Threat database

A security vulnerability has been detected in code-projects Simple Gym Management System 1.0. This vulnerability affects unknown code of the component Payment Handler. The manipulation of the argument Payment_id/Amount/customer_id/payment_type/customer_name leads to sql injection. Remote exploitation of the attack is possible. The exploit has been disclosed publicly and may be used.

A vulnerability was determined in code-projects Student Membership System 1.0. The impacted element is an unknown function of the file /admin/index.php of the component Admin Login. This manipulation of the argument username/password causes sql injection. Remote exploitation of the attack is possible. The exploit has been publicly disclosed and may be utilized.

CVE-2026-5197 is a medium severity SQL injection vulnerability in code-projects Student Membership System version 1.0. It occurs in an unknown function within the /delete_user.php file, where manipulation of the ID parameter allows remote attackers to perform SQL injection. The vulnerability has a CVSS 4.0 base score of 5.3, indicating a moderate risk. Exploit code has been publicly disclosed, but there are no known exploits in the wild at this time. No official patch or remediation guidance is currently available from the vendor.

A vulnerability has been found in code-projects Student Membership System 1.0. Impacted is an unknown function of the file /delete_member.php. The manipulation of the argument ID leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used.

CVE-2026-5195 is a medium severity SQL injection vulnerability in code-projects Student Membership System version 1.0. It affects the User Registration Handler component, allowing remote attackers to manipulate input and execute SQL injection attacks. No official patch or remediation information is provided, and no known exploits are reported in the wild.

CVE-2026-5157 is a medium severity cross-site scripting (XSS) vulnerability in version 1.0 of the code-projects Online Food Ordering System. The vulnerability exists in the /form/order.php file within the Order Module, where manipulation of the cust_id parameter can lead to XSS attacks. This vulnerability can be exploited remotely and requires user interaction. No patch or official remediation information is provided at this time. The exploit code is publicly available, but there are no known exploits in the wild currently.

CVE-2026-5150 is a medium severity SQL injection vulnerability in code-projects Accounting System version 1.0. It arises from improper handling of the cos_id parameter in the /viewin_costumer.php file within the Parameter Handler component. This flaw allows remote attackers to manipulate SQL queries, potentially compromising the database. The vulnerability has been publicly disclosed, but no known exploits are reported in the wild. No official patch or remediation guidance is currently available.

A flaw has been found in code-projects Exam Form Submission 1.0. The impacted element is an unknown function of the file /admin/update_fst.php. Executing a manipulation of the argument sname can lead to cross site scripting. It is possible to launch the attack remotely. The exploit has been published and may be used.

A vulnerability was identified in code-projects Chamber of Commerce Membership Management System 1.0. Impacted is the function fwrite of the file admin/pageMail.php. The manipulation of the argument mailSubject/mailMessage leads to command injection. The attack may be initiated remotely. The exploit is publicly available and might be used.

A vulnerability has been found in code-projects Accounting System 1.0. This affects an unknown part of the file /view_work.php of the component Parameter Handler. Such manipulation of the argument en_id leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.

A flaw has been found in code-projects Accounting System 1.0. Affected by this issue is some unknown functionality of the file /edit_costumer.php of the component Parameter Handler. This manipulation of the argument cos_id causes sql injection. It is possible to initiate the attack remotely. The exploit has been published and may be used.

A vulnerability was detected in code-projects Accounting System 1.0. Affected by this vulnerability is an unknown functionality of the file /view_costumer.php of the component Parameter Handler. The manipulation of the argument cos_id results in sql injection. The attack may be performed from remote. The exploit is now public and may be used.

A security vulnerability has been detected in code-projects Simple Food Order System 1.0. Affected by this vulnerability is an unknown functionality of the file all-orders.php of the component Parameter Handler. The manipulation of the argument Status leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed publicly and may be used.

A weakness has been identified in code-projects Simple Food Order System 1.0. Affected is an unknown function of the file register-router.php of the component Parameter Handler. Executing a manipulation of the argument Name can lead to sql injection. The attack can be launched remotely. The exploit has been made available to the public and could be used for attacks.

A security flaw has been discovered in code-projects Simple Food Order System 1.0. This impacts an unknown function of the file /all-tickets.php of the component Parameter Handler. Performing a manipulation of the argument Status results in sql injection. The attack can be initiated remotely. The exploit has been released to the public and may be used for attacks.

A security vulnerability has been detected in code-projects Online Reviewer System up to 1.0. Affected is an unknown function of the file /system/system/students/assessments/databank/btn_functions.php. Such manipulation of the argument Description leads to cross site scripting. The attack may be performed from remote. The exploit has been disclosed publicly and may be used.

A security flaw has been discovered in code-projects Social Networking Site 1.0. This affects an unknown function of the file delete_photos.php of the component Endpoint. The manipulation of the argument ID results in sql injection. The attack can be executed remotely. The exploit has been released to the public and may be used for attacks.

A vulnerability was identified in code-projects Social Networking Site 1.0. The impacted element is an unknown function of the file /home.php of the component Alert Handler. The manipulation of the argument content leads to cross site scripting. Remote exploitation of the attack is possible. The exploit is publicly available and might be used.

CVE-2026-4909 is a medium severity cross-site scripting (XSS) vulnerability in code-projects Exam Form Submission version 1.0. The vulnerability exists in the /admin/update_s7.php file, where manipulation of the 'sname' argument allows remote attackers to inject malicious scripts. The exploit code has been publicly disclosed, but there are no known exploits in the wild at this time. No official patch or remediation guidance is currently available.

CVE-2026-4908 is a medium severity SQL injection vulnerability in code-projects Simple Laundry System version 1.0. The flaw exists in the /modstaffinfo.php file within the Parameter Handler component, where manipulation of the userid argument allows an attacker to perform SQL injection remotely. The vulnerability has a CVSS 4.0 base score of 6.9. Although an exploit has been publicly released, there are no known exploits in the wild at this time. No official patch or remediation guidance is currently provided by the vendor.