Threat database

CVE-2026-114267 is a medium severity vulnerability in SourceCodester Food Order Management System version 1.0. It involves missing authorization in an admin endpoint, allowing remote attackers to perform unauthorized actions. The exploit is publicly available, but no official patch or remediation details are provided.

A vulnerability was found in SourceCodester Inventory System 1.0. This issue affects some unknown processing of the file /api/transactions_handler.php?action=save_sale of the component Sales Management Handler. The manipulation of the argument Hsn_Code results in cross site scripting. It is possible to launch the attack remotely.

A vulnerability has been found in SourceCodester Inventory System 1.0. This vulnerability affects unknown code of the file /api/transactions_handler.php?action=save_purchase of the component Purchase Records Handler. The manipulation of the argument Product_Name/Product_Code/Vendor_Name leads to cross site scripting. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.

A flaw has been found in SourceCodester Inventory System 1.0. This affects an unknown part of the file /api/products_handler.php?action=save of the component Product Management. Executing a manipulation of the argument Product_Id/Product_Name can lead to cross site scripting. The attack may be performed from remote. The exploit has been published and may be used.

CVE-2026-109620 is a medium severity SQL injection vulnerability in SourceCodester Online Reviewer System version 1.0. The flaw exists in the PDO::prepare function within the login/index.php file, allowing remote attackers to manipulate username or password parameters to execute SQL injection attacks. The vulnerability has been publicly disclosed, but no known exploits are currently reported in the wild. No official patch or remediation guidance is provided in the available data.

CVE-2026-109607 is a SQL injection vulnerability in SourceCodester Online Exam System version 1.0. The flaw exists in the login endpoint script adminpanel/admin/query/loginExe.php, where manipulation of the username or password parameters allows remote attackers to perform SQL injection. The vulnerability has a CVSS 4.0 base score of 6.9, indicating medium severity. Exploit code has been published, but no known active exploitation in the wild is reported. No patch or official remediation information is currently available.

A vulnerability was detected in SourceCodester Art Gallery Management System 1.0. This impacts the function Action::save_user of the file admin/admin_class.php of the component Account Creation. The manipulation of the argument Name results in sql injection. The attack may be performed from remote. The exploit is now public and may be used.

CVE-2026-109605 is a medium severity vulnerability in SourceCodester Simple Cafe Billing System 1.0. It involves improper authorization in the User Management component, specifically in the Action::save_user function of admin_class.php. The vulnerability arises from manipulation of the 'Type' argument, allowing unauthorized actions remotely. The exploit has been publicly disclosed but no known active exploitation is reported.

CVE-2026-108975 is a medium-severity vulnerability in SourceCodester Library Management System version 1.0. It involves an unrestricted file upload flaw in the move_uploaded_file function within admin/add_admin.php. This vulnerability allows remote attackers to upload files without proper restrictions. Public exploit code is available, increasing the risk of exploitation.

CVE-2026-108974 is a vulnerability in SourceCodester E-Learning System version 1.0 that allows unrestricted file upload via manipulation of the img argument in the save_users function of /classes/Users.php. This vulnerability can be exploited remotely and has a medium severity rating with a CVSS score of 6.9. Exploit code is publicly available, but there are no known exploits in the wild. No patch or remediation information is currently provided.

A vulnerability was determined in SourceCodester Contact Tracing System 1.0. Affected by this issue is the function move_uploaded_file of the file /classes/Users.php?f=save. This manipulation of the argument img/id causes unrestricted upload. The attack can be initiated remotely. The exploit has been publicly disclosed and may be utilized.

CVE-2026-108972 is an improper authentication vulnerability in SourceCodester Human Resource Management System version 1.0. The flaw exists in the session_start function within controller/employee.php, where manipulation of the role, pfimg, or EmpId parameters can bypass authentication controls. The vulnerability is remotely exploitable and has a publicly available exploit. It has a medium severity rating with a CVSS 4.0 score of 6.9.

CVE-2026-108968 is a SQL injection vulnerability in SourceCodester Performance Indicator System version 1.0. The flaw exists in an unknown function within the file /opils/staff/sales_history.php, where manipulation of the ID argument allows injection. This vulnerability can be exploited remotely without authentication. Public exploit code is available, increasing the risk of attack. The CVSS 4.0 base score is 6.9, indicating a medium severity level.

CVE-2026-108967 is a SQL injection vulnerability in SourceCodester Performance Indicator System version 1.0. The flaw exists in the /opils/staff/edit_credit.php file where the 'credit' parameter is improperly sanitized, allowing remote attackers to inject SQL commands. This vulnerability has a CVSS 4.0 base score of 6.9, indicating a medium severity. Exploit code for this vulnerability has been publicly released, increasing the risk of attack. No official patch or remediation guidance is currently provided by the vendor.

CVE-2026-108966 is a SQL injection vulnerability in SourceCodester Performance Indicator System version 1.0. The issue arises from improper handling of the 'Category' argument in the /opils/staff/product.php file, allowing remote attackers to inject SQL commands. The vulnerability has a CVSS 4.0 base score of 6.9, indicating a medium severity level. Exploit code is publicly available, but there are no confirmed reports of active exploitation in the wild. No patch or official remediation has been provided yet.

A vulnerability was determined in SourceCodester Performance Indicator System 1.0. This vulnerability affects unknown code of the file /opils/staff/edit_quantity.php. Executing a manipulation of the argument pqty can lead to sql injection. The attack can be launched remotely. The exploit has been publicly disclosed and may be utilized.

CVE-2026-108964 is a medium severity SQL injection vulnerability in SourceCodester Performance Indicator System version 1.0. The flaw exists in the /opils/admin/addproduct.php file, where manipulation of the prodcategory parameter allows remote attackers to perform SQL injection. The vulnerability has a CVSS 4.0 base score of 6.9. Exploit code has been publicly disclosed, but no known active exploitation in the wild has been reported. No official patch or remediation guidance is currently provided.

CVE-2026-108920 is a cross-site scripting (XSS) vulnerability in SourceCodester Drug Recommendation System version 1.0. It affects the Admin/user_record.php file in the Admin Record Tables component, where manipulation of the name or email argument can lead to XSS. The vulnerability can be exploited remotely and has been publicly disclosed.

CVE-2026-108919 is a cross-site scripting (XSS) vulnerability in SourceCodester Drug Recommendation System version 1.0. The vulnerability exists in an unknown function within the Auth/add_student.php file, specifically in the Student Registration component. It involves manipulation of input parameters such as txtname, txtpassword, txtemail, txtphone, and txtprevious_school. The vulnerability can be exploited remotely and public exploit code is available. The CVSS 4.0 base score is 5.3, indicating medium severity.

CVE-2026-105957 is a medium severity SQL injection vulnerability in SourceCodester Performance Indicator System version 1.0. The flaw exists in an unspecified function within the file /opils/admin/view_product.php, where manipulation of the 'Category' argument allows SQL injection. The vulnerability can be exploited remotely without user interaction and requires low privileges. Public exploit code is available, but no official patch or remediation guidance has been provided yet.