Threat database

CVE-2026-82700 is a medium severity cross-site scripting (XSS) vulnerability found in version 1.0 of the code-projects Online Shopping System. The vulnerability exists in the /offersmail.php file within the Newsletter Subscription component, where manipulation of the email argument can lead to XSS. The vulnerability can be exploited remotely and requires user interaction. Public exploit code is available. No official patch or remediation guidance has been provided yet.

A vulnerability has been found in code-projects Simple Inventory System 1.0. This affects an unknown part of the file /register.php of the component User Registration. Such manipulation of the argument last_name leads to cross site scripting. The attack may be launched remotely. The exploit has been disclosed to the public and may be used.

CVE-2026-82624 is an information disclosure vulnerability in code-projects Simple Inventory System version 1.0. The flaw exists in an unknown functionality of the inventorymanagement.sql file within the Database Backup File Handler component. The vulnerability can be exploited remotely without authentication and has a published exploit. The CVSS 4.0 base score is 6.9, indicating medium severity.

CVE-2026-82622 is a medium severity cross-site scripting (XSS) vulnerability in code-projects Employee Leave Managing System version 1.0. It affects the Employee Profile Update component, specifically the /EmpManageSys/editaction.php file, where the Name argument can be manipulated remotely to execute XSS attacks. The vulnerability has been publicly disclosed, but no official patch or remediation guidance is currently available.

CVE-2026-79845 is a SQL injection vulnerability in code-projects Simple Inventory System version 1.0. The flaw exists in the /InventoryManagement/edit.php file where the ID parameter can be manipulated remotely to execute unauthorized SQL commands. Exploit code is publicly available, but no official patch or fix has been confirmed yet.

CVE-2026-79793 is a cross-site scripting (XSS) vulnerability in code-projects Online Shopping System version 1.0. The vulnerability exists in the /admin/sumit_form.php file where manipulation of the 'Success' argument can lead to XSS. The vulnerability can be exploited remotely and requires user interaction. The CVSS score is 5.3, indicating a medium severity level.

CVE-2026-78144 is an authorization bypass vulnerability in code-projects Barangay Resident Profiling Management System version 1.0. The flaw exists in the Boarder Management Module, specifically in the /boarders.php file, where manipulation of the ID argument allows unauthorized access. The vulnerability can be exploited remotely without user interaction. Public exploit code is available. The CVSS 4.0 base score is 5.3, indicating medium severity.

CVE-2026-78143 is a SQL injection vulnerability in the Barangay Resident Profiling Management System version 1.0. It affects the Resident Search Functionality in the residents.php file, where manipulation of the Search argument allows injection. The vulnerability can be exploited remotely without authentication. Public exploit code has been disclosed. The CVSS 4.0 base score is 6.9, indicating a medium severity.

CVE-2026-78142 is an authorization bypass vulnerability in code-projects Barangay Resident Profiling Management System version 1.0. It affects the Restore/Delete component, specifically the /archived_records.php file, where manipulation of the resident_id argument can bypass authorization controls. The vulnerability can be exploited remotely without user interaction. The exploit code has been publicly disclosed. The CVSS 4.0 score is 5.3, indicating medium severity.

CVE-2026-76990 is a SQL injection vulnerability in code-projects Simple Inventory System version 1.0. The flaw exists in the /delete.php file where manipulation of the ID parameter allows an attacker to inject SQL commands. This vulnerability can be exploited remotely without authentication. The exploit has been publicly disclosed. The vulnerability has a medium severity rating with a CVSS score of 6.9.

CVE-2026-76799 is a medium severity vulnerability in code-projects Login Registration System version 1.0. It involves a weakness in the SQL Database Backup Handler component, specifically in the file /loginsystem/database/login_registration_system.sql, which allows files or directories to be accessible remotely. The vulnerability can be exploited without authentication and requires no user interaction. Public exploit code is available, but there are no known exploits in the wild. No patch or remediation information is provided.

CVE-2026-76764 is a SQL injection vulnerability in code-projects Employee Management System version 1.0. The flaw exists in an unknown function within the /process/aprocess.php file at the Admin Login Endpoint, where manipulation of the mailuid argument allows SQL injection. This vulnerability can be exploited remotely. An exploit has been published but there is no indication of active exploitation in the wild.

CVE-2026-76762 is a medium severity SQL injection vulnerability in code-projects Assessment Management version 1.0. The flaw exists in an unknown function within the /welcome.php file where the userid argument is improperly handled, allowing remote attackers to inject SQL code. Exploit code is publicly available, but no official patch or remediation guidance has been provided yet.

CVE-2026-76574 is a SQL injection vulnerability in code-projects Hospital Information System version 1.0. It affects the User::login function in includes/users/UsersController.php, allowing remote attackers to manipulate the email argument to perform SQL injection. The vulnerability has a CVSS 4.0 score of 6.9 (medium severity). Exploit code has been published but no known active exploitation in the wild is reported. No patch or official remediation information is provided.

CVE-2026-75986 is a SQL injection vulnerability in the code-projects Online Job Portal System version 1.0. It affects an unknown function in the /ForPass.php file related to the Password Recovery component. The vulnerability allows remote attackers to manipulate the txtUserName argument to perform SQL injection. The exploit has been publicly disclosed. The vulnerability has a medium severity with a CVSS 4.0 base score of 6.9.