Threat database

CVE-2026-9575 is a medium severity SQL injection vulnerability in itsourcecode Student Transcript Processing System version 1.0. The issue arises from improper handling of the 'ID' parameter in the /admin/modules/class/index.php? view=view endpoint, allowing remote attackers to inject SQL commands. The vulnerability has been publicly disclosed, but no official patch or remediation guidance is currently available.

CVE-2026-9574 is a medium-severity SQL injection vulnerability in itsourcecode Student Transcript Processing System version 1.0. The flaw exists in the /admin/modules/student/trans.php file, where manipulation of the studentId or cid parameters can lead to SQL injection. The vulnerability can be exploited remotely without authentication. Although an exploit has been published, there is no confirmed patch or official remediation available at this time.

A vulnerability has been found in itsourcecode Electronic Judging System 1.0. This affects an unknown part of the file /intrams/admin/login.php. The manipulation of the argument Username leads to sql injection. Remote exploitation of the attack is possible. The exploit has been disclosed to the public and may be used.

A vulnerability was identified in itsourcecode Electronic Judging System 1.0. This affects an unknown part of the file /intrams/login.php. Such manipulation of the argument Username leads to sql injection. The attack can be launched remotely. The exploit is publicly available and might be used.

CVE-2026-5256 is a medium severity SQL injection vulnerability in version 1.0 of code-projects Simple Laundry System. The flaw exists in the /modify.php file within the Parameter Handler component, where manipulation of the firstName argument can lead to SQL injection. This vulnerability can be exploited remotely without authentication or user interaction. Although an exploit has been published, there are no known exploits observed in the wild. No official patch or remediation guidance is currently available from the vendor.

A vulnerability was detected in code-projects Simple Laundry System 1.0. This affects an unknown part of the file /delstaffinfo.php of the component Parameter Handler. The manipulation of the argument userid results in cross site scripting. The attack may be launched remotely. The exploit is now public and may be used.

ZenTaoPMS v18.11 through v21.6.beta is vulnerable to Directory Traversal in /module/ai/control.php. This allows attackers to execute arbitrary code via a crafted file upload

A vulnerability was found in itsourcecode Directory Management System 1.0. Affected by this issue is some unknown functionality of the file /admin/forget-password.php. The manipulation of the argument email results in sql injection. The attack can be launched remotely. The exploit has been made public and could be used.

A vulnerability was found in itsourcecode Online Cake Ordering System 1.0. This issue affects some unknown processing of the file /admindetail.php?action=edit. The manipulation of the argument ID results in sql injection. The attack may be launched remotely. The exploit has been made public and could be used.