CVE-2026-5812 is a medium severity vulnerability in SourceCodester Pharmacy Product Management System version 1.0. It involves a business logic error in the add-sales.php component, specifically in handling the POST parameter txtqty. This flaw allows remote attackers to manipulate the quantity parameter, potentially causing unintended business logic behavior. The vulnerability has a CVSS 4.0 base score of 5.3. No official patch or remediation guidance is currently available, and no known exploits are reported in the wild.
CVE-2026-5811 is a medium severity vulnerability in SourceCodester Online Food Ordering System version 1.0. It involves business logic errors caused by manipulation of the price parameter in the save_product function within the /Actions.php file. The vulnerability can be exploited remotely without user interaction or privileges. Although an exploit is publicly available, there are no known exploits in the wild. No official patch or remediation guidance has been provided yet.
A flaw has been found in SourceCodester Sales and Inventory System 1.0. Affected is an unknown function of the file /delete.php of the component GET Parameter Handler. This manipulation of the argument ID causes cross site scripting. Remote exploitation of the attack is possible. The exploit has been published and may be used.
CVE-2026-5576 is a medium severity vulnerability in SourceCodester/jkev Record Management System 1.0. It involves an unrestricted file upload flaw in the save_emp.php component of the Add Employee Page. This vulnerability allows remote attackers with high privileges to upload files without proper restrictions. Although an exploit has been published, there are no known exploits in the wild at this time. No official patch or remediation guidance has been provided by the vendor yet.
CVE-2026-5575 is a medium severity SQL injection vulnerability in SourceCodester/jkev Record Management System version 1.0. The vulnerability exists in the Login component's index.php file, where manipulation of the Username argument can lead to SQL injection. The vulnerability can be exploited remotely without authentication. Although an exploit is publicly available, there is no confirmed patch or official remediation at this time.
A vulnerability has been found in SourceCodester Student Result Management System 1.0. Impacted is an unknown function of the file /login_credentials.txt of the component HTTP GET Request Handler. The manipulation leads to cleartext storage in a file or on disk. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used.
CVE-2026-5330 is a medium severity vulnerability in SourceCodester Best Courier Management System 1.0. It involves improper access controls in the User Delete Handler component, specifically in the /ajax.php? action=delete_user endpoint. An attacker can manipulate the ID argument to bypass access restrictions and potentially delete users remotely. The vulnerability has a CVSS 4.0 base score of 6.9. No official patch or remediation guidance is currently available, and no known exploits are reported in the wild.
A vulnerability was identified in SourceCodester Leave Application System 1.0. Impacted is an unknown function of the file /index.php?page=manage_user of the component User Information Handler. Such manipulation of the argument ID leads to authorization bypass. The attack can be executed remotely. The exploit is publicly available and might be used.
CVE-2026-5325 is a medium severity cross-site scripting (XSS) vulnerability in SourceCodester Simple Customer Relationship Management System version 1.0. The issue arises from improper handling of the Description parameter in the /create-ticket.php component, allowing remote attackers to inject malicious scripts. The vulnerability has been publicly disclosed, but no official patch or remediation guidance is currently available.
A vulnerability was detected in SourceCodester Leave Application System 1.0. This affects an unknown part. Performing a manipulation of the argument page results in file inclusion. Remote exploitation of the attack is possible. The exploit is now public and may be used.
A security vulnerability has been detected in SourceCodester Leave Application System 1.0. Affected by this issue is some unknown functionality of the component User Management Handler. Such manipulation leads to cross site scripting. The attack may be launched remotely. The exploit has been disclosed publicly and may be used.
CVE-2026-5182 is a medium-severity SQL injection vulnerability in SourceCodester Teacher Record System version 1.0. The flaw exists in an unknown function handling the 'searchteacher' parameter, allowing remote attackers to manipulate SQL queries. The vulnerability has a CVSS 4.0 base score of 6.9, indicating moderate impact. Exploit code has been publicly disclosed, but no known exploits in the wild have been reported. No official patch or remediation guidance is currently available from the vendor.
CVE-2026-5181 is a medium severity vulnerability in SourceCodester Simple Doctors Appointment System version 1.0. It involves an unrestricted file upload issue via the img argument in the /doctors_appointment/admin/ajax.php? action=save_category endpoint. The vulnerability can be exploited remotely without user interaction or privileges. The exploit has been publicly disclosed but no known exploits are reported in the wild. No official patch or remediation details are provided in the available data.
SourceCodester Simple Doctors Appointment System version 1.0 contains a SQL injection vulnerability in the /admin/ajax.php? action=login2 endpoint. The flaw arises from improper handling of the 'email' parameter, allowing remote attackers to manipulate SQL queries. This vulnerability has a CVSS 4.0 base score of 6.9, indicating medium severity. No official patch or remediation guidance is currently provided, and no known exploits have been reported in the wild.
CVE-2026-5179 is a medium severity SQL injection vulnerability in SourceCodester Simple Doctors Appointment System version 1.0. The vulnerability exists in the /admin/login.php file where the Username parameter can be manipulated to perform SQL injection. This flaw allows an unauthenticated remote attacker to potentially execute unauthorized SQL commands. The exploit code is publicly available, increasing the risk of exploitation. No official patch or remediation guidance has been provided by the vendor at this time.
A flaw has been found in SourceCodester RSS Feed Parser 1.0. Affected by this issue is the function file_get_contents. This manipulation causes server-side request forgery. The attack is possible to be carried out remotely. The exploit has been published and may be used.
A vulnerability was detected in SourceCodester Online Quiz System up to 1.0. Affected by this vulnerability is an unknown functionality of the file endpoint/add-question.php. Performing a manipulation of the argument quiz_question results in cross site scripting. It is possible to initiate the attack remotely. The exploit is now public and may be used.
A weakness has been identified in SourceCodester Note Taking App up to 1.0. This impacts an unknown function. This manipulation causes cross-site request forgery. The attack is possible to be carried out remotely. The exploit has been made available to the public and could be used for attacks.
A vulnerability was determined in SourceCodester Diary App 1.0. The affected element is an unknown function of the file diary.php. Executing a manipulation can lead to cross-site request forgery. The attack may be launched remotely. The exploit has been publicly disclosed and may be utilized.
A vulnerability has been found in SourceCodester Food Ordering System 1.0. This affects an unknown function of the file /purchase.php of the component Parameter Handler. The manipulation of the argument custom leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.