Threat database

SourceCodester Simple Online Food Ordering System version 1.0 contains a SQL injection vulnerability in the /admin/ajax.php?action=login endpoint. The vulnerability arises from improper sanitization of the Username parameter, allowing remote attackers to manipulate SQL queries. An exploit for this vulnerability has been published. The CVSS 4.0 base score is 6.9, indicating a medium severity level.

CVE-2026-75151 is a cross-site request forgery (CSRF) vulnerability affecting SourceCodester Onlne Examination & Learning Management System version 1.0. The vulnerability allows remote attackers to trick authenticated users into performing unwanted actions without their consent. The specific functionality affected is not detailed. The vulnerability has a medium severity rating with a CVSS score of 5.3.

CVE-2026-75080 is a medium severity SQL injection vulnerability in SourceCodester Class and Exam Timetabling System version 1.0. The flaw exists in the /edit_subject1.php file where the ID parameter is improperly handled, allowing remote attackers to inject SQL commands. This vulnerability has a CVSS score of 6.9 and has been publicly disclosed, though no known exploits are reported in the wild. No official patch or remediation guidance is currently available from the vendor.

CVE-2026-75079 is a SQL injection vulnerability in SourceCodester Class and Exam Timetabling System version 1.0. The issue exists in the /edit_subject2.php file where manipulation of the ID parameter can lead to SQL injection. This vulnerability can be exploited remotely without authentication. Public exploit code is available, increasing the risk of exploitation.

CVE-2026-75078 is a cross-site scripting (XSS) vulnerability in SourceCodester Class and Exam Timetabling System version 1.0. The flaw exists in the /BSHRM1.php file where manipulation of the 'course' argument allows injection of malicious scripts. This vulnerability can be exploited remotely and requires user interaction. Public exploit code has been released. The vulnerability has a medium severity rating with a CVSS score of 5.3.

CVE-2026-75077 is a cross-site scripting (XSS) vulnerability in SourceCodester Class and Exam Timetabling System version 1.0. The issue exists in the /BSCE2.php file where manipulation of the 'course' argument allows remote attackers to inject malicious scripts. The vulnerability has a medium severity score of 5.3 and requires user interaction to exploit. No official patch or remediation guidance is currently available.

A flaw has been found in SourceCodester Pet Grooming Management Software 1.0. This vulnerability affects unknown code of the file /admin/get_barcode_data.php. This manipulation of the argument barcode causes sql injection. The attack may be initiated remotely. The exploit has been published and may be used.

SourceCodester Best Employee Management System version 1.0 contains a vulnerability that allows remote attackers to obtain information through directory listing in the /assets/uploadImage/Profile/ directory. This exposure could reveal sensitive files or data stored in that directory. The vulnerability has a medium severity rating with a CVSS score of 6.9. No official patch or remediation guidance is currently available from the vendor.

A vulnerability was detected in SourceCodester Stock Management System 1.0. This issue affects some unknown processing of the file /classes/Master.php?f=delete_supplier. The manipulation of the argument ID results in sql injection. The attack may be launched remotely. The exploit is now public and may be used.

A vulnerability was found in SourceCodester Online Book Store System 1.0. This vulnerability affects unknown code of the file /admin/index.php?page=site_settings of the component System Settings Module. The manipulation results in cross site scripting. The attack can be executed remotely. The exploit has been made public and could be used.

A vulnerability has been found in SourceCodester Online Clothing Store 1.0. This affects an unknown part of the file /db/shopping.sql of the component SQL Database Backup. The manipulation leads to files or directories accessible. Remote exploitation of the attack is possible. The exploit has been disclosed to the public and may be used.

CVE-2026-19899 is a SQL injection vulnerability in SourceCodester Class and Exam Timetabling System version 1.0. It affects an unknown function in the /edit_teacher.php file, where manipulation of the ID argument can lead to SQL injection. The vulnerability can be exploited remotely without authentication. The exploit has been publicly disclosed but there are no known exploits in the wild. The severity is rated medium with a CVSS score of 6.9.

A vulnerability was detected in SourceCodester Simple Doctors Appointment System 1.0. This issue affects the function save_doctor of the file /save_file.php. The manipulation results in unrestricted upload. The attack can be executed remotely. The exploit is now public and may be used.

SourceCodester Simple Client Management System version 1.0 contains a SQL injection vulnerability in the save_service function within the /classes/Master.php file. The vulnerability arises from improper handling of the ID argument, allowing remote attackers to inject SQL commands. This vulnerability has a medium severity with a CVSS score of 6.9. There is no official patch or remediation guidance currently available from the vendor. Exploit code has been publicly disclosed but there are no known exploits in the wild at this time.

A vulnerability was determined in SourceCodester Air Cargo Management System 1.0. Impacted is an unknown function of the file /classes/Master.php?f=save_cargo_type. Executing a manipulation of the argument ID can lead to sql injection. The attack can be executed remotely. The exploit has been publicly disclosed and may be utilized.

CVE-2026-19710 is a SQL injection vulnerability in SourceCodester Simple Student Information System affecting an unknown functionality in app/admin/departments/view_department.php. The vulnerability allows remote attackers to manipulate the ID argument to perform SQL injection. Exploit code has been publicly disclosed. The vulnerability has a CVSS 4.0 base score of 6.9, indicating medium severity.

CVE-2026-19384 is a SQL injection vulnerability in SourceCodester Simple Doctors Appointment System version 1.0. The flaw exists in an unknown function within /admin/ajax.php?action=set_appointment, where manipulation of the ID parameter allows injection. This vulnerability can be exploited remotely without authentication. Public exploit code is available, increasing the risk of attack. The vulnerability has a medium severity rating with a CVSS score of 6.9.