Threat database

A security flaw has been discovered in itsourcecode Payroll Management System up to 1.0. This affects an unknown function of the file /index.php. Performing a manipulation of the argument page results in cross site scripting. It is possible to initiate the attack remotely. The exploit has been released to the public and may be used for attacks.

A vulnerability was identified in itsourcecode Free Hotel Reservation System 1.0. The impacted element is an unknown function of the file /admin/mod_amenities/index.php?view=editpic. Such manipulation of the argument ID leads to sql injection. The attack may be performed from remote. The exploit is publicly available and might be used.

CVE-2026-4875 is a medium-severity vulnerability in itsourcecode Free Hotel Reservation System version 1.0. It involves an unrestricted file upload issue in the /admin/mod_amenities/index.php? view=add endpoint, where manipulation of the 'image' argument allows remote attackers to upload files without restriction. The vulnerability has been publicly disclosed, but no known exploits in the wild have been reported. No official patch or remediation guidance is currently available from the vendor.

CVE-2026-4842 is a medium severity SQL injection vulnerability in itsourcecode Online Enrollment System version 1.0. The vulnerability exists in the Parameter Handler component, specifically in the /sms/grades/index.php file when handling the 'deptid' argument. This flaw allows remote attackers to manipulate SQL queries via the deptid parameter. The vulnerability has been publicly disclosed, but no known exploits are currently reported in the wild. No patch or official remediation information is available at this time.

A vulnerability has been found in itsourcecode College Management System 1.0. The impacted element is an unknown function of the file /admin/add-single-student-results.php of the component Parameter Handler. The manipulation of the argument course_code leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.

A weakness has been identified in itsourcecode Online Enrollment System 1.0. This vulnerability affects unknown code of the file /sms/user/index.php?view=add of the component Parameter Handler. Executing a manipulation of the argument Name can lead to sql injection. The attack may be performed from remote. The exploit has been made available to the public and could be used for attacks.

A vulnerability was determined in itsourcecode sanitize or validate this input 1.0. This issue affects some unknown processing of the file /admin/subjects.php of the component Parameter Handler. This manipulation of the argument subject_code causes sql injection. The attack is possible to be carried out remotely. The exploit has been publicly disclosed and may be utilized.

A vulnerability has been found in itsourcecode Free Hotel Reservation System 1.0. This affects an unknown part of the file /hotel/admin/mod_users/index.php?view=edit&id=8 of the component Parameter Handler. The manipulation of the argument account_id leads to sql injection. Remote exploitation of the attack is possible. The exploit has been disclosed to the public and may be used.

CVE-2026-4485 is a medium severity SQL injection vulnerability found in itsourcecode College Management System version 1.0, specifically in the /admin/search_student.php file. The vulnerability arises from improper sanitization of the 'Search' parameter, allowing remote attackers to inject malicious SQL queries without requiring authentication or user interaction. Exploitation could lead to unauthorized data access or modification within the college management database. Although no public exploits are currently known in the wild, the vulnerability has been disclosed publicly, increasing the risk of exploitation. The vulnerability has a CVSS 4.0 base score of 5.3, reflecting moderate impact and ease of exploitation. Organizations using this software should prioritize patching or applying mitigations to prevent potential data breaches.

A flaw has been found in itsourcecode University Management System 1.0. Impacted is an unknown function of the file /admin_single_student_update.php. This manipulation of the argument st_name causes cross site scripting. The attack may be initiated remotely. The exploit has been published and may be used.

A vulnerability was detected in itsourcecode Online Doctor Appointment System 1.0. This issue affects some unknown processing of the file /admin/appointment_action.php. The manipulation of the argument appointment_id results in sql injection. The attack can be launched remotely. The exploit is now public and may be used.

CVE-2026-4472 is a medium severity SQL injection vulnerability found in the itsourcecode Online Frozen Foods Ordering System version 1.0. The flaw exists in the /admin/admin_edit_supplier.php file, where the Supplier_Name parameter is improperly sanitized, allowing remote attackers to inject malicious SQL code. Exploitation does not require user interaction but does require low-level privileges. The vulnerability can lead to unauthorized data access or modification, impacting confidentiality, integrity, and availability of the system's database. Although no public exploits are currently known in the wild, the vulnerability has been publicly disclosed, increasing the risk of exploitation. Organizations using this software should prioritize patching or applying mitigations to prevent potential attacks. The affected product is niche, so the impact is likely limited to organizations in the frozen foods supply chain using this system. Countries with significant frozen food industries and adoption of this software are at higher risk.

CVE-2026-4471 is a medium severity SQL injection vulnerability found in itsourcecode Online Frozen Foods Ordering System version 1.0. The flaw exists in the /admin/admin_edit_employee.php file, specifically in the handling of the First_Name parameter. This vulnerability allows remote attackers to manipulate SQL queries without requiring user interaction or privileges, potentially leading to unauthorized data access or modification. Although the exploit code is publicly available, no known active exploitation has been reported. The vulnerability impacts confidentiality, integrity, and availability to a limited extent due to required privileges and limited scope. Organizations using this system should prioritize patching or applying mitigations to prevent exploitation. Countries with significant use of this product or similar e-commerce platforms are at higher risk. The CVSS 4.

A security flaw has been discovered in itsourcecode Online Frozen Foods Ordering System 1.0. Affected by this issue is some unknown functionality of the file /admin/admin_edit_menu.php. Performing a manipulation of the argument product_name results in sql injection. It is possible to initiate the attack remotely. The exploit has been released to the public and may be used for attacks.

A vulnerability was identified in itsourcecode Online Frozen Foods Ordering System 1.0. Affected by this vulnerability is an unknown functionality of the file /admin/admin_edit_menu_action.php. Such manipulation of the argument product_name leads to sql injection. The attack may be performed from remote. The exploit is publicly available and might be used.

A flaw has been found in itsourcecode University Management System 1.0. Affected is an unknown function of the file /add_result.php. Executing a manipulation of the argument vr can lead to cross site scripting. The attack may be launched remotely. The exploit has been published and may be used.

A vulnerability was identified in itsourcecode College Management System 1.0. The impacted element is an unknown function of the file /admin/time-table.php. Such manipulation of the argument course_code leads to sql injection. The attack can be launched remotely. The exploit is publicly available and might be used.

A vulnerability has been found in itsourcecode College Management System 1.0. This issue affects some unknown processing of the file /admin/courses.php. The manipulation of the argument course_code leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.

A flaw has been found in itsourcecode Free Hotel Reservation System 1.0. This vulnerability affects unknown code of the file /hotel/admin/mod_reports/index.php. Executing a manipulation of the argument Home can lead to sql injection. The attack may be performed from remote. The exploit has been published and may be used.

A security vulnerability has been detected in itsourcecode Online Enrollment System 1.0. Impacted is an unknown function of the file /enrollment/index.php?view=add. Such manipulation of the argument txtsearch/deptname/name leads to sql injection. The attack may be performed from remote. The exploit has been disclosed publicly and may be used.