Threat Intelligence Database

CVE-2026-9607 is a medium-severity SQL injection vulnerability in itsourcecode Courier Management System version 1.0. The flaw exists in an unknown function within the /parcel_list.php file, where manipulation of the 's' argument allows remote attackers to perform SQL injection. The vulnerability has been publicly disclosed, and an exploit is available, but there are no known exploits observed in the wild yet. No official patch or remediation guidance has been provided by the vendor at this time.

CVE-2026-7822 is a medium severity SQL injection vulnerability in itsourcecode Courier Management System version 1.0. The issue exists in the /print_pdets.php file where the 'ids' parameter can be manipulated to execute unauthorized SQL commands. This vulnerability can be exploited remotely without user interaction and an exploit is publicly available. No official patch or remediation guidance has been provided by the vendor as of the publication date.

A vulnerability was determined in itsourcecode Courier Management System 1.0. Affected is an unknown function of the file /edit_user.php. Executing a manipulation of the argument ID can lead to sql injection. The attack may be performed from remote. The exploit has been publicly disclosed and may be utilized.

A weakness has been identified in itsourcecode Courier Management System 1.0. This affects an unknown function of the file /edit_staff.php. Executing a manipulation of the argument ID can lead to sql injection. The attack may be launched remotely. The exploit has been made available to the public and could be used for attacks.

A vulnerability was identified in itsourcecode Courier Management System 1.0. The affected element is an unknown function of the file /edit_parcel.php. The manipulation of the argument ID leads to sql injection. The attack can be initiated remotely. The exploit is publicly available and might be used.

CVE-2026-7076 is a SQL injection vulnerability in itsourcecode Courier Management System version 1.0. The issue exists in an unspecified function within the /edit_branch.php file, where manipulation of the ID parameter can lead to SQL injection. This vulnerability can be exploited remotely without authentication. The exploit has been publicly disclosed, but no official patch or remediation guidance is currently available. The vulnerability is rated with a medium severity and a CVSS 4.0 base score of 6.9.

A weakness has been identified in code-projects Courier Management System 1.0. This affects an unknown function of the file /add-office.php. This manipulation of the argument OfficeName causes sql injection. The attack may be initiated remotely. The exploit has been made available to the public and could be exploited.

MediumVulnerabilityGermanyFranceUnited Kingdom+4#cve#cve-2025-13396

CVE-2025-13302 is a medium-severity SQL injection vulnerability affecting version 1.0 of the code-projects Courier Management System. The flaw exists in the /add-new-officer.php file, where the ManagerName parameter is improperly sanitized, allowing remote attackers to inject malicious SQL commands. Exploitation requires no user interaction but does require high privileges, limiting attack vectors. Although no known exploits are currently in the wild, a public exploit is available, increasing risk. The vulnerability could lead to unauthorized data access or modification, impacting confidentiality, integrity, and availability of the system. European organizations using this software, especially logistics and courier services, could face data breaches or operational disruptions. Mitigation involves applying patches when available, implementing strict input validation, and restricting database user privileges. Countries with significant logistics sectors and adoption of this software, such as Germany, France, and the UK, are most likely to be affected.

MediumVulnerabilityGermanyFranceNetherlands+3#cve#cve-2025-13302

A vulnerability was identified in code-projects Courier Management System 1.0. This impacts an unknown function of the file /courier/edit-courier.php. The manipulation of the argument OfficeName leads to sql injection. The attack is possible to be carried out remotely. The exploit is publicly available and might be used.

MediumVulnerabilityGermanyFranceUnited Kingdom+4#cve#cve-2025-12316

A vulnerability was found in Campcodes Courier Management System 1.0. It has been declared as critical. This vulnerability affects unknown code of the file /view_parcel.php. The manipulation of the argument ID leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.

MediumVulnerabilityGermanyFranceUnited Kingdom+4#cve#cve-2025-8254