Threat database

CVE-2026-86221 is a SQL injection vulnerability in SourceCodester Class and Exam Timetabling System version 1.0. The flaw exists in the mysqli_query function within the /admin/modal_add_course1.php file, where manipulation of the 'course' argument allows injection. This vulnerability can be exploited remotely without authentication. An exploit has been published, but there are no known reports of active exploitation in the wild. The vulnerability has a CVSS 4.0 base score of 6.9, indicating medium severity.

CVE-2026-86220 is a SQL injection vulnerability in SourceCodester Class and Exam Timetabling System version 1.0. The flaw exists in the mysqli_query function within the /admin/modal_add_course.php file, where the 'course' argument is improperly sanitized. This vulnerability allows remote attackers to inject SQL commands. The exploit code for this vulnerability is publicly available. The CVSS 4.0 base score is 6.9, indicating a medium severity level.

A security vulnerability has been detected in SourceCodester Class and Exam Timetabling System 1.0. Affected by this vulnerability is an unknown functionality of the file /delete_user_account.php. Such manipulation of the argument ID leads to sql injection. The attack may be launched remotely. The exploit has been disclosed publicly and may be used.

CVE-2026-86209 is a SQL injection vulnerability in SourceCodester Class and Exam Timetabling System version 1.0. The flaw exists in the /delete_user.php file where manipulation of the ID parameter allows injection of malicious SQL code. This vulnerability can be exploited remotely without authentication. The exploit code has been publicly disclosed. The CVSS 4.0 base score is 6.9, indicating a medium severity risk.

A security flaw has been discovered in SourceCodester Class and Exam Timetabling System 1.0. This impacts an unknown function of the file /delete_teacher.php. The manipulation of the argument ID results in sql injection. The attack can be launched remotely. The exploit has been released to the public and may be used for attacks.

CVE-2026-86162 is a medium severity SQL injection vulnerability in SourceCodester Online Voting System version 1.0. It affects the /ajax.php?action=login endpoint by allowing remote attackers to manipulate the Username parameter to execute SQL injection. The vulnerability has been publicly disclosed, but no official patch or remediation guidance is currently provided.

A vulnerability was found in SourceCodester Online Voting System 1.0. The impacted element is an unknown function of the file /ajax.php?action=delete_category. Performing a manipulation of the argument ID results in sql injection. Remote exploitation of the attack is possible. The exploit has been made public and could be used.

CVE-2026-86160 is a SQL injection vulnerability in SourceCodester Online Voting System version 1.0. The flaw exists in the /ajax.php?action=delete_voting endpoint where manipulation of the ID parameter allows injection of SQL commands. This vulnerability can be exploited remotely without authentication. The exploit has been publicly disclosed. The CVSS 4.0 base score is 6.9, indicating a medium severity risk.

CVE-2026-86159 is a SQL injection vulnerability in SourceCodester Online Voting System version 1.0. The flaw exists in the /ajax.php?action=save_user endpoint, where manipulation of the ID parameter allows injection of malicious SQL code. This vulnerability can be exploited remotely without authentication. The exploit code has been published publicly. The CVSS 4.0 base score is 6.9, indicating a medium severity level.

A security flaw has been discovered in SourceCodester Class and Exam Timetabling System 1.0. This vulnerability affects unknown code of the file /admin/session.php. The manipulation of the argument ID results in missing authorization. The attack can be executed remotely. The exploit has been released to the public and may be used for attacks.

SourceCodester Queue Management System version 1.0 contains a cross-site scripting (XSS) vulnerability in the /api/add_customer.php endpoint. The vulnerability arises from improper handling of the 'Name' parameter, allowing remote attackers to inject malicious scripts. The vulnerability has a medium severity score of 5.3 and an exploit has been published, though no known active exploitation in the wild is reported. No official patch or remediation guidance is currently available.

SourceCodester Simple Online Food Ordering System version 1.0 contains a SQL injection vulnerability in the /admin/ajax.php?action=login2 endpoint. The vulnerability arises from improper handling of the 'email' parameter, allowing remote attackers to inject SQL code. This issue has a CVSS 4.0 base score of 6.9, indicating medium severity. No official patch or remediation guidance is currently available, and no known exploits are reported in the wild.

CVE-2026-78248 is a SQL injection vulnerability in SourceCodester Simple Online Food Ordering System version 1.0. It affects an unknown function in the file /fos/admin/ajax.php when handling the 'Name' argument. The vulnerability allows remote attackers to manipulate SQL queries. The exploit has been publicly disclosed but there are no known exploits in the wild. The vulnerability has a medium severity rating with a CVSS 4.0 score of 6.9.

CVE-2026-78247 is a SQL injection vulnerability in SourceCodester Simple Online Food Ordering System version 1.0. It arises from improper handling of the 'ID' parameter in the /fos/admin/ajax.php?action=confirm_order endpoint. This vulnerability allows remote attackers to manipulate SQL queries, potentially compromising the database. The vulnerability has a medium severity rating with a CVSS score of 6.9. Exploit code has been publicly disclosed, but no known active exploitation in the wild has been reported. No official patch or remediation guidance is currently provided.

CVE-2026-78199 is a medium severity SQL injection vulnerability in SourceCodester Simple Online Food Ordering System version 1.0. The flaw exists in the /fos/view_prod.php file where manipulation of the ID parameter allows remote attackers to perform SQL injection. Exploit code is publicly available, but no official patch or remediation guidance has been provided.

SourceCodester Simple Online Food Ordering System version 1.0 contains a SQL injection vulnerability in the /fos/admin/ajax.php?action=add_to_cart endpoint. The flaw is due to improper handling of the pid parameter, allowing remote attackers to manipulate SQL queries. This vulnerability has a CVSS 3.1 base score of 7.3, indicating medium severity. No official patch or remediation guidance is currently available. Public exploit details have been disclosed, but no known exploits are reported in the wild.