CVE-2026-10184 is a medium severity SQL injection vulnerability in SourceCodester Hospitals Patient Records Management System version 1.0. It affects the delete function in the /classes/Users.php file via manipulation of the ID parameter. The vulnerability can be exploited remotely without authentication. Although an exploit is publicly available, there is no confirmed patch or official remediation at this time.
A security vulnerability has been detected in SourceCodester eDoc Doctor Appointment System 1.0. This affects an unknown part of the file /admin/delete-session.php. The manipulation of the argument ID leads to missing authorization. Remote exploitation of the attack is possible. The exploit has been disclosed publicly and may be used.
CVE-2026-9583 is a medium severity vulnerability in SourceCodester CET Automated Grading System with AI Predictive Analytics version 1.0. It involves information exposure through error messages in the SQL Handler component located in /index.php. The vulnerability can be exploited remotely without user interaction or privileges. Although the exploit code is publicly available, there is no confirmed patch or official remediation at this time.
A security flaw has been discovered in SourceCodester CET Automated Grading System with AI Predictive Analytics 1.0. This affects an unknown function. Performing a manipulation results in cross-site request forgery. The attack is possible to be carried out remotely. The exploit has been released to the public and may be used for attacks.
A vulnerability was found in SourceCodester/oretnom23 Hospitals Patient Records Management System 1.0. The impacted element is an unknown function of the file /admin/?page=patients/view_patient. Performing a manipulation of the argument Remarks results in cross site scripting. Remote exploitation of the attack is possible. The exploit has been made public and could be used.
CVE-2026-9486 is a cross-site request forgery (CSRF) vulnerability affecting SourceCodester Student Grades Management System version 1.0. The flaw allows remote attackers to trick authenticated users into submitting unauthorized requests. The vulnerability has a medium severity with a CVSS score of 5.3. No official patch or remediation guidance has been provided by the vendor as of the publication date. Exploit code has been publicly released, increasing the risk of potential attacks. The affected product is not a cloud service, so remediation depends on vendor updates or user-applied fixes.
CVE-2026-9485 is a cross-site scripting (XSS) vulnerability in SourceCodester Student Grades Management System version 1.0. The issue arises from improper handling of the 'Remarks' parameter in the students.php file, allowing remote attackers to inject malicious scripts. The vulnerability has a medium severity rating with a CVSS score of 5.1. No official patch or remediation guidance is currently available from the vendor. Exploits are publicly available, but no known active exploitation in the wild has been reported.
A vulnerability was determined in SourceCodester Student Grades Management System 1.0. Affected by this vulnerability is the function getClassroomStudents/removeStudentFromClassroom of the file classroom.php. Executing a manipulation of the argument classroom_id can lead to improper authorization. The attack may be launched remotely. The exploit has been publicly disclosed and may be utilized.
CVE-2026-9483 is a medium severity vulnerability in SourceCodester Student Grades Management System version 1.0. It involves improper authorization in the grades.php file, where manipulation of the student_id argument can bypass authorization controls. The vulnerability can be exploited remotely without user interaction or elevated privileges. No official patch or remediation guidance is currently available from the vendor. The exploit details have been publicly disclosed, but no known exploitation in the wild has been reported.
CVE-2026-9447 is a SQL injection vulnerability in SourceCodester Simple POS and Inventory System version 1.0. It exists in an unspecified function within the /user/search.php file, where manipulation of the 'Name' argument allows injection. The vulnerability can be exploited remotely without authentication. Although an exploit has been publicly disclosed, there is no confirmed patch or official remediation available at this time. The CVSS 4.0 base score is 6.9, indicating a medium severity level.
A vulnerability has been found in SourceCodester Simple POS and Inventory System 1.0. The affected element is an unknown function of the file /admin/edit_customer.php. Such manipulation of the argument ID leads to sql injection. The attack can be executed remotely. The exploit has been disclosed to the public and may be used.
CVE-2026-9445 is a medium severity vulnerability in SourceCodester Simple POS and Inventory System version 1.0. It involves an unrestricted file upload flaw in the /admin/addproduct.php file's File Extension Handler component. This flaw allows remote attackers to upload files without proper restriction, potentially leading to unauthorized actions. Exploits have been published, but no known active exploitation in the wild is reported. No official patch or remediation guidance is currently available from the vendor.
CVE-2026-9444 is a medium severity SQL injection vulnerability in SourceCodester Simple POS and Inventory System version 1.0. It affects the delete function in /admin/deleteproduct.php via manipulation of the ID GET parameter. The vulnerability allows remote attackers with high privileges to inject SQL commands. The exploit code is publicly available. No official patch or remediation guidance has been provided yet.
CVE-2026-9414 is a cross-site scripting (XSS) vulnerability in the SourceCodester Indian Invoicing System versions up to 0.x and 1.0. The vulnerability exists in the /Invoicing/add_order.php file, specifically involving the customer_name parameter. An attacker can remotely exploit this flaw by injecting malicious scripts via this parameter. The vulnerability has a medium severity rating with a CVSS score of 5.1. No official patch or remediation guidance has been provided by the vendor at this time. Public exploit code is available, but there are no confirmed reports of exploitation in the wild.
CVE-2026-9413 is a medium severity cross-site scripting (XSS) vulnerability in SourceCodester Indian Invoicing System version 1.0. It arises from improper handling of the 'msg' argument in the /Invoicing/category.php file, allowing remote attackers to inject malicious scripts. The vulnerability does not require privileges or user interaction to be initiated, but user interaction is possible. No official patch or remediation guidance is currently available from the vendor. The exploit code is publicly available, but there are no known exploits in the wild at this time.
A vulnerability was determined in SourceCodester Indian Invoicing System 1.0. Impacted is an unknown function of the component Backend Endpoint. Executing a manipulation can lead to improper access controls. The attack can be launched remotely. The exploit has been publicly disclosed and may be utilized. Multiple endpoints are affected.
CVE-2026-9411 is a medium severity SQL injection vulnerability in SourceCodester Indian Invoicing System version 1.0. The flaw exists in the Invoice Generation Handler component, specifically in the /Invoicing/IGST_Invoice.php file, where manipulation of the customer_name or category arguments can lead to SQL injection. The vulnerability can be exploited remotely without user interaction or elevated privileges. Although the exploit code has been publicly disclosed, there is no confirmed patch or official remediation available at this time.
A vulnerability was identified in SourceCodester SUP Online Shopping 1.0. The impacted element is an unknown function of the file /admin/productedit.php. The manipulation of the argument productName leads to cross site scripting. It is possible to initiate the attack remotely. The exploit is publicly available and might be used.
A vulnerability has been found in SourceCodester Hospitals Patient Records Management System 1.0. This affects an unknown function of the file /admin/patients/manage_history.php. Such manipulation of the argument ID leads to sql injection. The attack may be performed from remote. The exploit has been disclosed to the public and may be used.
A flaw has been found in SourceCodester Hospitals Patient Records Management System 1.0. The impacted element is an unknown function of the file /classes/Master.php?f=save_patient_history. This manipulation of the argument ID causes sql injection. The attack is possible to be carried out remotely. The exploit has been published and may be used.