. The flaw exists in the /chatbox/insert.php endpoint, where manipulation of the 'msg' argument can lead to SQL injection. This vulnerability can be exploited remotely without authentication. Although the exploit has been publicly disclosed, there is no confirmed patch or official remediation available at this time.

A vulnerability was found in code-projects Simple ChatBox 1.0. Affected by this issue is the function SimpleChatbox_PHP of the file chatbox.sql of the component Endpoint. Performing a manipulation results in file and directory information exposure. It is possible to initiate the attack remotely. The exploit has been made public and could be used.

CVE-2026-6159 is a medium severity cross-site scripting (XSS) vulnerability in code-projects Simple ChatBox version 1.0. The vulnerability exists in the /chatbox/insert.php file, specifically in the handling of the 'msg' parameter. This flaw allows remote attackers to inject malicious scripts via crafted input. The vulnerability has been publicly disclosed, but no official patch or remediation guidance is currently available.

A vulnerability was identified in code-projects Vehicle Showroom Management System 1.0. Impacted is an unknown function of the file /util/StaffDetailsFunction.php. Such manipulation of the argument STAFF_ID leads to sql injection. The attack can be launched remotely. The exploit is publicly available and might be used.

CVE-2026-6152 is a medium severity SQL injection vulnerability in code-projects Vehicle Showroom Management System version 1.0. It arises from improper handling of the STAFF_ID parameter in the /util/StaffAddingFunction.php file, allowing remote attackers to manipulate SQL queries. The vulnerability has been publicly disclosed, but no official patch or remediation guidance is currently available. Exploitation could lead to unauthorized database access or modification.

CVE-2026-6151 is a medium severity SQL injection vulnerability in code-projects Vehicle Showroom Management System version 1.0. The vulnerability exists in the /util/PaymentStatusFunction.php file, where manipulation of the CUSTOMER_ID argument allows remote attackers to perform SQL injection. The exploit code has been publicly disclosed, but no official patch or remediation guidance is currently available from the vendor.

A vulnerability has been found in code-projects Simple Laundry System 1.0. This affects an unknown part of the file /checkupdatestatus.php. The manipulation of the argument serviceId leads to cross site scripting. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.

CVE-2026-6149 is a medium severity SQL injection vulnerability in version 1.0 of the code-projects Vehicle Showroom Management System. The flaw exists in the /util/BookVehicleFunction.php file, where manipulation of the BRANCH_ID argument can lead to SQL injection. The vulnerability can be exploited remotely without authentication. An exploit has been published, but there are no known exploits in the wild at this time. No official patch or remediation guidance is currently available from the vendor.

A vulnerability was detected in code-projects Vehicle Showroom Management System 1.0. Affected by this vulnerability is an unknown functionality of the file /util/MonthTotalReportUpdateFunction.php. Performing a manipulation of the argument BRANCH_ID results in sql injection. The attack is possible to be carried out remotely. The exploit is now public and may be used.

CVE-2026-6038 is a medium severity SQL injection vulnerability in version 1.0 of the code-projects Vehicle Showroom Management System. The issue exists in the /util/RegisterCustomerFunction.php file, where manipulation of the BRANCH_ID argument allows remote attackers to perform SQL injection. The vulnerability is publicly known, but no official patch or remediation guidance has been provided by the vendor as of the publication date.

A vulnerability was determined in code-projects Vehicle Showroom Management System 1.0. This affects an unknown function of the file /util/AddVehicleFunction.php. This manipulation of the argument BRANCH_ID causes sql injection. The attack is possible to be carried out remotely. The exploit has been publicly disclosed and may be utilized.

CVE-2026-6036 is a medium severity SQL injection vulnerability in code-projects Vehicle Showroom Management System version 1.0. The vulnerability exists in an unknown function within the /util/VehicleDetailsFunction.php file, where manipulation of the VEHICLE_ID argument allows remote attackers to perform SQL injection. Although an exploit has been publicly disclosed, there is no confirmed patch or official remediation available at this time.

A vulnerability has been found in code-projects Vehicle Showroom Management System 1.0. The affected element is an unknown function of the file /BranchManagement/ServiceAndSalesReport.php. The manipulation of the argument BRANCH_ID leads to cross site scripting. Remote exploitation of the attack is possible. The exploit has been disclosed to the public and may be used.

A flaw has been found in code-projects Vehicle Showroom Management System 1.0. Impacted is an unknown function of the file /BranchManagement/ProfitAndLossReport.php. Executing a manipulation of the argument BRANCH_ID can lead to cross site scripting. The attack may be launched remotely. The exploit has been published and may be used.

A vulnerability was found in code-projects Simple Laundry System 1.0. This impacts an unknown function of the file /checkcheckout.php. Performing a manipulation of the argument serviceId results in cross site scripting. The attack is possible to be carried out remotely. The exploit has been made public and could be used.

CVE-2026-6031 is a SQL injection vulnerability in code-projects Simple IT Discussion Forum version 1.0. The issue exists in the /add-category-function.php file where manipulation of the Category argument allows remote attackers to execute SQL injection attacks. The vulnerability has a CVSS 4.0 base score of 6.9, indicating medium severity. There is no official patch or remediation level provided by the vendor, and no known exploits have been observed in the wild. The vulnerability disclosure is public, which may increase risk if not addressed.

A vulnerability has been found in code-projects Patient Record Management System 1.0. The impacted element is an unknown function of the file /edit_hpatient.php. The manipulation of the argument ID leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.