Threat database

A vulnerability was determined in code-projects Employee Management System 1.0. This affects an unknown part of the file 370project/edit.php. This manipulation of the argument ID causes sql injection. The attack may be initiated remotely. The exploit has been publicly disclosed and may be utilized.

A flaw has been found in code-projects Invoice System in Laravel 1.0. Affected is an unknown function of the file /item. Executing a manipulation of the argument item name/description can lead to cross site scripting. It is possible to launch the attack remotely. The exploit has been published and may be used.

A vulnerability was detected in code-projects Invoice System in Laravel 1.0. This impacts an unknown function of the file /item of the component API Endpoint. Performing a manipulation results in improper authorization. It is possible to initiate the attack remotely. The exploit is now public and may be used.

A security vulnerability has been detected in code-projects Invoice System in Laravel 1.0. This affects an unknown function. Such manipulation leads to cross-site request forgery. The attack may be performed from remote. The exploit has been disclosed publicly and may be used.

A weakness has been identified in code-projects Invoice System in Laravel 1.0. The impacted element is an unknown function of the file /company. This manipulation of the argument logo causes unrestricted upload. The attack is possible to be carried out remotely. The exploit has been made available to the public and could be used for attacks.

A vulnerability was determined in code-projects Chat System 1.0. Affected is an unknown function of the file update_user.php of the component MD5 Hash Handler. This manipulation of the argument Password causes use of weak hash. The attack is possible to be carried out remotely. The attack's complexity is rated as high. The exploitability is told to be difficult. The exploit has been publicly disclosed and may be utilized.

A vulnerability was identified in code-projects Employee Management System 1.0. This affects an unknown part of the file 370project/edit.php. The manipulation of the argument ID leads to cross site scripting. It is possible to initiate the attack remotely. The exploit is publicly available and might be used.

CVE-2026-7093 is a medium-severity vulnerability in version 1.0 of the code-projects Invoice System built on Laravel. It involves improper authorization in an unspecified functionality within the /invoice/ endpoint, where manipulating the ID argument can bypass authorization controls. The vulnerability can be exploited remotely without user interaction. Although an exploit has been publicly disclosed, no official patch or remediation guidance is currently available from the vendor.

A vulnerability has been found in code-projects Invoice System in Laravel 1.0. Affected is an unknown function of the file /profile/ of the component Profile Handler. Such manipulation of the argument ID leads to improper authorization. The attack can be executed remotely. The exploit has been disclosed to the public and may be used.

CVE-2026-7091 is a medium-severity vulnerability in code-projects Invoice System in Laravel version 1.0. It involves improper authorization in an unspecified function within the /user file of the User Management Handler component. This flaw allows remote attackers to exploit the system without proper authorization. Although an exploit has been published, there are no known exploits observed in the wild. No official patch or remediation guidance is currently available from the vendor.

CVE-2026-7090 is a medium severity cross-site scripting (XSS) vulnerability in code-projects Chat System version 1.0. It affects the /admin/send_message.php file where the 'msg' parameter can be manipulated to inject malicious scripts. The vulnerability can be exploited remotely and requires user interaction with elevated privileges. No official patch or remediation guidance is currently available, and no known exploits are reported in the wild.

CVE-2026-7089 is a medium severity cross-site scripting (XSS) vulnerability in code-projects Home Service System version 1.0. The vulnerability exists in an unknown function within the /booking.php file of the Appointment Booking component. It is triggered by manipulation of the fname or lname arguments. The vulnerability can be exploited remotely and requires user interaction. There is no official patch or remediation guidance provided at this time. Public exploit details have been disclosed, but no known active exploitation in the wild has been reported.

CVE-2026-7070 is a medium severity SQL injection vulnerability in version 1.0 of the code-projects Inventory Management System. The vulnerability exists in an unknown function within the Login component, where manipulation of the Username argument can lead to SQL injection. The vulnerability can be exploited remotely without authentication. Although an exploit is publicly available, there are no known exploits observed in the wild. No official patch or remediation guidance has been provided yet.

CVE-2026-7063 is a medium severity SQL injection vulnerability in code-projects Employee Management System version 1.0. It affects the /370project/process/eprocess.php endpoint by allowing remote attackers to manipulate the 'pwd' argument to perform SQL injection. The vulnerability is publicly known but there is no confirmed patch or official remediation available at this time.

A security flaw has been discovered in code-projects Easy Blog Site 1.0. This affects an unknown function of the file post.php. Performing a manipulation of the argument tags results in sql injection. The attack may be initiated remotely. The exploit has been released to the public and may be used for attacks.

A weakness has been identified in code-projects Simple Content Management System 1.0. This affects an unknown part of the file /web/admin/welcome.php. Executing a manipulation of the argument News Title can lead to cross site scripting. The attack can be executed remotely. The exploit has been made available to the public and could be used for attacks.

A security flaw has been discovered in code-projects Simple Content Management System 1.0. Affected by this issue is some unknown functionality of the file /web/index.php. Performing a manipulation of the argument ID results in sql injection. Remote exploitation of the attack is possible. The exploit has been released to the public and may be used for attacks.

CVE-2026-6182 is a medium-severity SQL injection vulnerability in code-projects Simple Content Management System version 1.0. It affects an unspecified functionality in the /web/admin/login.php file where manipulation of the User argument can lead to SQL injection. The vulnerability can be exploited remotely without authentication. Although an exploit is publicly available, there are no known exploits observed in the wild. No official patch or remediation guidance has been provided yet.

A vulnerability was detected in code-projects Faculty Management System 1.0. Impacted is an unknown function of the file /subject-print.php. The manipulation of the argument ID results in sql injection. The attack may be launched remotely. The exploit is now public and may be used.

A security vulnerability has been detected in code-projects Vehicle Showroom Management System 1.0. This issue affects some unknown processing of the file /util/UpdateVehicleFunction.php. The manipulation of the argument VEHICLE_ID leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed publicly and may be used.