A security flaw has been discovered in code-projects Internship Management System 1.0. This affects an unknown part of the file /employer/login.php. Performing a manipulation of the argument Password results in sql injection. The attack is possible to be carried out remotely. The exploit has been released to the public and may be used for attacks.
A flaw has been found in code-projects Online Food Order System 1.0. The impacted element is an unknown function of the file delete_food_items1.php. Executing a manipulation of the argument checkbox can lead to sql injection. The attack can be executed remotely. The exploit has been published and may be used.
A vulnerability was identified in code-projects Online Examination 1.0. This affects an unknown part of the file /update.php?q=addquiz of the component Quiz Creation Feature. The manipulation of the argument name/total/right/wrong/time/tag/desc leads to sql injection. The attack can be initiated remotely. The exploit is publicly available and might be used.
A vulnerability was detected in code-projects Internship Management System 1.0. This affects an unknown function of the file employer/details/change_password.php of the component Password Change Endpoint. The manipulation of the argument Current results in sql injection. The attack can be executed remotely. The exploit is now public and may be used.
CVE-2026-9451 is a medium severity SQL injection vulnerability in version 1.0 of the code-projects Employee Management System. The vulnerability exists in an unspecified functionality within the /process/applyleaveprocess.php file, where manipulation of the ID argument can lead to SQL injection. The vulnerability can be exploited remotely without user interaction and requires low privileges. Although an exploit is publicly available, there are no known exploits observed in the wild. No official patch or remediation guidance has been provided by the vendor at this time.
CVE-2026-9450 is a medium severity SQL injection vulnerability in code-projects Employee Management System version 1.0. The flaw exists in an unknown function within the /psubmit.php file, where manipulation of the 'pid' argument allows remote attackers to perform SQL injection. The vulnerability is publicly known, and an exploit has been released, but there are no confirmed reports of exploitation in the wild. No official patch or remediation guidance has been provided by the vendor at this time.
CVE-2026-9419 is a cross-site scripting (XSS) vulnerability in version 1.0 of the code-projects Employee Management System. The issue arises from improper handling of the 'ID' argument in the /empproject.php file, allowing remote attackers to inject malicious scripts. The vulnerability has been publicly disclosed but no official patch or remediation guidance is currently available. The CVSS 4.0 base score is 5.3, indicating a medium severity level.
CVE-2026-9417 is a cross-site scripting (XSS) vulnerability in code-projects Employee Management System version 1.0. The issue exists in an unspecified function within the /myprofileup.php file, where manipulation of the ID argument allows remote attackers to execute XSS attacks. The vulnerability has a medium severity rating with a CVSS 4.0 score of 5.3. No official patch or remediation guidance is currently available, and no known exploits are reported in the wild.
A security vulnerability has been detected in code-projects Employee Management System 1.0. This impacts an unknown function of the file /myprofile.php. Such manipulation of the argument ID leads to cross site scripting. The attack can be executed remotely. The exploit has been disclosed publicly and may be used.
CVE-2026-9415 is a cross-site scripting (XSS) vulnerability in version 1.0 of the code-projects Employee Management System. The issue arises from improper handling of the 'ID' argument in the /eloginwel.php file, allowing remote attackers to inject malicious scripts. The vulnerability has a medium severity rating with a CVSS score of 5.3. Although an exploit is publicly available, there are no known active exploits in the wild. No official patch or remediation guidance has been provided by the vendor at this time.
A vulnerability was identified in code-projects Employee Management System 1.0. This vulnerability affects unknown code of the file 370project/delete.php. Such manipulation of the argument ID leads to sql injection. The attack may be launched remotely. The exploit is publicly available and might be used.
A vulnerability was determined in code-projects Employee Management System 1.0. This affects an unknown part of the file 370project/edit.php. This manipulation of the argument ID causes sql injection. The attack may be initiated remotely. The exploit has been publicly disclosed and may be utilized.
CVE-2026-4842 is a medium severity SQL injection vulnerability in itsourcecode Online Enrollment System version 1.0. The vulnerability exists in the Parameter Handler component, specifically in the /sms/grades/index.php file when handling the 'deptid' argument. This flaw allows remote attackers to manipulate SQL queries via the deptid parameter. The vulnerability has been publicly disclosed, but no known exploits are currently reported in the wild. No patch or official remediation information is available at this time.
A weakness has been identified in itsourcecode Online Enrollment System 1.0. This vulnerability affects unknown code of the file /sms/user/index.php?view=add of the component Parameter Handler. Executing a manipulation of the argument Name can lead to sql injection. The attack may be performed from remote. The exploit has been made available to the public and could be used for attacks.
CVE-2026-4557 is a medium severity cross-site scripting (XSS) vulnerability found in code-projects Exam Form Submission version 1.0. The flaw exists in the /admin/update_s1.php file where the sname parameter is improperly sanitized, allowing remote attackers to inject malicious scripts. Exploitation does not require authentication but does require user interaction, such as tricking an administrator into clicking a crafted link. The vulnerability could lead to session hijacking, defacement, or redirection to malicious sites. No patches are currently available, and no known exploits are actively used in the wild. Organizations using this product should prioritize input validation and consider restricting access to the vulnerable admin interface. Countries with significant use of this software or similar educational platforms may be more at risk.
A vulnerability classified as critical has been found in code-projects Online Shoe Store 1.0. This affects an unknown part of the file /admin/confirm.php. The manipulation of the argument ID leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.
A vulnerability was found in code-projects Online Shoe Store 1.0. It has been rated as critical. Affected by this issue is some unknown functionality of the file /admin/admin_running.php. The manipulation of the argument qty leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used.
A vulnerability was found in code-projects Online Shoe Store 1.0. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the file /cart2.php. The manipulation of the argument ID leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used.
SQL injection vulnerability in processscore.php in Learning Management System Project In PHP With Source Code 1.0 allows attackers to execute arbitrary SQL commands via the id parameter.