Threat database

A vulnerability was detected in FastAdmin 1.6.1.20250430/1.6.5.20260602. This affects an unknown function of the file application/database.php of the component Database Management. The manipulation results in execution with unnecessary privileges. The attack may be launched remotely. The exploit is now public and may be used.

CVE-2026-90526 is a SQL injection vulnerability in SourceCodester School Registration and Fee System version 1.0. It arises from improper handling of the 'Category' parameter in the /bilal/save_class.php file, allowing remote attackers to inject SQL commands. The vulnerability has a medium severity with a CVSS score of 6.9. Exploit code has been publicly disclosed, but no known active exploitation in the wild is reported. No official patch or remediation guidance is currently provided by the vendor.

CVE-2025-63842 is a Cross-Site Scripting (XSS) vulnerability in the Repetico web backend version 1.9.7.31 for Android. It allows a remote authenticated user to execute arbitrary JavaScript code via crafted input in the multiple-choice question text field. The vulnerability affects versions up to 2026-06-30. The CVSS score is 5.4, indicating medium severity. No official patch or remediation details are provided in the available data.

CVE-2026-76764 is a SQL injection vulnerability in code-projects Employee Management System version 1.0. The flaw exists in an unknown function within the /process/aprocess.php file at the Admin Login Endpoint, where manipulation of the mailuid argument allows SQL injection. This vulnerability can be exploited remotely. An exploit has been published but there is no indication of active exploitation in the wild.

CVE-2026-76762 is a medium severity SQL injection vulnerability in code-projects Assessment Management version 1.0. The flaw exists in an unknown function within the /welcome.php file where the userid argument is improperly handled, allowing remote attackers to inject SQL code. Exploit code is publicly available, but no official patch or remediation guidance has been provided yet.

CVE-2026-76574 is a SQL injection vulnerability in code-projects Hospital Information System version 1.0. It affects the User::login function in includes/users/UsersController.php, allowing remote attackers to manipulate the email argument to perform SQL injection. The vulnerability has a CVSS 4.0 score of 6.9 (medium severity). Exploit code has been published but no known active exploitation in the wild is reported. No patch or official remediation information is provided.

CVE-2026-75778 is a SQL injection vulnerability in code-projects Task Management System version 1.0. The flaw exists in the Operation::select_with_multiple_condition function within the /index.php file of the Login Form component. An attacker can remotely exploit this vulnerability by manipulating the email argument to execute arbitrary SQL commands. The vulnerability has a CVSS 4.0 base score of 6.9, indicating medium severity. Public exploit code is available, but no known active exploitation in the wild has been reported. No patch or remediation information is provided.

A vulnerability was found in SourceCodester Photo Share Website 1.0. This affects an unknown function of the file /social/ajax.php?action=signup. Performing a manipulation of the argument email results in sql injection. Remote exploitation of the attack is possible. The exploit has been made public and could be used.

SourceCodester Photo Share Website 1.0 contains a vulnerability in the /social/ajax.php?action=save_upload endpoint. Manipulation of the img[] or imgName[] arguments allows unrestricted file upload. The vulnerability can be exploited remotely and public exploit details are available. No patch or remediation information is currently provided.

A security vulnerability has been detected in PHPGurukul Company Visitor Management System 1.0. This issue affects some unknown processing of the file /manage-newvisitors.php. The manipulation of the argument fullname leads to cross site scripting. The attack can be initiated remotely. The exploit has been disclosed publicly and may be used.

A vulnerability was determined in itsourcecode Electronic Judging System 1.0. Impacted is an unknown function of the file /intrams/admin/add_judges.php. This manipulation of the argument fname causes sql injection. The attack may be initiated remotely. The exploit has been publicly disclosed and may be utilized.

A vulnerability was determined in CodeAstro Apartment Visitor Management System 1.0. This vulnerability affects unknown code of the file /apartment-visitor/edit-apartment.php. Executing a manipulation of the argument editid can lead to sql injection. It is possible to launch the attack remotely. The exploit has been publicly disclosed and may be utilized.

A vulnerability was found in CodeAstro Human Resource Management System 1.0. Impacted is an unknown function. The manipulation results in cross-site request forgery. The attack may be launched remotely. The exploit has been made public and could be used.

A flaw has been found in CodeAstro Human Resource Management System 1.0. This vulnerability affects the function GetFileInfo of the file hrsystem/application/models/Employee_model.php of the component View Endpoint. Executing a manipulation of the argument ID can lead to sql injection. The attack can be launched remotely. The exploit has been published and may be used.

A vulnerability was detected in CodeAstro Human Resource Management System 1.0. This issue affects the function emselectByCode of the file application/models/Employee_model.php of the component Update_Earn_Leave Endpoint. The manipulation of the argument emid results in sql injection. The attack can be launched remotely. The exploit is now public and may be used.

A vulnerability was identified in CodeAstro Human Resource Management System 1.0. Affected by this issue is some unknown functionality of the file /dashboard/add_tod of the component Dashboard Interface. The manipulation of the argument todo_data leads to cross site scripting. The attack may be initiated remotely. The exploit is publicly available and might be used.

A security flaw has been discovered in projectworlds Online Art Gallery Shop Project 1.0. The impacted element is an unknown function of the file /admin/adminHome.ph. The manipulation of the argument social_twitter results in sql injection. The attack may be launched remotely. The exploit has been released to the public and may be used for attacks.

A vulnerability was identified in itsourcecode Content Management System 1.0. This vulnerability affects unknown code of the file /save_comment.php. The manipulation of the argument Name leads to sql injection. Remote exploitation of the attack is possible. The exploit is publicly available and might be used.

A weakness has been identified in CodeAstro Leave Management System 1.0. The affected element is an unknown function of the file /admin/add_staff.php. Executing a manipulation of the argument email_id can lead to sql injection. The attack can be launched remotely. The exploit has been made available to the public and could be used for attacks.

CVE-2026-8097 is a medium severity SQL injection vulnerability in CodeAstro Online Classroom version 1.0. The flaw exists in the /askquery.php file where the squeryx parameter can be manipulated to perform SQL injection attacks remotely. The vulnerability has been publicly disclosed, but no official patch or remediation guidance is currently available from the vendor. Exploits have not been observed in the wild to date.