Threat Intelligence Database

A flaw has been found in code-projects Online Food Order System 1.0. The impacted element is an unknown function of the file delete_food_items1.php. Executing a manipulation of the argument checkbox can lead to sql injection. The attack can be executed remotely. The exploit has been published and may be used.

A vulnerability was identified in code-projects Online Examination 1.0. This affects an unknown part of the file /update.php?q=addquiz of the component Quiz Creation Feature. The manipulation of the argument name/total/right/wrong/time/tag/desc leads to sql injection. The attack can be initiated remotely. The exploit is publicly available and might be used.

A vulnerability was detected in code-projects Internship Management System 1.0. This affects an unknown function of the file employer/details/change_password.php of the component Password Change Endpoint. The manipulation of the argument Current results in sql injection. The attack can be executed remotely. The exploit is now public and may be used.

CVE-2026-9451 is a medium severity SQL injection vulnerability in version 1.0 of the code-projects Employee Management System. The vulnerability exists in an unspecified functionality within the /process/applyleaveprocess.php file, where manipulation of the ID argument can lead to SQL injection. The vulnerability can be exploited remotely without user interaction and requires low privileges. Although an exploit is publicly available, there are no known exploits observed in the wild. No official patch or remediation guidance has been provided by the vendor at this time.

CVE-2026-9450 is a medium severity SQL injection vulnerability in code-projects Employee Management System version 1.0. The flaw exists in an unknown function within the /psubmit.php file, where manipulation of the 'pid' argument allows remote attackers to perform SQL injection. The vulnerability is publicly known, and an exploit has been released, but there are no confirmed reports of exploitation in the wild. No official patch or remediation guidance has been provided by the vendor at this time.

CVE-2026-9419 is a cross-site scripting (XSS) vulnerability in version 1.0 of the code-projects Employee Management System. The issue arises from improper handling of the 'ID' argument in the /empproject.php file, allowing remote attackers to inject malicious scripts. The vulnerability has been publicly disclosed but no official patch or remediation guidance is currently available. The CVSS 4.0 base score is 5.3, indicating a medium severity level.

CVE-2026-9417 is a cross-site scripting (XSS) vulnerability in code-projects Employee Management System version 1.0. The issue exists in an unspecified function within the /myprofileup.php file, where manipulation of the ID argument allows remote attackers to execute XSS attacks. The vulnerability has a medium severity rating with a CVSS 4.0 score of 5.3. No official patch or remediation guidance is currently available, and no known exploits are reported in the wild.

A security vulnerability has been detected in code-projects Employee Management System 1.0. This impacts an unknown function of the file /myprofile.php. Such manipulation of the argument ID leads to cross site scripting. The attack can be executed remotely. The exploit has been disclosed publicly and may be used.

CVE-2026-9415 is a cross-site scripting (XSS) vulnerability in version 1.0 of the code-projects Employee Management System. The issue arises from improper handling of the 'ID' argument in the /eloginwel.php file, allowing remote attackers to inject malicious scripts. The vulnerability has a medium severity rating with a CVSS score of 5.3. Although an exploit is publicly available, there are no known active exploits in the wild. No official patch or remediation guidance has been provided by the vendor at this time.

A vulnerability was identified in code-projects Employee Management System 1.0. This vulnerability affects unknown code of the file 370project/delete.php. Such manipulation of the argument ID leads to sql injection. The attack may be launched remotely. The exploit is publicly available and might be used.