A flaw has been found in SourceCodester Hospitals Patient Records Management System 1.0. The impacted element is an unknown function of the file /classes/Master.php?f=save_patient_history. This manipulation of the argument ID causes sql injection. The attack is possible to be carried out remotely. The exploit has been published and may be used.
A security flaw has been discovered in SourceCodester Hospitals Patient Records Management System 1.0. Impacted is an unknown function of the file /admin/patients/view_history.php. The manipulation of the argument ID results in sql injection. The attack may be launched remotely. The exploit has been released to the public and may be used for attacks.
CVE-2026-8136 is a cross-site scripting (XSS) vulnerability in SourceCodester Pharmacy Sales and Inventory System version 1.0. The flaw exists in the /index.php? page=users endpoint where manipulation of the 'Name' argument can lead to XSS. The vulnerability can be exploited remotely and an exploit has been published. The CVSS score is 4.8, indicating medium severity. No official patch or remediation guidance is currently available from the vendor.
SourceCodester SUP Online Shopping version 1.0 contains a SQL injection vulnerability in the /admin/replymsg.php file via the msgid parameter. This flaw allows remote attackers to manipulate SQL queries without requiring authentication or user interaction. The vulnerability has a CVSS 4.0 base score of 6.9, indicating medium severity. No official patch or remediation guidance is currently available, and no known exploits have been observed in the wild. The vulnerability disclosure includes a public exploit, which may increase risk if not addressed.
SourceCodester SUP Online Shopping version 1.0 contains a SQL injection vulnerability in the /admin/message.php file via the seenid parameter. This vulnerability can be exploited remotely without authentication. The vulnerability has a CVSS 4.0 base score of 6.9, indicating medium severity. No official patch or remediation guidance is currently available from the vendor. Exploits are publicly available, but there are no confirmed reports of exploitation in the wild at this time.
CVE-2026-8129 is a medium severity SQL injection vulnerability in SourceCodester SUP Online Shopping version 1.0. The vulnerability exists in an unknown function within the wishlist.php file, where manipulation of the delwlistid argument can lead to SQL injection. This flaw can be exploited remotely without authentication. The exploit has been publicly disclosed, but no official patch or remediation guidance is currently available from the vendor.
CVE-2026-8128 is a medium severity SQL injection vulnerability in SourceCodester SUP Online Shopping version 1.0. The flaw exists in an unknown function within the /admin/viewmsg.php file, where manipulation of the 'msgid' parameter allows remote attackers to perform SQL injection. The vulnerability is exploitable remotely without authentication. No official patch or remediation guidance is currently available, and no known exploits are reported in the wild.
CVE-2026-8126 is a medium severity SQL injection vulnerability in SourceCodester Comment System version 1.0. The flaw exists in the post_comment.php file where manipulation of the 'Name' argument allows remote attackers to perform SQL injection. There is no official patch or remediation guidance available at this time. Exploit code has been published, but no known exploits in the wild have been reported. The vulnerability allows an attacker to potentially interfere with the backend database through crafted input.
SourceCodester Pizzafy Ecommerce System version 1.0 contains a cross-site scripting (XSS) vulnerability in the /admin/index.php file. The vulnerability arises from improper handling of the 'page' argument, allowing remote attackers to inject malicious scripts. This issue has been publicly disclosed but there are no known exploits in the wild. The vulnerability has a medium severity rating with a CVSS score of 5.3.
A vulnerability was found in SourceCodester Pharmacy Sales and Inventory System 1.0. This affects an unknown part of the file /ajax.php?action=save_user. The manipulation of the argument ID results in sql injection. The attack can be executed remotely. The exploit has been made public and could be used.
A vulnerability was identified in SourceCodester Web-based Pharmacy Product Management System 1.0. Affected is an unknown function of the file /product_expiry/edit-admin.php. Such manipulation of the argument ID leads to sql injection. It is possible to launch the attack remotely. The exploit is publicly available and might be used.
A vulnerability has been found in SourceCodester Pharmacy Sales and Inventory System 1.0. Affected is an unknown function of the file /ajax.php?action=save_customer. The manipulation of the argument ID leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.
A flaw has been found in SourceCodester Pharmacy Sales and Inventory System 1.0. This impacts an unknown function of the file /ajax.php?action=delete_customer. Executing a manipulation of the argument ID can lead to sql injection. The attack may be performed from remote. The exploit has been published and may be used.
A weakness has been identified in SourceCodester Advanced School Management System 1.0. The affected element is an unknown function of the file commonController.php of the component checkEmail Endpoint. This manipulation causes sql injection. Remote exploitation of the attack is possible. The exploit has been made available to the public and could be used for attacks.
CVE-2026-7506 is a medium severity SQL injection vulnerability found in SourceCodester Hotel Management System version 1.0. The issue exists in the /index.php/reservation/check file where the room_type parameter can be manipulated to perform SQL injection. This vulnerability can be exploited remotely without authentication. The exploit has been publicly disclosed, but no official patch or remediation guidance is currently available from the vendor.
A flaw has been found in SourceCodester Pet Grooming Management Software 1.0. This vulnerability affects unknown code of the file /admin/update_customer.php. This manipulation of the argument type/length/business parameter validity causes sql injection. The attack is possible to be carried out remotely. The exploit has been published and may be used.
A vulnerability has been found in SourceCodester Pizzafy Ecommerce System 1.0. This vulnerability affects unknown code of the file /admin/ajax.php?action=add_to_cart. The manipulation of the argument pid leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used.
CVE-2026-7409 is a medium-severity SQL injection vulnerability in SourceCodester Pizzafy Ecommerce System version 1.0. The flaw exists in the save_user function within /admin/ajax.php? action=save_user. This vulnerability allows remote attackers with high privileges to manipulate input and potentially execute SQL injection attacks. Although an exploit has been published, there are no known exploits in the wild at this time. No official patch or remediation guidance has been provided by the vendor yet.
CVE-2026-7408 is a medium-severity SQL injection vulnerability in SourceCodester Pizzafy Ecommerce System version 1.0. The flaw exists in the save_menu function within /admin/ajax.php? action=save_menu, allowing remote attackers to manipulate SQL queries. The vulnerability has a CVSS 4.0 base score of 5.1. Exploit code is publicly available, but no official patch or remediation guidance has been provided by the vendor. The system is not a cloud service, and no known exploits in the wild have been reported.
CVE-2026-7407 is a medium severity SQL injection vulnerability in SourceCodester Pizzafy Ecommerce System version 1.0. The flaw exists in the save_settings function within the /pizzafy/admin/ajax.php? action=save_settings file of the Setting Handler component. This vulnerability allows remote attackers with high privileges to manipulate SQL queries, potentially compromising the database. The vulnerability has been publicly disclosed, but no official patch or remediation guidance is currently available from the vendor.