Threat database

A vulnerability was identified in code-projects Online Reviewer System 1.0. The affected element is an unknown function of the file /reviewer/system/system/admins/manage/users/btn_functions.php of the component User Update Handler. Such manipulation leads to sql injection. The attack may be launched remotely. The exploit is publicly available and might be used.

CVE-2026-108948 is a medium severity vulnerability in code-projects Online Reviewer System 1.0. It involves manipulation of the usertype_id argument in the User Profile Update Handler component, leading to dynamically-determined object attributes. The vulnerability can be exploited remotely without user interaction. Public exploit details have been disclosed. No patch or remediation information is currently available.

CVE-2026-108938 is a medium severity vulnerability in code-projects Matrimonial System version 1.0. It allows remote attackers to access files or directories due to improper handling of the file db/matrimony.sql. Exploit code has been published, but no official patch or remediation details are available.

CVE-2026-108937 is a medium-severity vulnerability in code-projects Online Ticket Reservation System version 1.0. It involves file and directory information exposure via the /database/medallion.sql file. The vulnerability can be exploited remotely without authentication or user interaction. Public exploit code is available, but no known active exploitation in the wild has been reported.

A vulnerability was found in code-projects Human Resource Management System 1.0. Affected by this vulnerability is an unknown functionality of the file /views/admin/liveEventHistory.php of the component Live Event History. The manipulation of the argument eventSubject results in cross site scripting. The attack may be launched remotely. The exploit has been made public and could be used.

A flaw has been found in code-projects Human Resource Management 1.0. This affects an unknown part of the file /humanresourcemanagementsystem/src/store/EventStore.php of the component Event Creation. Executing a manipulation of the argument eventSubject can lead to cross site scripting. The attack may be launched remotely. The exploit has been published and may be used.

CVE-2026-93980 is a SQL injection vulnerability in the code-projects Internship Management System version 1.0. It affects the Admin Login Form component, specifically the /admin/login.php file. An attacker can manipulate the Password argument remotely to perform SQL injection. The vulnerability has a CVSS 4.0 base score of 6.9, indicating medium severity. Public exploit code is available, but no known active exploitation in the wild has been reported. No patch or remediation information is provided.

A security flaw has been discovered in code-projects Internship Management System 1.0. This affects an unknown part of the file /employer/login.php. Performing a manipulation of the argument Password results in sql injection. The attack is possible to be carried out remotely. The exploit has been released to the public and may be used for attacks.

CVE-2026-93978 is a SQL injection vulnerability in code-projects Internship Management System version 1.0. The flaw exists in the /login.php file where manipulation of the Password argument allows remote attackers to perform SQL injection. Exploit code is publicly available, but no official patch or remediation guidance has been provided yet.

A vulnerability was determined in code-projects Assessment Management 1.0. Affected by this vulnerability is an unknown functionality of the file lecturer/add-single-mark.php. This manipulation of the argument mark causes cross site scripting. Remote exploitation of the attack is possible. The exploit has been publicly disclosed and may be utilized.

CVE-2026-93976 is a cross-site scripting (XSS) vulnerability in code-projects Assessment Management version 1.0. The flaw exists in an unspecified function within the file admin/add-user.php, where manipulation of the 'level' argument allows remote attackers to inject malicious scripts. The vulnerability has a medium severity rating and an exploit has been publicly disclosed, though no known active exploitation in the wild is reported.

CVE-2026-93975 is a cross-site scripting (XSS) vulnerability in code-projects Assessment Management version 1.0. It affects the admin/edit-user.php file in the User Editing component, where manipulation of parameters such as name, sname, email, username, password, or id can lead to XSS attacks. The vulnerability can be exploited remotely and requires high privileges with user interaction. The exploit has been publicly disclosed.

CVE-2026-92926 is a SQL injection vulnerability in code-projects Matrimonial System version 1.0. It affects the writepartnerprefs function in the /partner_preference.php file, where manipulation of the education argument can lead to SQL injection. The vulnerability can be exploited remotely without authentication. Public exploit code has been disclosed. The CVSS 4.0 base score is 6.9, indicating a medium severity.

A vulnerability was determined in code-projects Matrimonial System 1.0. This affects an unknown part of the file /search.php of the component Regular Search. This manipulation of the argument sex/mothertongue/maritialstatus/country/state/religion/agemin/agemax causes sql injection. The attack can be initiated remotely. The exploit has been publicly disclosed and may be utilized.

A vulnerability was identified in code-projects Record Management System 1.0. Affected is an unknown function of the file main/reg.php. Such manipulation of the argument desc leads to cross site scripting. The attack may be launched remotely. The exploit is publicly available and might be used.

A vulnerability was found in code-projects Student Crud Operation 1.0. This impacts an unknown function of the file /card_activation.sql of the component Backup File Handler. The manipulation results in information disclosure. The attack can be launched remotely. The exploit has been made public and could be used.

A vulnerability has been found in code-projects Student Crud Operation 1.0. This affects an unknown function of the file /edit.php. The manipulation of the argument ID leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.

A vulnerability was found in code-projects Hospital Information System 1.0. Affected by this vulnerability is an unknown functionality of the file /HIS/his.sql of the component SQL Database Backup File Handler. Performing a manipulation results in information disclosure. Remote exploitation of the attack is possible. The exploit has been made public and could be used.

CVE-2026-86301 is a medium severity cross-site scripting (XSS) vulnerability in code-projects Hospital Information System version 1.0. The flaw exists in an unknown function within the /HIS/src/patients/editPatient.php file of the Patient Management component. It allows remote attackers to manipulate the ID argument to execute XSS attacks. The exploit has been publicly disclosed but there is no information about active exploitation in the wild or an available patch.

A vulnerability was detected in code-projects Hotel and Tourism Reservation in PHP 1.0. Affected is an unknown function of the file /ht/hotel_db%20(1).sql of the component Database Backup Handler. The manipulation results in information disclosure. The attack may be launched remotely. The exploit is now public and may be used.