Threat database

CVE-2026-5672 is a medium severity SQL injection vulnerability in code-projects Simple IT Discussion Forum version 1.0. The issue exists in the /edit-category.php file within the Parameter Handler component, where the cat_id argument can be manipulated remotely to perform SQL injection. The vulnerability has been publicly disclosed, but no official patch or remediation guidance is currently available. Exploits are not known to be in the wild at this time.

CVE-2026-5666 is a medium-severity vulnerability in code-projects Online FIR System version 1.0. It involves insecure storage of sensitive information due to an issue in the SQL Database Backup File Handler component, specifically related to the /complaints.sql file. The vulnerability can be exploited remotely without authentication. Although the exploit is publicly available, there is no confirmed patch or official remediation at this time.

A security vulnerability has been detected in code-projects Online FIR System 1.0. Affected by this vulnerability is an unknown functionality of the file /Login/checklogin.php of the component Login. The manipulation of the argument email/password leads to sql injection. The attack is possible to be carried out remotely. The exploit has been disclosed publicly and may be used.

CVE-2026-5650 is a medium severity vulnerability in code-projects Online Application System for Admission version 1.0. It involves insecure storage of sensitive information due to a flaw in an unknown function within the /enrollment/database/oas.sql file. The vulnerability can be exploited remotely without authentication or user interaction. Although an exploit has been made public, there is no confirmed patch or official remediation available at this time.

CVE-2026-5649 is a medium severity SQL injection vulnerability in version 1.0 of the code-projects Online Application System for Admission. The flaw exists in the processing of the /enrollment/admsnform.php endpoint, allowing remote attackers to manipulate SQL queries. The vulnerability has been publicly disclosed, but no official patch or remediation guidance is currently available from the vendor. Exploits have not been observed in the wild to date.

CVE-2026-5648 is a medium-severity SQL injection vulnerability in code-projects Simple Laundry System version 1.0. The flaw exists in the /userfinishregister.php file within the Parameter Handler component, where manipulation of the firstName argument can lead to SQL injection. This vulnerability can be exploited remotely without authentication or user interaction. Although an exploit has been published, there are no known exploits observed in the wild. No official patch or remediation guidance is currently available.

CVE-2026-5647 is a cross-site scripting (XSS) vulnerability in version 1.0 of code-projects Online Shoe Store. It affects the Add Product Page component, specifically the /admin/admin_feature.php file, where the product_name argument can be manipulated to execute XSS attacks. The vulnerability can be exploited remotely and requires user interaction with high privileges. No official patch or remediation guidance is currently available. The vulnerability has a medium severity rating with a CVSS score of 4.8.

CVE-2026-5646 is a SQL injection vulnerability in code-projects Easy Blog Site version 1.0. The issue exists in the login.php file where manipulation of the username or password parameters can lead to SQL injection. This vulnerability can be exploited remotely without authentication. The exploit has been publicly disclosed but there are no known exploits in the wild. The vulnerability has a medium severity rating with a CVSS 4.0 base score of 6.9.

A security vulnerability has been detected in code-projects Simple Laundry System 1.0. Affected by this issue is some unknown functionality of the file /delmemberinfo.php of the component Parameter Handler. Such manipulation of the argument userid leads to sql injection. The attack may be launched remotely. The exploit has been disclosed publicly and may be used.

A weakness has been identified in code-projects Simple Laundry System 1.0. Affected by this vulnerability is an unknown functionality of the file /searchguest.php of the component Parameter Handler. This manipulation of the argument searchServiceId causes sql injection. The attack may be initiated remotely. The exploit has been made available to the public and could be used for attacks.

A weakness has been identified in code-projects Concert Ticket Reservation System 1.0. This affects an unknown part of the file /ConcertTicketReservationSystem-master/login.php of the component Parameter Handler. Executing a manipulation of the argument Email can lead to sql injection. The attack may be launched remotely. The exploit has been made available to the public and could be used for attacks.

A security flaw has been discovered in code-projects Concert Ticket Reservation System 1.0. Affected by this issue is some unknown functionality of the file /ConcertTicketReservationSystem-master/process_search.php of the component Parameter Handler. Performing a manipulation of the argument searching results in sql injection. The attack may be initiated remotely. The exploit has been released to the public and may be used for attacks.

A vulnerability was determined in code-projects Simple Laundry System 1.0. Impacted is an unknown function of the file /modstaffinfo.php of the component Parameter Handler. Executing a manipulation of the argument userid can lead to cross site scripting. The attack may be launched remotely. The exploit has been publicly disclosed and may be utilized.

A vulnerability was found in code-projects Simple Laundry System 1.0. This issue affects some unknown processing of the file /modmemberinfo.php of the component Parameter Handler. Performing a manipulation of the argument userid results in cross site scripting. The attack may be initiated remotely. The exploit has been made public and could be used.

A vulnerability has been found in code-projects Simple Laundry System 1.0. This vulnerability affects unknown code of the file /modifymember.php of the component Parameter Handler. Such manipulation of the argument firstName leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used.

A flaw has been found in code-projects Simple Laundry System 1.0. This affects an unknown part of the file /modifymember.php of the component Parameter Handler. This manipulation of the argument firstName causes cross site scripting. The attack can be initiated remotely. The exploit has been published and may be used.

CVE-2026-5257 is a medium severity SQL injection vulnerability in code-projects Simple Laundry System version 1.0. It arises from improper handling of the userid parameter in the /delstaffinfo.php component, allowing remote attackers to manipulate SQL queries. The vulnerability has been publicly disclosed, but no known exploits are currently reported in the wild. There is no information about an available patch or official remediation.

CVE-2026-5256 is a medium severity SQL injection vulnerability in version 1.0 of code-projects Simple Laundry System. The flaw exists in the /modify.php file within the Parameter Handler component, where manipulation of the firstName argument can lead to SQL injection. This vulnerability can be exploited remotely without authentication or user interaction. Although an exploit has been published, there are no known exploits observed in the wild. No official patch or remediation guidance is currently available from the vendor.

A vulnerability was detected in code-projects Simple Laundry System 1.0. This affects an unknown part of the file /delstaffinfo.php of the component Parameter Handler. The manipulation of the argument userid results in cross site scripting. The attack may be launched remotely. The exploit is now public and may be used.

CVE-2026-5240 is a cross-site scripting (XSS) vulnerability in version 1.0 of the code-projects BloodBank Managing System. The vulnerability exists in the /admin_state.php file where the statename parameter can be manipulated to execute malicious scripts. This flaw can be exploited remotely and requires user interaction. The vulnerability has a medium severity rating with a CVSS score of 5.3. No official patch or remediation guidance is currently provided.