Threat database

A vulnerability was identified in code-projects Hotel and Tourism Reservation System 1.0. This issue affects the function password_verify of the file /admin/login.php of the component Admin Login. Such manipulation of the argument Password leads to improper authentication. It is possible to launch the attack remotely. The exploit is publicly available and might be used.

A vulnerability has been found in code-projects Real State Services 1.0. This impacts an unknown function of the file /loginuser.php of the component Login. The manipulation of the argument Username leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.

A security vulnerability has been detected in code-projects Smart Parking System 1.0. Affected is an unknown function of the component Admin Endpoint. Such manipulation leads to missing authentication. It is possible to launch the attack remotely. The exploit has been disclosed publicly and may be used. Multiple endpoints are affected.

A vulnerability has been found in code-projects Online Hospital Management System 1.0. Affected is an unknown function of the file appointmentdetail.php of the component Appointment Handler. The manipulation of the argument editid leads to sql injection. The attack is possible to be carried out remotely. The exploit has been disclosed to the public and may be used.

A flaw has been found in code-projects Online Hospital Management System 1.php. This impacts the function login_user of the file login_1.php. Executing a manipulation of the argument Username can lead to sql injection. The attack can be executed remotely. The exploit has been published and may be used.

CVE-2026-10186 is a medium severity SQL injection vulnerability in code-projects Online Hospital Management System version 1.0. The vulnerability exists in the /patient.php file where manipulation of the 'editid' parameter allows remote attackers to perform SQL injection. This vulnerability has been publicly disclosed but no official patch or remediation guidance is currently available from the vendor. Exploitation could lead to unauthorized database access or modification.

CVE-2026-10178 is a SQL injection vulnerability in code-projects Online Music Site version 1.0. It affects the /Administrator/PHP/AdminEditAlbum.php file, where manipulation of the ID parameter allows injection of SQL commands. The vulnerability can be exploited remotely without authentication. The exploit code is publicly available. No official patch or remediation guidance has been provided yet.

CVE-2026-10171 is a SQL injection vulnerability in code-projects Online Music Site version 1.0. It affects an unspecified part of the /Administrator/PHP/AdminUpdateAlbum.php file, where manipulation of the ID argument can lead to SQL injection. The vulnerability can be exploited remotely without user interaction. The exploit details have been publicly disclosed. No official patch or remediation guidance is currently available.

A flaw has been found in code-projects Visitor Management System 1.0. Affected by this issue is some unknown functionality of the file /vms/php/phone_0.php. This manipulation of the argument phone causes sql injection. The attack may be initiated remotely. The exploit has been published and may be used.

A vulnerability was detected in code-projects Student Details Management System 1.0. This affects an unknown function of the file /index.php. Performing a manipulation of the argument roll results in sql injection. The attack is possible to be carried out remotely. The exploit is now public and may be used.

A security vulnerability has been detected in code-projects Project Management System 1.0. Affected is an unknown function of the file chk.php of the component Login. The manipulation leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed publicly and may be used.

CVE-2026-9451 is a medium severity SQL injection vulnerability in version 1.0 of the code-projects Employee Management System. The vulnerability exists in an unspecified functionality within the /process/applyleaveprocess.php file, where manipulation of the ID argument can lead to SQL injection. The vulnerability can be exploited remotely without user interaction and requires low privileges. Although an exploit is publicly available, there are no known exploits observed in the wild. No official patch or remediation guidance has been provided by the vendor at this time.

CVE-2026-9450 is a medium severity SQL injection vulnerability in code-projects Employee Management System version 1.0. The flaw exists in an unknown function within the /psubmit.php file, where manipulation of the 'pid' argument allows remote attackers to perform SQL injection. The vulnerability is publicly known, and an exploit has been released, but there are no confirmed reports of exploitation in the wild. No official patch or remediation guidance has been provided by the vendor at this time.

CVE-2026-9449 is a medium severity SQL injection vulnerability in version 1.0 of the code-projects Employee Management System. The flaw exists in an unspecified function within the /changepassemp.php file and can be exploited remotely without user interaction. The vulnerability allows an attacker to manipulate SQL queries, potentially compromising the database. No official patch or remediation guidance is currently available from the vendor. Exploit code is publicly available, but there are no confirmed reports of exploitation in the wild.

A vulnerability was determined in code-projects Employee Management System 1.0. This affects an unknown function of the file /applyleave.php. Executing a manipulation of the argument ID can lead to cross site scripting. The attack may be performed from remote. The exploit has been publicly disclosed and may be utilized.

CVE-2026-9419 is a cross-site scripting (XSS) vulnerability in version 1.0 of the code-projects Employee Management System. The issue arises from improper handling of the 'ID' argument in the /empproject.php file, allowing remote attackers to inject malicious scripts. The vulnerability has been publicly disclosed but no official patch or remediation guidance is currently available. The CVSS 4.0 base score is 5.3, indicating a medium severity level.

A flaw has been found in code-projects Employee Management System 1.0. Affected by this vulnerability is an unknown functionality of the file /changepassemp.php. Executing a manipulation of the argument ID can lead to cross site scripting. The attack may be performed from remote. The exploit has been published and may be used.

CVE-2026-9417 is a cross-site scripting (XSS) vulnerability in code-projects Employee Management System version 1.0. The issue exists in an unspecified function within the /myprofileup.php file, where manipulation of the ID argument allows remote attackers to execute XSS attacks. The vulnerability has a medium severity rating with a CVSS 4.0 score of 5.3. No official patch or remediation guidance is currently available, and no known exploits are reported in the wild.

A security vulnerability has been detected in code-projects Employee Management System 1.0. This impacts an unknown function of the file /myprofile.php. Such manipulation of the argument ID leads to cross site scripting. The attack can be executed remotely. The exploit has been disclosed publicly and may be used.

CVE-2026-9415 is a cross-site scripting (XSS) vulnerability in version 1.0 of the code-projects Employee Management System. The issue arises from improper handling of the 'ID' argument in the /eloginwel.php file, allowing remote attackers to inject malicious scripts. The vulnerability has a medium severity rating with a CVSS score of 5.3. Although an exploit is publicly available, there are no known active exploits in the wild. No official patch or remediation guidance has been provided by the vendor at this time.