Threat database

CVE-2026-104625 is a medium severity SQL injection vulnerability in CodeAstro Simple Loan Management System version 1.0. The flaw exists in an unknown function within /admin/index.php, where manipulation of the g_name argument allows SQL injection. The vulnerability can be exploited remotely without user interaction. Public exploit code has been released, increasing the risk of attacks. No patch or official remediation information is currently available.

CVE-2026-94048 is a medium severity vulnerability in CodeAstro QR Code Attendance Management System version 1.0. It involves improper privilege management in the Save function of app/Controllers/UserController.php, where manipulation of the role_id argument can lead to unauthorized privilege changes. The vulnerability is remotely exploitable and public exploit code is available.

CVE-2026-77681 is a medium severity vulnerability in CodeAstro Online Job Portal version 1.0. It involves an unrestricted file upload issue in the /users/update-profile.php script triggered by manipulation of the Name argument. The vulnerability can be exploited remotely without user interaction. Public exploit code is available, but there are no known active exploitations in the wild. No patch or official remediation information is provided.

CVE-2026-77020 is a medium severity SQL injection vulnerability in CodeAstro Apartment Visitor Management System version 1.0. The flaw exists in the password-recovery.php file where the email parameter is vulnerable to SQL injection. This allows remote attackers to manipulate the SQL query. Exploit code is publicly available, but no confirmed active exploitation is reported.

CVE-2026-77019 is a SQL injection vulnerability in CodeAstro Apartment Visitor Management System version 1.0. The flaw exists in an unspecified function within the /apartment-visitor/forgotpw.php file, where manipulation of the 'secode' argument can lead to SQL injection. This vulnerability can be exploited remotely without authentication. The exploit has been publicly disclosed but there are no known exploits in the wild. The vulnerability has a medium severity rating with a CVSS score of 6.9.

A vulnerability was determined in CodeAstro Online Classroom 1.0. Affected by this issue is some unknown functionality of the file /OnlineClassroom/loginlinkadmin.php. Executing a manipulation of the argument aid can lead to sql injection. The attack can be executed remotely. The exploit has been publicly disclosed and may be utilized.

A vulnerability was detected in CodeAstro Simple Online Leave Management System 1.0. This affects an unknown part of the file /SimpleOnlineLeave/admin/accept.php of the component POST Handler. Performing a manipulation of the argument appid results in sql injection. The attack is possible to be carried out remotely. The exploit is now public and may be used.

A security vulnerability has been detected in CodeAstro Simple Online Leave Management System 1.0. Affected by this issue is some unknown functionality of the file /SimpleOnlineLeave/admin/deletemp.php. Such manipulation of the argument ID leads to sql injection. The attack can be executed remotely. The exploit has been disclosed publicly and may be used.

CodeAstro Simple Online Leave Management System version 1.0 contains a SQL injection vulnerability in the /SimpleOnlineLeave/admin/dashboard.php file. The vulnerability arises from improper handling of the 'Name' argument, allowing remote attackers to manipulate SQL queries. This issue has a medium severity rating with a CVSS score of 5.3. No official patch or remediation guidance is currently available from the vendor. Exploit code has been publicly disclosed, but no known active exploitation in the wild has been reported.

A vulnerability was determined in CodeAstro Simple Online Leave Management System 1.0. Affected by this vulnerability is an unknown functionality of the file /SimpleOnlineLeave/index.php. Executing a manipulation of the argument email can lead to sql injection. The attack may be performed from remote. The exploit has been publicly disclosed and may be utilized.

A security flaw has been discovered in CodeAstro Ecommerce Website 1.0. Impacted is an unknown function of the file /customer/my_account.php?my_wishlist. The manipulation of the argument delete_wishlist results in sql injection. The attack can be launched remotely. The exploit has been released to the public and may be used for attacks.

A vulnerability was identified in CodeAstro Apartment Visitor Management System 1.0. This issue affects some unknown processing of the file /apartment-visitor/visitor-entry.php. The manipulation of the argument visname leads to sql injection. The attack can be initiated remotely. The exploit is publicly available and might be used.

A vulnerability was determined in CodeAstro Apartment Visitor Management System 1.0. This vulnerability affects unknown code of the file /apartment-visitor/edit-apartment.php. Executing a manipulation of the argument editid can lead to sql injection. It is possible to launch the attack remotely. The exploit has been publicly disclosed and may be utilized.

A vulnerability was found in CodeAstro Apartment Visitor Management System 1.0. This affects an unknown part of the file /apartment-visitor/report.php. Performing a manipulation of the argument fromdate results in sql injection. It is possible to initiate the attack remotely. The exploit has been made public and could be used.

A vulnerability has been found in CodeAstro Apartment Visitor Management System 1.0. Affected by this issue is some unknown functionality of the file /apartment-visitor/action-visitor.php. Such manipulation of the argument remark leads to sql injection. The attack may be performed from remote. The exploit has been disclosed to the public and may be used.

A security flaw has been discovered in CodeAstro Ecommerce Website 1.0. This affects an unknown part of the file /ecommerce-website-php/customer/confirm.php of the component POST Parameter Handler. The manipulation of the argument invoice_no results in sql injection. The attack can be executed remotely. The exploit has been released to the public and may be used for attacks.

A vulnerability was identified in CodeAstro Apartment Visitor Management System 1.0. Affected by this issue is some unknown functionality of the file /apartment-visitor/search-result.php of the component POST Parameter Handler. The manipulation of the argument searchdata leads to sql injection. Remote exploitation of the attack is possible. The exploit is publicly available and might be used.

A security flaw has been discovered in CodeAstro Apartment Visitor Management System 1.0. The impacted element is an unknown function of the file /apartment-visitor/add-apartment.php. The manipulation of the argument apartmentno results in sql injection. The attack may be launched remotely. The exploit has been released to the public and may be used for attacks.

A vulnerability was found in CodeAstro Apartment Visitor Management System 1.0. Affected is an unknown function of the file /index.php of the component Login. Performing a manipulation of the argument Username results in sql injection. Remote exploitation of the attack is possible. The exploit has been made public and could be used.