Threat database

A weakness has been identified in code-projects Online Food Ordering System 1.0. This affects an unknown part of the file /dbfood/localhost.sql. This manipulation causes files or directories accessible. The attack can be initiated remotely. The exploit has been made available to the public and could be used for attacks. It is advisable to modify the configuration settings.

CVE-2026-4899 is a cross-site scripting (XSS) vulnerability in version 1.0 of the code-projects Online Food Ordering System. The issue exists in the /dbfood/food.php file where the 'cuisines' parameter can be manipulated to execute malicious scripts. This vulnerability can be exploited remotely and requires user interaction. The CVSS score is 4.8, indicating a medium severity level. There is no information about an available patch or official remediation. Exploit code has been publicly released, but no known exploits in the wild have been reported.

CVE-2026-4898 is a medium severity cross-site scripting (XSS) vulnerability in version 1.0 of the code-projects Online Food Ordering System. The vulnerability exists in the /dbfood/contact.php file where the 'Name' parameter can be manipulated remotely to inject malicious scripts. Exploitation requires user interaction and no privileges are needed. There is no information about an official patch or vendor advisory at this time.

A security flaw has been discovered in code-projects Simple Laundry System 1.0. Affected is an unknown function of the file /checkregisitem.php of the component Parameter Handler. The manipulation of the argument Long-arm-shirtVol results in sql injection. The attack may be launched remotely. The exploit has been released to the public and may be used for attacks.

CVE-2026-4849 is a cross-site scripting (XSS) vulnerability in code-projects Simple Laundry System version 1.0. The issue exists in the /modify.php file within the Parameter Handler component, where the firstName argument can be manipulated to execute malicious scripts. The vulnerability can be exploited remotely and requires user interaction. No official patch or remediation guidance is currently provided by the vendor. The CVSS 4.0 base score is 5.3, indicating a medium severity level.

A vulnerability was detected in code-projects Online Food Ordering System 1.0. This issue affects some unknown processing of the file /admin.php of the component Admin Login Module. The manipulation of the argument Username results in sql injection. The attack may be performed from remote. The exploit is now public and may be used.

A weakness has been identified in code-projects Online Food Ordering System 1.0. This affects an unknown part of the file form/cart.php of the component Shopping Cart Module. Executing a manipulation of the argument del can lead to sql injection. The attack can be executed remotely. The exploit has been made available to the public and could be used for attacks.

A vulnerability was detected in code-projects Accounting System 1.0. The affected element is an unknown function of the file /my_account/delete.php. Performing a manipulation of the argument cos_id results in sql injection. It is possible to initiate the attack remotely. The exploit is now public and may be used.

A security vulnerability has been detected in code-projects Accounting System 1.0. Impacted is an unknown function of the file /my_account/add_costumer.php of the component Web Application Interface. Such manipulation of the argument costumer_name leads to cross site scripting. The attack may be performed from remote. The exploit has been disclosed publicly and may be used.

A vulnerability was found in code-projects Simple Laundry System 1.0. This affects an unknown function of the file /checkcheckout.php of the component Parameter Handler. The manipulation of the argument serviceId results in sql injection. It is possible to launch the attack remotely. The exploit has been made public and could be used.

A vulnerability was determined in code-projects Exam Form Submission 1.0. This vulnerability affects unknown code of the file /admin/update_s6.php. Executing a manipulation of the argument sname can lead to cross site scripting. The attack can be launched remotely. The exploit has been publicly disclosed and may be utilized.

A weakness has been identified in code-projects Simple Laundry System 1.0. Affected is an unknown function of the file /checklogin.php of the component Parameters Handler. This manipulation of the argument Username causes sql injection. The attack is possible to be carried out remotely. The exploit has been made available to the public and could be used for attacks.

A security flaw has been discovered in code-projects Simple Laundry System 1.0. This impacts an unknown function of the file /checkupdatestatus.php of the component Parameters Handler. The manipulation of the argument serviceId results in sql injection. The attack can be executed remotely. The exploit has been released to the public and may be used for attacks.

A vulnerability was identified in code-projects Simple Laundry System 1.0. This affects an unknown function of the file /viewdetail.php of the component Parameters Handler. The manipulation of the argument serviceId leads to sql injection. Remote exploitation of the attack is possible. The exploit is publicly available and might be used.

A vulnerability was determined in code-projects Exam Form Submission 1.0. The impacted element is an unknown function of the file /admin/update_s3.php. Executing a manipulation of the argument sname can lead to cross site scripting. The attack may be launched remotely. The exploit has been publicly disclosed and may be utilized.

A vulnerability was found in code-projects Exam Form Submission 1.0. The affected element is an unknown function of the file /admin/update_s4.php. Performing a manipulation of the argument sname results in cross site scripting. The attack may be initiated remotely. The exploit has been made public and could be used.

A vulnerability has been found in code-projects Exam Form Submission 1.0. Impacted is an unknown function of the file /admin/update_s5.php. Such manipulation of the argument sname leads to cross site scripting. The attack can be launched remotely. The exploit has been disclosed to the public and may be used.

A flaw has been found in code-projects Exam Form Submission 1.0. This issue affects some unknown processing of the file /admin/update_s2.php. This manipulation of the argument sname causes cross site scripting. The attack can be initiated remotely. The exploit has been published and may be used.

CVE-2026-4557 is a medium severity cross-site scripting (XSS) vulnerability found in code-projects Exam Form Submission version 1.0. The flaw exists in the /admin/update_s1.php file where the sname parameter is improperly sanitized, allowing remote attackers to inject malicious scripts. Exploitation does not require authentication but does require user interaction, such as tricking an administrator into clicking a crafted link. The vulnerability could lead to session hijacking, defacement, or redirection to malicious sites. No patches are currently available, and no known exploits are actively used in the wild. Organizations using this product should prioritize input validation and consider restricting access to the vulnerable admin interface. Countries with significant use of this software or similar educational platforms may be more at risk.

CVE-2026-4550 is a medium-severity SQL injection vulnerability affecting version 1.0 of the code-projects Simple Gym Management System. The flaw exists in the /gym/func.php file where manipulation of the Trainer_id or fname parameters allows an attacker to inject malicious SQL commands. This vulnerability can be exploited remotely without user interaction or authentication, potentially leading to unauthorized data access or modification. Although no public exploits are currently known in the wild, the exploit details have been disclosed publicly, increasing the risk of exploitation. The vulnerability impacts confidentiality, integrity, and availability of the affected system's data, but requires high privileges to exploit. Organizations using this gym management software should prioritize patching or mitigating this issue to prevent potential data breaches or system compromise.