A vulnerability was found in code-projects E-Commerce Website 1.0. Affected is an unknown function of the file /pages/product_add.php. The manipulation of the argument prod_name/prod_desc/prod_cost results in cross site scripting. It is possible to launch the attack remotely. The exploit has been made public and could be used.
A vulnerability has been found in code-projects E-Commerce Website 1.0. This impacts an unknown function of the file /pages/supplier_add.php. The manipulation of the argument supp_name/supp_address leads to cross site scripting. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.
A vulnerability was identified in code-projects Courier Management System 1.0. This impacts an unknown function of the file /courier/edit-courier.php. The manipulation of the argument OfficeName leads to sql injection. The attack is possible to be carried out remotely. The exploit is publicly available and might be used.
A vulnerability was determined in code-projects Food Ordering System 1.0. This affects an unknown function of the file /admin/menu.php. Executing a manipulation of the argument itemPrice can lead to sql injection. The attack can be executed remotely. The exploit has been publicly disclosed and may be utilized.
A vulnerability was found in code-projects Food Ordering System 1.0. The impacted element is an unknown function of the file /admin/deleteitem.php. Performing a manipulation of the argument itemID results in sql injection. Remote exploitation of the attack is possible. The exploit has been made public and could be used.
A weakness has been identified in code-projects Nero Social Networking Site 1.0. This affects an unknown part of the file /friendprofile.php. Executing manipulation of the argument ID can lead to sql injection. It is possible to launch the attack remotely. The exploit has been made available to the public and could be exploited.
A security flaw has been discovered in code-projects Nero Social Networking Site 1.0. Affected by this issue is some unknown functionality of the file /deletemessage.php. Performing manipulation of the argument message_id results in sql injection. It is possible to initiate the attack remotely. The exploit has been released to the public and may be exploited.
A vulnerability was identified in code-projects Nero Social Networking Site 1.0. Affected by this vulnerability is an unknown functionality of the file /addfriend.php. Such manipulation of the argument ID leads to sql injection. The attack may be performed from remote. The exploit is publicly available and might be used.
A vulnerability was determined in code-projects Nero Social Networking Site 1.0. Affected is an unknown function of the file /acceptoffres.php. This manipulation of the argument ID causes sql injection. The attack is possible to be carried out remotely. The exploit has been publicly disclosed and may be utilized.
A vulnerability was detected in code-projects Simple Food Ordering System 1.0. The affected element is an unknown function of the file /editproduct.php. Performing manipulation of the argument pname/category/price results in cross site scripting. The attack may be initiated remotely. The exploit is now public and may be used.
A security vulnerability has been detected in code-projects Simple Food Ordering System 1.0. Impacted is an unknown function of the file /editproduct.php. Such manipulation of the argument photo leads to unrestricted upload. The attack can be launched remotely. The exploit has been disclosed publicly and may be used.
A weakness has been identified in code-projects Simple Food Ordering System 1.0. This issue affects some unknown processing of the file /addcategory.php. This manipulation of the argument cname causes cross site scripting. The attack can be initiated remotely. The exploit has been made available to the public and could be exploited.
CVE-2025-12299 is a medium severity cross-site scripting (XSS) vulnerability found in version 1.0 of the code-projects Simple Food Ordering System. The flaw exists in the /addproduct.php file, where manipulation of the pname, category, or price parameters allows remote attackers to inject malicious scripts. Exploitation does not require authentication but does require user interaction, such as a victim visiting a crafted URL. Although no known exploits are currently observed in the wild, the exploit code has been publicly released, increasing the risk of attacks. The vulnerability can lead to theft of user credentials, session hijacking, or defacement of web content. European organizations using this software, especially in the hospitality or food service sectors, may face targeted attacks. Mitigation involves sanitizing and validating all user inputs on the affected parameters and applying patches once available. Countries with higher adoption of small to medium hospitality businesses using this software, such as Germany, France, Italy, and Spain, are more likely to be impacted.
CVE-2025-12298 is a medium severity cross-site scripting (XSS) vulnerability in version 1.0 of the code-projects Simple Food Ordering System, specifically in the /editcategory.php file via the pname parameter. The vulnerability allows remote attackers to inject malicious scripts without requiring authentication, though user interaction is needed to trigger the attack. Exploits are publicly available, increasing the risk of exploitation. While no known active exploitation has been reported, affected systems remain vulnerable. The impact primarily concerns client-side attacks such as session hijacking, credential theft, or defacement. European organizations using this software, especially in the food service sector, should prioritize patching or mitigating this issue. Countries with higher adoption of this product or with strategic food service industries are more likely to be affected. Mitigations include input validation, output encoding, and deploying web application firewalls tailored to detect XSS payloads.
A security flaw has been discovered in code-projects Client Details System 1.0. The impacted element is an unknown function. The manipulation results in authorization bypass. The attack can be launched remotely. The exploit has been released to the public and may be exploited.
A vulnerability was identified in code-projects Client Details System 1.0. The affected element is an unknown function of the file /admin/manage-users.php. The manipulation leads to cross site scripting. The attack can be initiated remotely. The exploit is publicly available and might be used.
CVE-2025-12281 is a medium severity cross-site scripting (XSS) vulnerability in version 1.0 of the code-projects Client Details System, specifically in the /admin/clientview.php file. The vulnerability allows remote attackers to execute malicious scripts due to insufficient input sanitization, potentially leading to user session hijacking or defacement. Exploitation does not require authentication but does require user interaction. Although the exploit has been publicly disclosed, no known active exploitation in the wild has been reported. The vulnerability impacts confidentiality and integrity to a limited extent and does not affect availability. European organizations using this software should prioritize patching or applying mitigations to prevent potential targeted attacks. Countries with higher adoption of this product or with strategic interest in client data management systems are more likely to be affected.
CVE-2025-12280 is a medium severity cross-site scripting (XSS) vulnerability found in version 1.0 of the code-projects Client Details System, specifically in the /update-clients.php endpoint. The flaw allows remote attackers to inject malicious scripts without requiring authentication, but user interaction is needed to trigger the attack. Exploitation could lead to limited integrity impact and no direct confidentiality or availability loss. Although no public exploits are currently observed in the wild, the exploit code has been made public. The vulnerability affects only version 1.0 of this niche product, limiting its scope. European organizations using this system should prioritize patching or applying input validation controls to mitigate risks. Countries with higher adoption of this software or targeted sectors using it are more likely to be impacted.
A vulnerability has been found in code-projects Client Details System 1.0. This vulnerability affects unknown code of the file /welcome.php. Such manipulation leads to cross site scripting. The attack may be performed from remote. The exploit has been disclosed to the public and may be used.
A vulnerability was identified in code-projects Online Event Judging System 1.0. Affected is an unknown function of the file /edit_judge.php. The manipulation of the argument judge_id leads to sql injection. The attack may be initiated remotely. The exploit is publicly available and might be used.
