Threat database

A flaw has been found in code-projects Patient Record Management System 1.0. The affected element is an unknown function of the file /hematology_print.php. Executing a manipulation of the argument hem_id can lead to sql injection. It is possible to launch the attack remotely. The exploit has been published and may be used.

A vulnerability was detected in code-projects Simple IT Discussion Forum 1.0. Impacted is an unknown function of the file /delete-category.php. Performing a manipulation of the argument cat_id results in sql injection. It is possible to initiate the attack remotely. The exploit is now public and may be used.

A security vulnerability has been detected in code-projects Simple IT Discussion Forum 1.0. This issue affects some unknown processing of the file /admin/user.php. Such manipulation of the argument fname leads to cross site scripting. The attack may be performed from remote. The exploit has been disclosed publicly and may be used.

CVE-2026-6000 is a medium severity information disclosure vulnerability in version 1.0 of the code-projects Online Library Management System. It involves an unknown function within the /sql/library.sql file related to the SQL Database Backup File Handler. The vulnerability can be exploited remotely without privileges or user interaction, potentially allowing an attacker to disclose sensitive information. The exploit details have been made public, but no official patch or remediation guidance is currently available.

A security flaw has been discovered in code-projects Simple IT Discussion Forum 1.0. The affected element is an unknown function of the file /crud.php. The manipulation of the argument user_Id results in sql injection. The attack may be performed from remote. The exploit has been released to the public and may be used for attacks.

A security vulnerability has been detected in code-projects Simple IT Discussion Forum 1.0. This vulnerability affects unknown code of the file /topic-details.php. The manipulation of the argument post_id leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed publicly and may be used.

A weakness has been identified in code-projects Patient Record Management System 1.0. This affects an unknown part of the file /db/hcpms.sql of the component SQL Database Backup File Handler. Executing a manipulation can lead to information disclosure. The attack can be launched remotely. The exploit has been made available to the public and could be used for attacks.

CVE-2026-5847 is an information disclosure vulnerability in code-projects Movie Ticketing System version 1.0. It involves an unknown function in the /db/moviedb.sql file related to the SQL Database Backup File Handler component. The vulnerability can be exploited remotely and has a publicly disclosed exploit. The CVSS 4.0 base score is 5.3, indicating a medium severity level. No official patch or remediation guidance is currently available from the vendor. There is no evidence of active exploitation in the wild at this time.

CVE-2026-5836 is a medium severity cross-site scripting (XSS) vulnerability in version 1.0 of code-projects Online Shoe Store. The issue exists in the /admin/admin_product.php file where the product_name parameter can be manipulated to execute XSS attacks. The vulnerability can be exploited remotely and requires user interaction with high privileges. No official patch or remediation guidance is currently available from the vendor. The exploit has been publicly disclosed but no known active exploitation in the wild has been reported.

CVE-2026-5835 is a medium severity cross-site scripting (XSS) vulnerability in code-projects Online Shoe Store version 1.0. The flaw exists in an unspecified functionality of the /admin/admin_football.php file, where manipulation of the product_name argument can lead to XSS. The vulnerability can be exploited remotely and requires high privileges with user interaction. No official patch or remediation guidance is currently available.

CVE-2026-5834 is a cross-site scripting (XSS) vulnerability in code-projects Online Shoe Store version 1.0. The issue exists in an unknown function within the /admin/admin_running.php file, where manipulation of the product_name argument allows remote attackers to execute XSS attacks. The vulnerability has a medium severity rating with a CVSS score of 4.8. There is no official patch or remediation information available at this time, and no known exploits are reported in the wild.

CVE-2026-5829 is a SQL injection vulnerability in code-projects Simple IT Discussion Forum version 1.0. The issue exists in an unknown function within the /pages/content.php file, where manipulation of the post_id argument allows SQL injection. This vulnerability can be exploited remotely without authentication. The exploit has been publicly disclosed, but no official patch or remediation guidance is currently available.

CVE-2026-5828 is a medium severity SQL injection vulnerability in code-projects Simple IT Discussion Forum version 1.0. The vulnerability exists in an unknown function within the /functions/addcomment.php file, where manipulation of the postid argument allows for SQL injection. This flaw can be exploited remotely without authentication. No official patch or remediation guidance is currently available, and while an exploit has been publicly disclosed, there are no confirmed reports of exploitation in the wild.

A vulnerability has been found in code-projects Simple IT Discussion Forum 1.0. Impacted is an unknown function of the file /question-function.php. The manipulation of the argument content leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used.

CVE-2026-5826 is a medium severity cross-site scripting (XSS) vulnerability in code-projects Simple IT Discussion Forum version 1.0. The issue arises from improper handling of the 'Category' argument in the /edit-category.php file, allowing remote attackers to inject malicious scripts. Although an exploit has been published, there is no confirmed patch or official remediation available at this time.

CVE-2026-5825 is a medium-severity cross-site scripting (XSS) vulnerability in code-projects Simple Laundry System version 1.0. The issue exists in the /delmemberinfo.php file where manipulation of the userid argument can lead to XSS. The vulnerability can be exploited remotely and requires user interaction. No official patch or remediation guidance is currently available, and the exploit code has been made public.

CVE-2026-5824 is a medium severity SQL injection vulnerability in code-projects Simple Laundry System version 1.0. It affects the /userchecklogin.php file, where manipulation of the userid argument allows remote attackers to perform SQL injection. The vulnerability has been publicly disclosed, but no official patch or remediation guidance is currently available from the vendor.

CVE-2026-5806 is a medium severity cross-site scripting (XSS) vulnerability in code-projects Easy Blog Site version 1.0. The vulnerability exists in the /posts/update.php file where the postTitle parameter can be manipulated to execute malicious scripts. This flaw can be exploited remotely without requiring user interaction or elevated privileges. The vulnerability has been publicly disclosed, but no official patch or remediation guidance is currently available from the vendor.

CVE-2026-5805 is a medium severity SQL injection vulnerability in code-projects Easy Blog Site version 1.0. The flaw exists in an unspecified function within the /users/contact_us.php file, where manipulation of the 'Name' argument can lead to SQL injection. This vulnerability can be exploited remotely without authentication. Although a public exploit is available, there is no confirmed patch or official remediation at this time.

A vulnerability was identified in code-projects Online Hotel Booking 1.0. Affected by this vulnerability is an unknown functionality of the file /booknow.php of the component Booking Endpoint. Such manipulation of the argument roomname leads to cross site scripting. It is possible to launch the attack remotely. The exploit is publicly available and might be used.