Threat Intelligence Database

A security vulnerability has been detected in SourceCodester School Registration and Fee System 1.0. This impacts an unknown function of the file /bilal/save_class.php. The manipulation of the argument Category leads to sql injection. Remote exploitation of the attack is possible. The exploit has been disclosed publicly and may be used.

A Cross-Site Scripting (XSS) vulnerability in the web backend for the Repetico app 1.9.7.31 for Android allows a remote authenticated user to execute arbitrary JavaScript code in the app's context via crafted input in the multiple-choice question text field.

CVE-2026-76764 is a SQL injection vulnerability in code-projects Employee Management System version 1.0. The flaw exists in an unknown function within the /process/aprocess.php file at the Admin Login Endpoint, where manipulation of the mailuid argument allows SQL injection. This vulnerability can be exploited remotely. An exploit has been published but there is no indication of active exploitation in the wild.

CVE-2026-76762 is a medium severity SQL injection vulnerability in code-projects Assessment Management version 1.0. The flaw exists in an unknown function within the /welcome.php file where the userid argument is improperly handled, allowing remote attackers to inject SQL code. Exploit code is publicly available, but no official patch or remediation guidance has been provided yet.

CVE-2026-76574 is a SQL injection vulnerability in code-projects Hospital Information System version 1.0. It affects the User::login function in includes/users/UsersController.php, allowing remote attackers to manipulate the email argument to perform SQL injection. The vulnerability has a CVSS 4.0 score of 6.9 (medium severity). Exploit code has been published but no known active exploitation in the wild is reported. No patch or official remediation information is provided.

CVE-2026-75778 is a SQL injection vulnerability in code-projects Task Management System version 1.0. The flaw exists in the Operation::select_with_multiple_condition function within the /index.php file of the Login Form component. An attacker can remotely exploit this vulnerability by manipulating the email argument to execute arbitrary SQL commands. The vulnerability has a CVSS 4.0 base score of 6.9, indicating medium severity. Public exploit code is available, but no known active exploitation in the wild has been reported. No patch or remediation information is provided.

A vulnerability was found in SourceCodester Photo Share Website 1.0. This affects an unknown function of the file /social/ajax.php?action=signup. Performing a manipulation of the argument email results in sql injection. Remote exploitation of the attack is possible. The exploit has been made public and could be used.

SourceCodester Photo Share Website 1.0 contains a vulnerability in the /social/ajax.php?action=save_upload endpoint. Manipulation of the img[] or imgName[] arguments allows unrestricted file upload. The vulnerability can be exploited remotely and public exploit details are available. No patch or remediation information is currently provided.

A security vulnerability has been detected in PHPGurukul Company Visitor Management System 1.0. This issue affects some unknown processing of the file /manage-newvisitors.php. The manipulation of the argument fullname leads to cross site scripting. The attack can be initiated remotely. The exploit has been disclosed publicly and may be used.

A vulnerability was determined in itsourcecode Electronic Judging System 1.0. Impacted is an unknown function of the file /intrams/admin/add_judges.php. This manipulation of the argument fname causes sql injection. The attack may be initiated remotely. The exploit has been publicly disclosed and may be utilized.