Threat database

A vulnerability was found in SourceCodester Online Faculty Clearance System 1.0. This affects the function move_uploaded_file of the file production/edit_picture.php of the component Profile Picture Upload. Performing a manipulation of the argument File results in unrestricted upload. The attack is possible to be carried out remotely. The exploit has been made public and could be used.

A vulnerability has been found in SourceCodester Online Faculty Clearance System 1.0. The impacted element is an unknown function of the file /delete_faculty1.php. Such manipulation of the argument ID leads to sql injection. The attack can be executed remotely. The exploit has been disclosed to the public and may be used.

CVE-2026-90877 is a SQL injection vulnerability in SourceCodester Online Faculty Clearance System version 1.0. The flaw exists in the /update_requirement_status.php file where the 'haydi' parameter can be manipulated to execute unauthorized SQL commands. This vulnerability can be exploited remotely without authentication. The exploit code has been publicly disclosed. The CVSS 4.0 base score is 6.9, indicating a medium severity risk.

CVE-2026-90876 is a medium severity SQL injection vulnerability in SourceCodester Online Faculty Clearance System version 1.0. The flaw exists in the /delete_requirement.php file where the ID parameter can be manipulated remotely to execute SQL injection attacks. The vulnerability has been publicly disclosed and exploit code is available, but no official patch or remediation has been provided yet.

CVE-2026-90857 is a medium severity vulnerability in SourceCodester College Notes Gallery Management System version 1.0. It involves an unrestricted file upload issue in the /dashboard/userprofile.php component related to profile image uploads. The vulnerability allows remote attackers with limited privileges to upload arbitrary files by manipulating the image argument. Exploit code is publicly available, but no known active exploitation has been reported. No official patch or remediation guidance is currently provided.

CVE-2026-90856 is a medium severity vulnerability in SourceCodester College Notes Gallery Management System 1.0. It involves improper privilege management due to manipulation of the 'role' argument in the signup.php file within the registration flow component. The vulnerability can be exploited remotely without authentication. Public exploit code has been disclosed. No patch or remediation information is currently available.

CVE-2026-90855 is a SQL injection vulnerability in SourceCodester/katojkalemba Online Food Ordering System version 1.0. The flaw exists in the /web/order.php file where manipulation of the ID argument can lead to SQL injection. The vulnerability can be exploited remotely without authentication. Public exploit code is available, increasing the risk of attack. The CVSS 4.0 base score is 6.9, indicating a medium severity level.

A security flaw has been discovered in SourceCodester/katojkalemba Online Food Ordering System 1.0. The impacted element is an unknown function of the file /web/category-foods.php. The manipulation of the argument ID results in sql injection. It is possible to launch the attack remotely. The exploit has been released to the public and may be used for attacks.

CVE-2026-90849 is a SQL injection vulnerability in SourceCodester College Notes Gallery Management System version 1.0. The vulnerability exists in the login.php file where the User argument is improperly sanitized, allowing remote attackers to manipulate SQL queries. This flaw has been publicly disclosed and can be exploited remotely without authentication.

A vulnerability was identified in SourceCodester Inventory Management System 1.0. This affects an unknown part of the file invoice.php. The manipulation of the argument ID leads to authorization bypass. It is possible to initiate the attack remotely. The exploit is publicly available and might be used.

A vulnerability was determined in SourceCodester Inventory Management System 1.0. Affected by this issue is some unknown functionality of the file /api/products_handler.php of the component Product Management Module. Executing a manipulation of the argument Product_Name can lead to cross site scripting. The attack may be performed from remote. The exploit has been publicly disclosed and may be utilized.

A vulnerability was found in SourceCodester Inventory Management System 1.0. Affected by this vulnerability is an unknown functionality of the file /api/vendors_handler.php of the component Vendor Management. Performing a manipulation results in cross site scripting. The attack is possible to be carried out remotely. The exploit has been made public and could be used.

A vulnerability has been found in SourceCodester Inventory Management System 1.0. Affected is an unknown function of the file /api/customers_handler.php of the component Customer Management Module. Such manipulation of the argument Customer_Name leads to cross site scripting. The attack can be executed remotely. The exploit has been disclosed to the public and may be used.

A security vulnerability has been detected in SourceCodester Class and Exam Timetabling System 1.0. This affects an unknown part of the file /subject1.php. Such manipulation of the argument subject leads to cross site scripting. The attack can be executed remotely. The exploit has been disclosed publicly and may be used.

CVE-2026-90526 is a SQL injection vulnerability in SourceCodester School Registration and Fee System version 1.0. It arises from improper handling of the 'Category' parameter in the /bilal/save_class.php file, allowing remote attackers to inject SQL commands. The vulnerability has a medium severity with a CVSS score of 6.9. Exploit code has been publicly disclosed, but no known active exploitation in the wild is reported. No official patch or remediation guidance is currently provided by the vendor.

CVE-2026-90516 is a SQL injection vulnerability in SourceCodester School Registration and Fee System version 1.0. The flaw exists in an unspecified function within the file /bilal/normal/pay_report.php, where manipulation of the 'period' argument allows injection. This vulnerability can be exploited remotely without authentication. The exploit code has been publicly disclosed. The CVSS 4.0 base score is 6.9, indicating a medium severity level.

A vulnerability was determined in SourceCodester School Registration and Fee System 1.0. The impacted element is an unknown function of the file /bilal/normal/delete_stud.php. Executing a manipulation of the argument selector[] can lead to sql injection. The attack can be launched remotely. The exploit has been publicly disclosed and may be utilized.