Threat database

CVE-2026-78198 is a SQL injection vulnerability in SourceCodester Simple Online Food Ordering System version 1.0. The vulnerability exists in the processing of the 'pid' parameter in the /fos/admin/ajax.php?action=add_to_cart endpoint. This flaw allows remote attackers to manipulate SQL queries via the 'pid' argument. The vulnerability has a medium severity score of 6.9 and has been publicly disclosed. No official patch or remediation information is provided.

CVE-2026-78197 is a SQL injection vulnerability in SourceCodester Simple Online Food Ordering System version 1.0. The flaw exists in the /fos/admin/ajax.php?action=save_user endpoint, where manipulation of the Username parameter can lead to SQL injection. This vulnerability can be exploited remotely without authentication. Public exploit code is available, increasing the risk of exploitation. The vulnerability has a CVSS 4.0 base score of 6.9, indicating medium severity.

CVE-2026-78115 is an improper authorization vulnerability in SourceCodester Class and Exam Timetabling System version 1.0. It affects the /admin/edit_user_account.php file's User Account Update component, where manipulation of the id or username parameters can bypass authorization controls. The vulnerability can be exploited remotely without user interaction. Public exploit details have been disclosed. The vulnerability has a medium severity rating with a CVSS 4.0 score of 5.3.

CVE-2026-78060 is a cross-site scripting (XSS) vulnerability in SourceCodester Stock Management System version 1.0. The vulnerability occurs due to improper handling of the clientName and clientContact parameters in the /php_action/getOrderReport.php file. An attacker can exploit this remotely by manipulating these parameters to execute malicious scripts in the context of the affected application. The vulnerability has a medium severity rating with a CVSS score of 5.3. Public exploit code is available, but there are no known exploits in the wild at this time.

CVE-2026-78059 is a cross-site scripting (XSS) vulnerability in SourceCodester Stock Management System version 1.0. The flaw exists in the /php_action/printOrder.php file where the clientName or clientContact parameters can be manipulated to inject malicious scripts. This vulnerability can be exploited remotely and requires user interaction. The vulnerability has a medium severity rating with a CVSS score of 5.3. Public exploit code has been disclosed, but there are no known exploits in the wild at this time.

CVE-2026-78055 is a cross-site scripting (XSS) vulnerability in SourceCodester Class and Exam Timetabling System version 1.0. The vulnerability exists in the /BSIT2.php file where the 'course' parameter can be manipulated to execute malicious scripts. This flaw allows remote attackers to perform XSS attacks. The vulnerability has a medium severity rating with a CVSS score of 5.3. Public exploit code has been disclosed, but no known active exploitation in the wild is reported. No patch or official remediation has been provided yet.

CVE-2026-78054 is a medium severity cross-site scripting (XSS) vulnerability in SourceCodester Class and Exam Timetabling System version 1.0. The vulnerability arises from improper handling of the 'course' argument in the /BSIS1.php file, allowing remote attackers to inject malicious scripts. Exploitation requires user interaction. Public exploit code exists for this vulnerability.

CVE-2026-77392 is a medium severity SQL injection vulnerability affecting SourceCodester Dynamic Input Field Generator Using HTML, CSS, and PHP version 1.0. The flaw exists in the saveUser function within the /public/submit.php file, where the 'Researcher' argument can be manipulated by remote attackers to perform SQL injection. Public exploit code is available, but no official patch or fix has been provided by the vendor.

CVE-2026-77391 is a cross-site request forgery (CSRF) vulnerability affecting SourceCodester Dynamic Input Field Generator Using HTML, CSS, and PHP version 1.0. This flaw allows remote attackers to trick authenticated users into submitting unauthorized requests. The vulnerability has a medium severity with a CVSS score of 5.3. Exploit code is publicly available, but no official patch or remediation has been released yet.

A vulnerability was detected in SourceCodester CET Automated Grading System with AI Predictive Analytics 1.0. This affects the function add_grade of the file /index.php. Performing a manipulation of the argument student_id results in improper authorization. The attack can be initiated remotely.

CVE-2026-76998 is a SQL injection vulnerability in SourceCodester Simple Online Food Ordering System version 1.0. The flaw exists in the /admin/ajax.php?action=delete_category endpoint where manipulation of the ID parameter allows SQL injection. This vulnerability can be exploited remotely without authentication. Public exploit code has been disclosed. The CVSS 4.0 base score is 6.9, indicating a medium severity risk.

CVE-2026-76997 is a SQL injection vulnerability in SourceCodester Simple Online Food Ordering System version 1.0. The vulnerability exists in the /admin/ajax.php?action=save_category endpoint, where manipulation of the ID parameter allows remote attackers to perform SQL injection. The exploit code is publicly available. The vulnerability has a medium severity rating with a CVSS score of 5.3.

CVE-2026-76996 is a medium severity SQL injection vulnerability in SourceCodester Simple Online Food Ordering System version 1.0. The flaw exists in the /fos/admin/view_order.php file where the ID parameter can be manipulated to perform SQL injection attacks remotely. Exploit code has been publicly released, increasing the risk of exploitation. No official patch or remediation guidance is currently provided.

A vulnerability was identified in SourceCodester Simple Online Food Ordering System 1.0. This issue affects some unknown processing of the file /admin/ajax.php?action=save_menu. The manipulation of the argument img leads to unrestricted upload. The attack is possible to be carried out remotely. The exploit is publicly available and might be used.

CVE-2026-76050 is a SQL injection vulnerability in SourceCodester Simple Online Food Ordering System version 1.0. The issue exists in the /admin/ajax.php file when handling the delete_menu action via the ID parameter. This vulnerability allows remote attackers to manipulate the ID argument to execute unauthorized SQL commands. The exploit code has been publicly disclosed. The vulnerability has a CVSS 4.0 base score of 6.9, indicating a medium severity level.

CVE-2026-76049 is a SQL injection vulnerability in SourceCodester Simple Online Food Ordering System version 1.0. The flaw exists in the /admin/ajax.php?action=save_menu endpoint where manipulation of the ID parameter allows remote attackers to execute SQL injection. The vulnerability has a CVSS score of 6.9 (medium severity) and public exploit details have been disclosed. No official patch or remediation information is provided.