Description Summary:
The Online Shopping System version 1.0 contains a time-based blind SQL injection vulnerability in the search functionality, allowing unauthenticated remote attackers to extract backend database data.

Executive Summary:
An unauthenticated SQL injection vulnerability in Code-Projects Online Shopping System version 1.0 allows remote attackers to compromise sensitive database information.

Vulnerability Details

CVE-ID: CVE-2026-82701

Affected Software: Code-Projects Online Shopping System

Affected Versions: 1.0

Vulnerability: This is a time-based blind SQL injection flaw located in the search functionality at the /action.php endpoint. By manipulating the unauthenticated keyword parameter, an attacker can execute arbitrary SQL expressions and infer database content through observable variations in server response times.

Business Impact

Successful exploitation of this vulnerability can lead to the unauthorized extraction of sensitive data stored in the database, including user records, administrator credentials, and order history. Given the CVSS score of 7.3, this represents a significant risk to data confidentiality and application integrity, potentially leading to widespread account compromise and severe reputational damage.

Remediation Plan

Immediate Action: There is currently no official vendor patch available. Administrators should restrict access to the /action.php endpoint or disable the search functionality until a secure update is provided by the vendor.

Proactive Monitoring: Review web server and database access logs for unusual patterns, such as repeated requests to /action.php containing SQL syntax, or anomalous response times associated with search queries.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to detect and block SQL injection patterns, specifically targeting the keyword parameter in POST requests.

Exploitation Status

Public Exploit Available: Yes, a proof-of-concept exists as documented in the security researcher's write-up published on GitHub.

Analyst Notes: As of September 1, 2026, there is no information confirming active exploitation in the wild; however, a functional proof-of-concept is publicly available via the researcher's technical disclosure. The vulnerability is inherently exploitable due to the lack of input sanitization and the failure to utilize parameterized queries when interacting with the database.

Analyst Recommendation

This vulnerability presents a high risk due to its accessibility to unauthenticated users and the availability of public exploit documentation. Organizations utilizing this software must prioritize the implementation of compensating controls, such as WAF filtering, and monitor for unauthorized activity while awaiting an official security update from the vendor.

Description Summary:
A SQL injection vulnerability in the Barangay Resident Profiling Management System 1.0 allows remote attackers to bypass authorization via the ID parameter in /boarders.php.

Executive Summary:
A critical SQL injection vulnerability in the Barangay Resident Profiling Management System 1.0 allows unauthenticated remote attackers to bypass authorization controls.

Vulnerability Details

CVE-ID: CVE-2026-78143

Affected Software: code-projects Barangay Resident Profiling Management System

Affected Versions: 1.0

Vulnerability: The application is susceptible to a SQL injection attack due to improper sanitization of the ID argument within the /boarders.php file of the Boarder Management Module. This flaw permits unauthenticated remote attackers to manipulate database queries and bypass authorization mechanisms.

Business Impact

The vulnerability carries a CVSS score of 7.3, indicating a high risk of unauthorized access and potential data compromise. Successful exploitation could allow an attacker to extract sensitive resident information, modify database records, or manipulate system logic, leading to significant reputational damage and a loss of data integrity within the management system.

Remediation Plan

Immediate Action: There is no official patch currently available; administrators should restrict network access to the /boarders.php endpoint and implement strict input validation for the ID parameter.

Proactive Monitoring: Monitor server access logs for unusual patterns or SQL syntax fragments originating from the ID parameter.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules specifically configured to detect and block SQL injection attempts targeting the affected application.

Exploitation Status

Public Exploit Available: Yes, a public exploit is available via the provided reference links.

Analyst Notes: As of August 24, 2026, there is no public information indicating active exploitation in the wild, though the existence of a public exploit significantly increases the risk of opportunistic attacks.

Analyst Recommendation

Due to the high severity and the availability of public exploit code, this vulnerability poses a credible threat. Administrators are urged to apply rigorous input filtering immediately and limit access to the affected module to authorized personnel only until a formal vendor patch is released.

Description Summary:
A SQL injection vulnerability in code-projects Online Hospital Management System 1.0 allows unauthenticated remote attackers to execute arbitrary database queries via the delid parameter in viewappointment.php.

Executive Summary:
An unauthenticated SQL injection vulnerability in code-projects Online Hospital Management System 1.0 allows remote attackers to manipulate database queries via the delid parameter in viewappointment.php, posing a severe risk of data compromise and record destruction.

Vulnerability Details

CVE-ID: CVE-2026-7632

Affected Software: code-projects Online Hospital Management System

Affected Versions: code-projects Online Hospital Management System: 1.0

Vulnerability: This vulnerability is an SQL injection flaw (CWE-89) located in the viewappointment.php file. The unauthenticated attacker can supply malicious input via the delid parameter, which is directly concatenated into a SQL query without sanitization or parameterized protection.

Business Impact

Successful exploitation permits malicious actors to execute arbitrary database commands, leading to unauthorized data extraction, extraction of sensitive admin credentials, and the mass deletion of appointment records. These actions can result in severe data loss, operational downtime, and a compromise of patient confidentiality. The CVSS score of 7.3 reflects the high severity of enabling unauthenticated remote data manipulation.

Remediation Plan

Immediate Action: Refactor the vulnerable viewappointment.php script to use prepared statements and parameterized queries for the delid parameter, and implement strict session-based authentication checks before processing any deletion logic.

Proactive Monitoring: Monitor web server access logs for anomalous GET requests targeting viewappointment.php, particularly those containing SQL syntax characters such as single quotes or sleep functions.

Compensating Controls: Deploy a Web Application Firewall (WAF) rule to inspect and block inbound HTTP requests to viewappointment.php containing suspicious SQL injection patterns in the delid parameter.

Exploitation Status

Public Exploit Available: Yes, a public exploit and detailed technical write-up are available on GitHub via the researcher references.

Analyst Notes: As of May 4, 2026, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The lack of input sanitization and authentication checks makes this flaw trivially exploitable by remote actors.

Analyst Recommendation

Security teams must treat this vulnerability with high urgency due to the availability of public proof-of-concept exploit code and the complete lack of authentication requirements. Immediate code modification to adopt prepared statements and robust access controls is required to protect the application environment.

Description Summary:
A buffer overflow vulnerability in the TOTOLINK A800R router allows remote attackers to execute arbitrary code or cause a denial of service via the setWiFiMultipleConfig interface.

Executive Summary:
A critical remote buffer overflow vulnerability in the TOTOLINK A800R router allows unauthenticated or low-privileged attackers to achieve arbitrary code execution via the web interface.

Vulnerability Details

CVE-ID: CVE-2026-7503

Affected Software: TOTOLINK A800R

Affected Versions: V4.1.2cu.5137_B20200730

Vulnerability: This is a stack-based buffer overflow occurring in the setWiFiMultipleConfig function within the wireless.so library. An attacker can supply a specially crafted wepkey2 parameter that exceeds the 68-byte buffer limit, allowing for the overwriting of return addresses and subsequent control flow hijacking.

Business Impact

The ability for an attacker to execute arbitrary code remotely on network infrastructure poses a severe risk to organizational security. Successful exploitation could lead to full device compromise, allowing attackers to intercept network traffic, pivot into internal segments, or render the device inoperable, resulting in significant service disruption. With a CVSS score of 8.8, this vulnerability represents a high-severity threat that requires immediate attention to prevent unauthorized access to the network perimeter.

Remediation Plan

Immediate Action: There is currently no official patch available for the affected firmware version. Users should restrict access to the web management interface to trusted internal segments only and disable remote management features until the vendor releases a firmware update.

Proactive Monitoring: Monitor network traffic for unusual POST requests directed at the /cgi-bin/cstecgi.cgi endpoint, particularly those containing excessively long strings in the wepkey2 parameter.

Compensating Controls: Deploy a Web Application Firewall (WAF) or an Intrusion Prevention System (IPS) rule to inspect and block HTTP requests to the cstecgi.cgi endpoint that contain oversized parameters.

Exploitation Status

Public Exploit Available: Yes, a published proof-of-concept exists and is attributed to the technical write-up provided by the researcher.

Analyst Notes: As of May 2, 2026, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The vulnerability is highly exploitable as it does not require complex authentication bypasses, relying instead on simple memory corruption techniques.

Analyst Recommendation

Given the availability of a public proof-of-concept and the critical nature of remote code execution, organizations utilizing the TOTOLINK A800R must prioritize the isolation of these devices. Administrators should ensure that the management interface is not exposed to the public internet and verify that firmware update notifications from the vendor are monitored closely for a resolution to this memory corruption flaw.

Description Summary:
The Online Lot Reservation System version 1.0 is vulnerable to SQL injection in the loginuser.php file, allowing unauthenticated attackers to bypass authentication and access the system.

Executive Summary:
A critical SQL injection vulnerability in the code-projects Online Lot Reservation System allows unauthenticated attackers to bypass authentication and gain unauthorized access to the application.

Vulnerability Details

CVE-ID: CVE-2026-7131

Affected Software: code-projects Online Lot Reservation System

Affected Versions: 1.0

Vulnerability: The application is susceptible to SQL injection via the email and password parameters in the loginuser.php file. This flaw permits an unauthenticated attacker to manipulate database queries to bypass login mechanisms entirely.

Business Impact

The ability for an unauthenticated user to bypass authentication protocols poses a severe risk to data integrity and confidentiality. Successful exploitation allows unauthorized access to administrative or user accounts, potentially leading to full system compromise and the exposure of sensitive reservation data. With a CVSS score of 7.3, this high-severity vulnerability warrants immediate attention to prevent unauthorized data access and potential service disruption.

Remediation Plan

Immediate Action: As no official patch is currently available, administrators should restrict network access to the loginuser.php endpoint or disable the affected module entirely until a secure update is released by the vendor.

Proactive Monitoring: Security teams should monitor web server access logs for anomalous POST requests to loginuser.php, specifically identifying patterns involving SQL syntax characters like single quotes and comment indicators.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to detect and block common SQL injection payloads targeting the login parameters.

Exploitation Status

Public Exploit Available: Yes, a published proof-of-concept exists, attributed to the security researcher's technical write-up provided in the referenced GitHub repository.

Analyst Notes: As of April 29, 2026, there is no confirmed active exploitation in the wild; however, a functional proof-of-concept is publicly available, which significantly lowers the barrier for entry for malicious actors. The vulnerability stems from the direct concatenation of user input into database queries.

Analyst Recommendation

Given the availability of a public proof-of-concept and the ease of exploitation, this vulnerability presents a significant risk to any organization running the Online Lot Reservation System. Organizations must prioritize the implementation of compensating controls, such as WAF filtering, and actively seek a secure replacement or vendor-supplied patch to mitigate the risk of unauthorized account takeover.

Description Summary:
A SQL injection vulnerability in the login component of code-projects Inventory Management System 1.0 allows remote, unauthenticated attackers to bypass authentication via the username parameter.

Executive Summary:
A critical SQL injection vulnerability in the code-projects Inventory Management System 1.0 allows unauthenticated attackers to bypass authentication and gain unauthorized system access.

Vulnerability Details

CVE-ID: CVE-2026-7070

Affected Software: code-projects Inventory Management System

Affected Versions: 1.0

Vulnerability: This vulnerability is a SQL injection flaw located in the index.php file of the login component. It permits an unauthenticated attacker to manipulate the username parameter to bypass authentication controls and log in as any user.

Business Impact

Successful exploitation of this flaw allows an unauthorized actor to bypass authentication mechanisms entirely. This creates a high risk of unauthorized data access, potential administrative control over the inventory management application, and loss of data integrity. With a CVSS score of 7.3, this represents a significant threat to internal business operations that rely on this software for tracking assets.

Remediation Plan

Immediate Action: Since no official vendor patch is currently available, administrators should restrict network access to the login portal using IP allowlisting or VPN requirements.

Proactive Monitoring: Review web server access logs for anomalous SQL syntax, such as single quotes, dashes, or SQL keywords within the username field of login requests.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to detect and block SQL injection patterns targeting the login endpoint.

Exploitation Status

Public Exploit Available: Yes — a public proof-of-concept is documented in the referenced GitHub repository.

Analyst Notes: As of April 28, 2026, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The vulnerability is highly accessible, as it requires no prior authentication to trigger via a crafted HTTP request.

Analyst Recommendation

Given the availability of a public proof-of-concept and the ease of exploitation, this vulnerability poses a clear risk to any organization hosting this software. Organizations should prioritize isolating the affected application from public-facing networks until a vendor-supplied patch is released and applied.

Description Summary:
The Code-Projects Employee Management System 1.0 is vulnerable to an unauthenticated SQL injection via the mailuid parameter in the /370project/process/eprocess.php endpoint.

Executive Summary:
An unauthenticated SQL injection vulnerability in the Code-Projects Employee Management System allows remote attackers to bypass authentication and execute arbitrary database commands.

Vulnerability Details

CVE-ID: CVE-2026-7063

Affected Software: Code-Projects Employee Management System

Affected Versions: 1.0

Vulnerability: The application is susceptible to a time-based SQL injection vulnerability within the authentication logic. An unauthenticated attacker can inject malicious SQL payloads into the mailuid parameter via an HTTP POST request to the /370project/process/eprocess.php endpoint, which is processed without proper sanitization or parameterized queries.

Business Impact

Successful exploitation of this vulnerability allows an attacker to bypass authentication, extract sensitive employee data, modify or delete records, and potentially achieve full control over the application database. Given the CVSS score of 7.3, this represents a significant risk to data confidentiality and integrity, as the flaw is remotely exploitable without requiring any prior system access.

Remediation Plan

Immediate Action: As there is no official vendor patch available, administrators should immediately restrict access to the /370project/process/eprocess.php endpoint or take the application offline until the source code can be manually hardened using prepared statements.

Proactive Monitoring: Security teams should monitor web server logs for anomalous POST requests to the login endpoint, specifically looking for SQL syntax patterns or unexpected time delays in server responses.

Compensating Controls: Deploy a Web Application Firewall (WAF) configured with rules to detect and block common SQL injection patterns, specifically targeting the mailuid parameter in POST requests.

Exploitation Status

Public Exploit Available: Yes — a published proof-of-concept exists, as documented in the security researcher's write-up hosted on GitHub.

Analyst Notes: As of April 28, 2026, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The vulnerability is inherently easy to exploit due to the lack of input validation on a public-facing authentication endpoint.

Analyst Recommendation

Due to the critical nature of this SQL injection vulnerability and the availability of public proof-of-concept code, immediate remediation is required to prevent unauthorized database access. If the software cannot be patched by implementing prepared statements to handle user input, it should be removed from production environments until a secure version is provided by the vendor.

Description Summary:
An unauthenticated SQL injection vulnerability exists in the index.php file of Simple Content Management System 1.0, allowing remote attackers to extract sensitive database information.

Executive Summary:
An unauthenticated SQL injection vulnerability in Simple Content Management System 1.0 allows remote attackers to perform unauthorized database queries and extract sensitive information.

Vulnerability Details

CVE-ID: CVE-2026-6183

Affected Software: code-projects Simple Content Management System

Affected Versions: 1.0

Vulnerability: This vulnerability is a SQL injection (CWE-89) flaw located in the id parameter of the /web/index.php file. The application fails to properly sanitize user input, allowing an unauthenticated remote attacker to manipulate SQL queries and exfiltrate data from the underlying database.

Business Impact

The exploitation of this flaw poses a severe risk to data confidentiality and integrity. An attacker can leverage this injection to extract administrative credentials, user records, and the entire database content, leading to a full compromise of the application data. While the CVSS score is 7.3, the ability for an unauthenticated attacker to remotely dump the database makes this a high-priority risk for any organization hosting this software.

Remediation Plan

Immediate Action: As no official patch is currently available, administrators should restrict public access to the /web/index.php endpoint or disable the affected installation until a secure version is released.

Proactive Monitoring: Review web server access logs for anomalous GET requests containing SQL syntax, such as UNION, SELECT, or database-specific keywords, directed at the index.php file.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to detect and block common SQL injection patterns targeting the id parameter.

Exploitation Status

Public Exploit Available: Yes, a published proof-of-concept exists as documented in the GitHub repository referenced in the vulnerability details.

Analyst Notes: As of April 14, 2026, there is no confirmed active exploitation in the wild; however, a public proof-of-concept exploit is available, which significantly lowers the barrier for attackers. The vulnerability is inherently easy to exploit because it requires no authentication and targets a common parameter in a publicly accessible script.

Analyst Recommendation

Given the availability of a functional proof-of-concept and the lack of a vendor-provided patch, this vulnerability presents a credible and immediate threat to the confidentiality of your data. Organizations should prioritize isolating the affected system from the public internet and implementing strict input validation via a WAF to mitigate the risk of unauthorized database access.

Description Summary:
A SQL injection vulnerability in the admin login page of Simple Content Management System PHP 1.0 allows unauthenticated remote attackers to bypass authentication and gain administrative access.

Executive Summary:
An unauthenticated SQL injection vulnerability in Simple Content Management System PHP 1.0 allows remote attackers to bypass authentication and gain full administrative control.

Vulnerability Details

CVE-ID: CVE-2026-6182

Affected Software: code-projects Simple Content Management System PHP

Affected Versions: 1.0

Vulnerability: This vulnerability is a SQL injection (CWE-89) flaw located in the /web/admin/login.php file. An unauthenticated attacker can manipulate the user parameter in a POST request to bypass authentication mechanisms and achieve full administrative access.

Business Impact

The ability for an unauthenticated attacker to bypass authentication poses a critical risk to the confidentiality, integrity, and availability of the system. Successful exploitation grants full administrative control, which may lead to unauthorized data modification, content injection, or complete system takeover. While the CVSS score is 7.3, the potential for unauthorized administrative access necessitates immediate attention to prevent compromise.

Remediation Plan

Immediate Action: As no official patch is currently available, administrators should immediately restrict access to the /web/admin/ directory using network-level controls or IP allowlisting to prevent public exposure.

Proactive Monitoring: Review web server access logs for suspicious POST requests to /web/admin/login.php containing SQL injection patterns, such as the use of single quotes or tautological expressions like "or 1=1".

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to detect and block SQL injection attempts targeting the user parameter on the login endpoint.

Exploitation Status

Public Exploit Available: Yes, a published proof-of-concept exists as documented in the researcher's GitHub repository.

Analyst Notes: As of April 14, 2026, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The vulnerability is trivial to exploit as it requires no prior authentication and uses standard SQL injection techniques.

Analyst Recommendation

Given that this vulnerability allows for complete authentication bypass and administrative takeover, it represents a significant security risk. Administrators must prioritize isolating the affected management interface from public access until a secure update is provided by the vendor.

Description Summary:
A SQL injection vulnerability in code-projects Faculty Management System 1.0 allows remote attackers to manipulate the ID argument in subject-print.php.

Executive Summary:
The Faculty Management System 1.0 is vulnerable to unauthenticated SQL injection, posing a risk of unauthorized database interaction.

Vulnerability Details

CVE-ID: CVE-2026-6167

Affected Software: code-projects Faculty Management System

Affected Versions: 1.0

Vulnerability: This vulnerability is a SQL injection flaw (CWE-89) located in the subject-print.php file, which fails to properly sanitize the ID parameter. The flaw is exploitable by unauthenticated remote attackers.

Business Impact

The ability to perform SQL injection allows an attacker to interact directly with the backend database, potentially leading to unauthorized data disclosure or modification. With a CVSS score of 7.3, this high-severity vulnerability could compromise the integrity and confidentiality of student or faculty information, resulting in significant reputational and regulatory consequences for the institution.

Remediation Plan

Immediate Action: As no official patch is currently identified, administrators should restrict access to the affected web interface or disable the vulnerable subject-print.php functionality until a vendor update is released.

Proactive Monitoring: Security teams should monitor database logs for suspicious query patterns, such as unusual syntax or unexpected data access requests originating from the web server.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to detect and block SQL injection payloads targeting URL parameters.

Exploitation Status

Public Exploit Available: Yes, a public proof-of-concept exists as documented in the research write-up at https://github.com/wfcht-sy/src/issues/1.

Analyst Notes: As of April 14, 2026, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The vulnerability is inherently easy to exploit due to the lack of required authentication.

Analyst Recommendation

Given the availability of a public proof-of-concept and the unauthenticated nature of the attack, this vulnerability represents a significant risk. Organizations utilizing the Faculty Management System 1.0 must prioritize the implementation of WAF protections or network-level access controls immediately to prevent potential exploitation while awaiting a permanent vendor-supplied security update.

Description Summary:
A SQL injection vulnerability in the Vehicle Showroom Management System 1.0 allows remote attackers to manipulate the VEHICLE_ID parameter in /util/UpdateVehicleFunction.php.

Executive Summary:
The code-projects Vehicle Showroom Management System 1.0 contains a critical SQL injection vulnerability that allows unauthenticated remote attackers to execute arbitrary database commands.

Vulnerability Details

CVE-ID: CVE-2026-6166

Affected Software: code-projects Vehicle Showroom Management System

Affected Versions: 1.0

Vulnerability: The application is vulnerable to SQL injection (CWE-89) within the /util/UpdateVehicleFunction.php file. Attackers can exploit this by injecting malicious input into the VEHICLE_ID argument, which is processed without sufficient sanitization.

Business Impact

Successful exploitation allows an attacker to interact directly with the backend database, potentially leading to unauthorized data access, modification, or deletion. Given the CVSS score of 7.3, this high-severity flaw poses a significant risk to the confidentiality and integrity of information stored within the showroom management database.

Remediation Plan

Immediate Action: Since no official patch is currently available, administrators should restrict access to the affected script or disable the module entirely until a secure update is released by the vendor.

Proactive Monitoring: Review web server access logs for anomalous requests containing SQL syntax or unusual parameters targeting the /util/UpdateVehicleFunction.php endpoint.

Compensating Controls: Deploy a Web Application Firewall (WAF) rule to filter and block malicious SQL injection payloads targeting the VEHICLE_ID parameter.

Exploitation Status

Public Exploit Available: Yes, a published proof-of-concept exists as documented in the GitHub issue tracker referenced by the vulnerability record.

Analyst Notes: As of April 14, 2026, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The vulnerability is inherently dangerous due to its remote, unauthenticated attack vector.

Analyst Recommendation

Due to the availability of a public proof-of-concept and the lack of an official patch, organizations using this software are at elevated risk. Immediate isolation of the vulnerable component is required to prevent potential database compromise until the vendor provides a remediation update.

Description Summary:
A SQL injection vulnerability exists in the Vehicle Showroom Management System 1.0, specifically within the /util/Login_check.php file, allowing remote attackers to manipulate the ID argument.

Executive Summary:
A critical SQL injection vulnerability in the code-projects Vehicle Showroom Management System allows unauthenticated remote attackers to compromise the application database.

Vulnerability Details

CVE-ID: CVE-2026-6165

Affected Software: code-projects Vehicle Showroom Management System

Affected Versions: 1.0

Vulnerability: This is a SQL injection flaw (CWE-89) triggered by improper input validation of the ID parameter within the /util/Login_check.php file. The vulnerability is exploitable by unauthenticated remote attackers.

Business Impact

The ability to perform remote SQL injection poses a significant risk to the confidentiality, integrity, and availability of the application. An attacker could potentially extract sensitive user data, bypass authentication mechanisms, or modify database records, leading to unauthorized access and potential system compromise. With a CVSS score of 7.3, this high-severity flaw requires immediate attention to prevent unauthorized data exfiltration.

Remediation Plan

Immediate Action: Since no official patch is currently available, administrators should restrict access to the affected web directory or disable the vulnerable Vehicle Showroom Management System until a secure update is released.

Proactive Monitoring: Review web server access logs for anomalous requests containing SQL syntax patterns targeted at the /util/Login_check.php endpoint.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to detect and block SQL injection payloads targeting the identified parameter.

Exploitation Status

Public Exploit Available: Yes, a public proof-of-concept exists as documented in the referenced GitHub issue.

Analyst Notes: As of April 14, 2026, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The presence of a published proof-of-concept significantly lowers the barrier to entry for potential attackers.

Analyst Recommendation

Given the availability of a public proof-of-concept and the ease of remote exploitation, this vulnerability presents a clear and present danger to affected environments. Organizations must prioritize the implementation of compensating controls, such as WAF filtering, to mitigate the risk while awaiting a vendor-supplied patch. Failure to address this flaw could lead to a full database compromise.

Description Summary:
A SQL injection vulnerability exists in the addcat.php file of code-projects Lost and Found Thing Management 1.0, allowing remote attackers to manipulate the cata argument.

Executive Summary:
A critical SQL injection vulnerability in the Lost and Found Thing Management application allows unauthenticated remote attackers to compromise database integrity.

Vulnerability Details

CVE-ID: CVE-2026-6164

Affected Software: code-projects Lost and Found Thing Management

Affected Versions: 1.0

Vulnerability: This is a SQL injection vulnerability (CWE-89) located in the addcat.php file. An unauthenticated attacker can exploit this flaw by manipulating the cata argument to execute arbitrary SQL commands.

Business Impact

Successful exploitation of this vulnerability could lead to unauthorized access to sensitive data stored in the underlying database, potentially resulting in data exfiltration or modification. Given the CVSS score of 7.3, this represents a high-severity risk that could lead to significant operational disruption and compromise of user information.

Remediation Plan

Immediate Action: As no official patch is currently available, administrators should immediately restrict access to the affected web application or take it offline until the vendor provides a security update.

Proactive Monitoring: Monitor database query logs for suspicious patterns, such as unexpected syntax or unauthorized access attempts originating from the addcat.php endpoint.

Compensating Controls: Deploy a Web Application Firewall (WAF) with specific rules designed to detect and block SQL injection payloads targeting the cata parameter.

Exploitation Status

Public Exploit Available: Yes, a public proof-of-concept exists as documented in the GitHub issue referenced by the vulnerability record.

Analyst Notes: As of April 14, 2026, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The vulnerability is highly exploitable due to the lack of required authentication.

Analyst Recommendation

The presence of a public proof-of-concept combined with the ease of remote, unauthenticated exploitation necessitates immediate attention. Organizations utilizing this software must prioritize isolating the application from external networks and implementing strict input validation or WAF rules to prevent SQL injection attempts until an official vendor patch is released.

Description Summary:
A SQL injection vulnerability exists in the Lost and Found Thing Management application, specifically within the catageory.php file, which allows remote attackers to manipulate the cat argument.

Executive Summary:
The Lost and Found Thing Management application contains a critical SQL injection vulnerability that allows remote, unauthenticated attackers to potentially compromise database information.

Vulnerability Details

CVE-ID: CVE-2026-6163

Affected Software: code-projects Lost and Found Thing Management

Affected Versions: 1.0

Vulnerability: This is a SQL injection flaw (CWE-89) triggered via the cat parameter in the catageory.php script. The vulnerability allows an unauthenticated remote attacker to inject malicious SQL commands into the application database.

Business Impact

Successful exploitation of this SQL injection vulnerability could lead to unauthorized access to sensitive data stored within the application database. Given the CVSS score of 7.3, this represents a high-severity risk that could result in data exfiltration or potential manipulation of application records. Such an incident poses a significant threat to data confidentiality and the overall integrity of the business environment.

Remediation Plan

Immediate Action: Since no official patch is currently available, administrators should restrict access to the affected catageory.php file or disable the application until a security update is released by the vendor.

Proactive Monitoring: Security teams should monitor web access logs for anomalous patterns, such as SQL syntax characters (e.g., single quotes, double dashes, or UNION keywords) being passed to the cat parameter.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to detect and block common SQL injection patterns targeting the catageory.php endpoint.

Exploitation Status

Public Exploit Available: Yes, a public proof-of-concept exists as documented in the research write-up at https://github.com/lanPwa/CVE/issues/2.

Analyst Notes: As of April 14, 2026, there is no public information indicating active exploitation in the wild. However, because a functional proof-of-concept is publicly available, the risk of exploitation is elevated and immediate defensive measures are required.

Analyst Recommendation

The presence of a public proof-of-concept makes this SQL injection vulnerability a high-priority risk. Organizations using the Lost and Found Thing Management application should prioritize isolating the affected component immediately. Until the vendor provides a remediation update, strict input validation and access control via a WAF are essential to prevent unauthorized database access.

Description Summary:
Code-Projects Simple ChatBox version 1.0 is vulnerable to unauthenticated SQL injection via the msg parameter in /chatbox/insert.php.

Executive Summary:
An unauthenticated SQL injection vulnerability in Code-Projects Simple ChatBox 1.0 allows remote attackers to execute arbitrary database queries and potentially compromise backend data.

Vulnerability Details

CVE-ID: CVE-2026-6161

Affected Software: Code-Projects Simple ChatBox

Affected Versions: 1.0

Vulnerability: The application fails to sanitize the msg parameter within the /chatbox/insert.php endpoint before passing it to backend SQL queries. This allows an unauthenticated attacker to inject malicious SQL commands, enabling time-based blind SQL injection.

Business Impact

Successful exploitation grants an attacker the ability to interact directly with the underlying database. This can lead to unauthorized data exfiltration, modification or deletion of chat records, and potential full compromise of the database management system. Given the CVSS score of 7.3, this represents a high-severity risk to confidentiality and integrity that should be addressed immediately.

Remediation Plan

Immediate Action: As no official patch is currently available, administrators should immediately restrict access to the /chatbox/insert.php endpoint or disable the affected chat functionality until a secure update is released by the vendor.

Proactive Monitoring: Review database and web server access logs for anomalous POST requests to the chatbox directory, specifically searching for SQL syntax characters such as single quotes, sleep commands, or union select statements.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to detect and block SQL injection patterns targeting the msg parameter.

Exploitation Status

Public Exploit Available: Yes, a published proof-of-concept exists and is documented in a security research write-up on GitHub.

Analyst Notes: As of April 14, 2026, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The vulnerability is highly exploitable due to the lack of input validation and the use of direct string concatenation in SQL queries.

Analyst Recommendation

The presence of a functional proof-of-concept for this SQL injection vulnerability creates a significant risk of unauthorized data access. Users are strongly advised to limit exposure by restricting network access to the application and implementing strict WAF filtering. If the software cannot be secured through these compensating controls, it should be removed from production environments until the vendor provides a patched version that utilizes prepared statements.

Description Summary:
A SQL injection vulnerability in the Vehicle Showroom Management System allows remote attackers to manipulate database queries via the STAFF_ID argument in StaffDetailsFunction.php.

Executive Summary:
The Vehicle Showroom Management System is vulnerable to remote SQL injection, which could allow an unauthenticated attacker to compromise backend database integrity.

Vulnerability Details

CVE-ID: CVE-2026-6153

Affected Software: code-projects Vehicle Showroom Management System

Affected Versions: 1.0

Vulnerability: This is a SQL injection vulnerability (CWE-89) located in the /util/StaffDetailsFunction.php file. The flaw is triggered via the STAFF_ID parameter and can be exploited by an unauthenticated attacker remotely.

Business Impact

The ability for an unauthenticated user to inject arbitrary SQL commands poses a significant risk to data confidentiality and integrity. With a CVSS score of 7.3, this high-severity vulnerability could allow attackers to bypass authentication mechanisms, view sensitive staff records, or potentially modify database content, leading to unauthorized access and business disruption.

Remediation Plan

Immediate Action: As no official patch is currently available, administrators should restrict network access to the affected installation and consider disabling the vulnerable functionality if it is not business critical.

Proactive Monitoring: Security teams should implement strict input validation on all web forms and monitor server logs for unusual SQL syntax patterns or unauthorized access attempts targeting the /util/ directory.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to block common SQL injection payloads and monitor for anomalous traffic patterns directed at the identified vulnerable PHP file.

Exploitation Status

Public Exploit Available: Yes, a public proof-of-concept exists as documented in the linked GitHub repository.

Analyst Notes: As of April 14, 2026, there is no confirmed active exploitation in the wild; however, a public proof-of-concept exists, so exploitation risk should be treated as credible. The vulnerability is inherently dangerous because it allows for unauthenticated interaction with the underlying database.

Analyst Recommendation

Given the availability of a public proof-of-concept and the lack of a vendor-supplied patch, this vulnerability presents a clear and present risk. Organizations using the Vehicle Showroom Management System should immediately isolate the application from public-facing networks. Until a formal security update is released, prioritize the implementation of robust WAF filtering to mitigate the risk of exploitation.

Description Summary:
The Vehicle Showroom Management System is vulnerable to remote SQL injection via the STAFF_ID parameter in the /util/StaffAddingFunction.php file.

Executive Summary:
A critical SQL injection vulnerability in the code-projects Vehicle Showroom Management System allows unauthenticated remote attackers to execute arbitrary database queries.

Vulnerability Details

CVE-ID: CVE-2026-6152

Affected Software: code-projects Vehicle Showroom Management System

Affected Versions: 1.0

Vulnerability: The application fails to properly sanitize the STAFF_ID parameter within the /util/StaffAddingFunction.php script, which leads to SQL injection. This flaw is accessible to unauthenticated remote attackers who can interact directly with the vulnerable endpoint.

Business Impact

Successful exploitation of this vulnerability allows an attacker to manipulate backend database queries, potentially leading to unauthorized data extraction or modification. Given the CVSS score of 7.3, this flaw poses a significant risk to the confidentiality and integrity of the application, which could lead to severe reputational damage or unauthorized access to sensitive showroom management data.

Remediation Plan

Immediate Action: As no official patch is currently available, administrators should restrict network access to the /util/StaffAddingFunction.php file or disable the affected module entirely if it is not business-critical.

Proactive Monitoring: Review web server access logs for anomalous requests containing SQL syntax patterns or unexpected characters directed at the StaffAddingFunction.php endpoint.

Compensating Controls: Implement a Web Application Firewall (WAF) rule to filter and block malicious SQL injection payloads targeting the STAFF_ID parameter.

Exploitation Status

Public Exploit Available: Yes — a public proof-of-concept exists, as documented in the security researcher's write-up at the referenced GitHub repository.

Analyst Notes: As of April 14, 2026, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The flaw is inherently dangerous because it requires no authentication to trigger and targets a common database interaction point.

Analyst Recommendation

Due to the lack of an official vendor patch and the availability of public exploit material, this vulnerability presents a high risk to the application environment. Security teams must prioritize isolating the affected component and implementing robust input validation via a WAF until a permanent fix is issued by the vendor.

Description Summary:
A SQL injection vulnerability in the Vehicle Showroom Management System allows remote, unauthenticated attackers to manipulate the CUSTOMER_ID argument via the PaymentStatusFunction.php file.

Executive Summary:
The code-projects Vehicle Showroom Management System version 1.0 is vulnerable to remote SQL injection, presenting a significant risk of unauthorized database interaction.

Vulnerability Details

CVE-ID: CVE-2026-6151

Affected Software: code-projects Vehicle Showroom Management System

Affected Versions: 1.0

Vulnerability: This vulnerability is a SQL injection flaw located in the /util/PaymentStatusFunction.php file. It allows an unauthenticated remote attacker to inject malicious SQL commands by manipulating the CUSTOMER_ID parameter.

Business Impact

The exploitation of this vulnerability could lead to unauthorized access to the underlying database, potentially resulting in data exfiltration or corruption. With a CVSS score of 7.3, this high-severity flaw poses a serious threat to the integrity and confidentiality of the information stored within the application.

Remediation Plan

Immediate Action: As no official patch is currently available, administrators should restrict network access to the application and disable the affected functionality if possible.

Proactive Monitoring: Security teams should monitor database logs for unusual query patterns, particularly those containing SQL syntax or unexpected characters in the CUSTOMER_ID field.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to detect and block common SQL injection patterns targeting the specified application endpoint.

Exploitation Status

Public Exploit Available: Yes, a published proof-of-concept exists and is attributed to the GitHub issue referenced in the vulnerability report.

Analyst Notes: As of April 14, 2026, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The vulnerability is inherently dangerous because it allows unauthenticated interaction with the database.

Analyst Recommendation

Given the availability of a public proof-of-concept and the ease of remote exploitation, this vulnerability requires immediate attention. Organizations currently running this software should prioritize isolating the affected system from public-facing networks until a vendor-supplied update is released and verified.

Description Summary:
A security flaw has been identified in version 1 of the Code-projects Vehicle Showroom Management System, requiring immediate attention.

Executive Summary:
The Code-projects Vehicle Showroom Management System contains a security flaw in version 1 that requires immediate administrative action to mitigate potential risks.

Vulnerability Details

CVE-ID: CVE-2026-6149

Affected Software: Code-projects, Vehicle Showroom Management System

Affected Versions: 1

Vulnerability: This vulnerability involves a flaw within the Vehicle Showroom Management System. The issue potentially allows for unauthorized interaction with the application, necessitating a review of current security controls to prevent exploitation of the underlying system logic.

Business Impact

The CVSS score of 7.3 highlights a significant risk, particularly regarding the integrity of business data and the availability of the management system. Unauthorized access could result in the compromise of sensitive showroom data and the disruption of critical business functions.

Remediation Plan

Immediate Action: Ensure the application is behind a secure VPN and not directly accessible via the public internet while awaiting a vendor patch.

Proactive Monitoring: Audit access logs for anomalous behavior, particularly requests originating from unauthorized or unexpected IP ranges.

Compensating Controls: Implement strict input validation and session management policies via a WAF to mitigate potential exploitation attempts.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of April 13, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Security teams must prioritize the security of the Vehicle Showroom Management System. Given the identified vulnerability, it is imperative to apply security updates as soon as they are released by the vendor and maintain a defensive security posture to prevent unauthorized access.

Description Summary:
A security vulnerability has been detected in version 1 of the Code-projects Vehicle Showroom Management System.

Executive Summary:
A high-severity vulnerability in the Code-projects Vehicle Showroom Management System exposes the platform to potential unauthorized access and compromise.

Vulnerability Details

CVE-ID: CVE-2026-6148

Affected Software: Code-projects, Vehicle Showroom Management System

Affected Versions: 1

Vulnerability: This vulnerability affects the Vehicle Showroom Management System. The nature of the flaw suggests potential weaknesses in the application's authentication or session management, which may allow attackers to interact with the system without sufficient authorization.

Business Impact

With a CVSS score of 7.3, the vulnerability poses a substantial risk to sensitive customer and showroom data. Exploitation could lead to data exfiltration, unauthorized modification of records, and potential compromise of the administrative interface, impacting business operations and customer trust.

Remediation Plan

Immediate Action: Immediately isolate the application from public-facing networks until a vendor-supplied security patch is applied.

Proactive Monitoring: Monitor database query logs for evidence of unauthorized data retrieval or administrative command execution.

Compensating Controls: Use a Web Application Firewall (WAF) to validate incoming requests and block attempts to bypass authentication mechanisms.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of April 13, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Administrators should treat this vulnerability with high urgency. If an update is not immediately available, the system should be restricted to internal use only to minimize exposure to external threats until remediation is complete.

Description Summary:
A SQL injection vulnerability exists in the Vehicle Showroom Management System 1.0, allowing remote, unauthenticated attackers to manipulate the BRANCH_ID parameter via RegisterCustomerFunction.php.

Executive Summary:
An unauthenticated SQL injection vulnerability in the code-projects Vehicle Showroom Management System 1.0 poses a significant risk of remote data compromise.

Vulnerability Details

CVE-ID: CVE-2026-6038

Affected Software: code-projects Vehicle Showroom Management System

Affected Versions: 1.0

Vulnerability: This is a SQL injection vulnerability (CWE-89) located in the /util/RegisterCustomerFunction.php file. An unauthenticated attacker can exploit this flaw by injecting malicious SQL commands into the BRANCH_ID parameter.

Business Impact

Successful exploitation of this vulnerability allows unauthorized access to backend database information. Given the CVSS score of 7.3, this flaw is categorized as High severity, as it enables remote attackers to potentially exfiltrate sensitive customer data or interfere with system operations, leading to significant reputational and operational damage.

Remediation Plan

Immediate Action: Since a formal vendor patch is currently unavailable, administrators should restrict network access to the vulnerable application and consider taking it offline until the code can be manually audited or a patch is released.

Proactive Monitoring: Review web server access logs for anomalous requests directed at /util/RegisterCustomerFunction.php, particularly those containing SQL syntax characters like single quotes or semicolons.

Compensating Controls: Deploy a Web Application Firewall (WAF) with strict SQL injection protection rules to inspect and filter incoming traffic targeting the affected parameter.

Exploitation Status

Public Exploit Available: Yes, a public proof-of-concept exists as documented in the linked GitHub repository.

Analyst Notes: As of April 12, 2026, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The vulnerability is highly accessible as it requires no authentication to execute.

Analyst Recommendation

Due to the lack of an official patch and the availability of a public proof-of-concept, this vulnerability must be treated with high urgency. Organizations utilizing this software should immediately implement compensating controls or restrict access to the application to prevent potential data breaches.

Description Summary:
The Vehicle Showroom Management System is vulnerable to remote SQL injection via the BRANCH_ID parameter in /util/AddVehicleFunction.php.

Executive Summary:
The Vehicle Showroom Management System version 1.0 contains a remote SQL injection vulnerability that allows unauthenticated attackers to manipulate database queries.

Vulnerability Details

CVE-ID: CVE-2026-6037

Affected Software: code-projects Vehicle Showroom Management System

Affected Versions: 1.0

Vulnerability: This flaw is a SQL injection vulnerability (CWE-89) located in the /util/AddVehicleFunction.php file. An unauthenticated attacker can exploit this by manipulating the BRANCH_ID argument to execute arbitrary SQL commands.

Business Impact

Successful exploitation of this vulnerability could lead to unauthorized access to the application database, potential data exfiltration, or modification of sensitive vehicle and showroom records. With a CVSS score of 7.3, this represents a high risk to data confidentiality and integrity, particularly for systems managing business operations.

Remediation Plan

Immediate Action: As no official patch is currently available, administrators should restrict network access to the /util/AddVehicleFunction.php endpoint or disable the vulnerable module entirely until a vendor-supplied update is released.

Proactive Monitoring: Security teams should review web server access logs for anomalous requests containing SQL syntax patterns targeting the BRANCH_ID parameter.

Compensating Controls: Implement a Web Application Firewall (WAF) rule to block incoming requests containing malicious SQL injection payloads directed at the vulnerable file.

Exploitation Status

Public Exploit Available: Yes, a public proof-of-concept exists, as documented in the referenced GitHub issue.

Analyst Notes: As of April 12, 2026, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The vulnerability is highly accessible because it does not require user interaction or prior authentication.

Analyst Recommendation

Given the public availability of exploit code and the ease of remote execution, this vulnerability poses a significant risk to the integrity of the application. Organizations should prioritize isolating the affected system from public-facing networks and monitor for unauthorized activity until a permanent security update is provided by the vendor.

Description Summary:
A SQL injection vulnerability exists in the Vehicle Showroom Management System 1.0, specifically within the /util/VehicleDetailsFunction.php file, allowing remote attackers to manipulate the VEHICLE_ID.

Executive Summary:
A critical SQL injection vulnerability in the code-projects Vehicle Showroom Management System 1.0 allows for unauthenticated remote attackers to potentially access or manipulate database contents.

Vulnerability Details

CVE-ID: CVE-2026-6036

Affected Software: code-projects Vehicle Showroom Management System

Affected Versions: 1.0

Vulnerability: This vulnerability is a SQL injection flaw (CWE-89) located in the /util/VehicleDetailsFunction.php file. An unauthenticated attacker can exploit this remotely by sending a malicious request containing a crafted VEHICLE_ID parameter.

Business Impact

Successful exploitation of this flaw could allow an attacker to bypass security controls, leading to unauthorized access to sensitive data stored within the application database. With a CVSS score of 7.3, this high-severity vulnerability poses a significant risk to data confidentiality and integrity, potentially resulting in data exfiltration or unauthorized modification of system records.

Remediation Plan

Immediate Action: As no official patch is currently available, administrators should restrict network access to the application or disable the vulnerable component until a security update is released by the vendor.

Proactive Monitoring: Security teams should implement database activity monitoring to detect anomalous query patterns or unexpected SQL syntax originating from the /util/VehicleDetailsFunction.php endpoint.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to detect and block SQL injection payloads targeting the application URL parameters.

Exploitation Status

Public Exploit Available: Yes, a published proof-of-concept exists and is attributed to the technical write-up provided in the references (https://github.com/TAnNbR/CVE/issues/3).

Analyst Notes: As of April 12, 2026, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The flaw is inherently dangerous due to its ease of exploitation via simple HTTP GET or POST requests.

Analyst Recommendation

Given the availability of a public proof-of-concept and the lack of a vendor-supplied patch, this vulnerability must be treated with high priority. Organizations utilizing the Vehicle Showroom Management System should immediately isolate the affected instance from public-facing networks and apply strict input validation rules at the WAF level to mitigate the threat of SQL injection.

Description Summary:
A SQL injection vulnerability in the Simple Laundry System 1.0 allows unauthenticated attackers to manipulate database queries via the firstName parameter in /userfinishregister.php.

Executive Summary:
An unauthenticated SQL injection vulnerability in code-projects Simple Laundry System 1.0 poses a significant risk of unauthorized database access and potential data compromise.

Vulnerability Details

CVE-ID: CVE-2026-5648

Affected Software: code-projects Simple Laundry System

Affected Versions: 1.0

Vulnerability: The application is susceptible to SQL injection due to improper neutralization of the firstName parameter within the /userfinishregister.php script. This flaw allows an unauthenticated attacker to execute arbitrary SQL commands against the backend database.

Business Impact

Successful exploitation allows an attacker to gain unauthorized access to the underlying database, potentially leading to sensitive data leakage, unauthorized modification of records, or complete system compromise. With a CVSS score of 7.3, this vulnerability represents a high-risk entry point that could facilitate data breaches and disrupt business operations.

Remediation Plan

Immediate Action: As no official patch is currently available, administrators should restrict access to the /userfinishregister.php endpoint or disable the registration feature until a formal update is provided by the vendor.

Proactive Monitoring: Security teams should monitor database logs for anomalous queries, particularly those containing SQL syntax or time-based delay commands, and investigate any unexpected attempts to access the user registration endpoint.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to detect and block SQL injection patterns targeting the firstName parameter.

Exploitation Status

Public Exploit Available: Yes, a published proof-of-concept exists and is attributed to the research write-up at https://github.com/yao536/cve/issues/2.

Analyst Notes: As of April 6, 2026, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The vulnerability is inherently simple to exploit as it requires no prior authentication or administrative privileges.

Analyst Recommendation

Given the availability of a public proof-of-concept and the lack of a vendor-provided patch, this vulnerability presents an immediate risk. Organizations utilizing Simple Laundry System 1.0 must prioritize the implementation of compensating controls, such as WAF rules or network segmentation, and monitor for unauthorized access attempts until a secure version is released.

Description Summary:
A security vulnerability in Code-Projects Easy Blog Site 1 may allow attackers to compromise the integrity of the application.

Executive Summary:
The Code-Projects Easy Blog Site 1 is affected by a high-severity vulnerability that could lead to unauthorized system access.

Vulnerability Details

CVE-ID: CVE-2026-5646

Affected Software: Code-Projects Easy Blog Site

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: This vulnerability involves a flaw in the Easy Blog Site 1 architecture, potentially allowing an unauthenticated attacker to interact with the application in unintended ways. The defect likely involves insufficient validation of user input or improper access controls.

Business Impact

An attacker could leverage this vulnerability to gain unauthorized access to site data or modify administrative settings. The CVSS score of 7.3 highlights a high level of risk, which could result in service disruption or the unauthorized exposure of sensitive user information.

Remediation Plan

Immediate Action: Apply the latest security updates provided by the vendor to address the identified vulnerability.

Proactive Monitoring: Monitor server logs for unusual traffic patterns or unauthorized attempts to access sensitive blog configuration files.

Compensating Controls: Utilize a Web Application Firewall (WAF) to filter out common web-based attack vectors that could target this vulnerability.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of April 6, 2026, there is no public information indicating active exploitation of this vulnerability. Despite the lack of current exploit data, the severity of the flaw necessitates prompt remediation to prevent potential future abuse.

Analyst Recommendation

Security teams should immediately assess their exposure to the Easy Blog Site 1 application. Updating to the latest version is the most effective way to eliminate this risk and ensure the continued security of the web environment.

Description Summary:
A SQL injection vulnerability in the Simple Laundry System 1.0 allows unauthenticated attackers to execute arbitrary database queries via the userid parameter in the delmemberinfo.php file.

Executive Summary:
An unauthenticated SQL injection vulnerability in the Simple Laundry System 1.0 allows remote attackers to compromise backend database integrity and confidentiality.

Vulnerability Details

CVE-ID: CVE-2026-5565

Affected Software: code-projects Simple Laundry System

Affected Versions: 1.0

Vulnerability: This is a SQL injection vulnerability (CWE-89) located in the delmemberinfo.php script. The application fails to sanitize the userid parameter before using it in database queries, allowing unauthenticated remote attackers to inject malicious SQL commands.

Business Impact

Successful exploitation permits unauthorized access to the underlying database, potentially leading to sensitive data exposure, unauthorized modification or deletion of records, and full system control. With a CVSS score of 7.3, this flaw poses a high risk to business continuity and data integrity, as it provides a direct path for attackers to bypass application-level security controls.

Remediation Plan

Immediate Action: As no official patch is currently available, administrators should restrict network access to the delmemberinfo.php file or disable the affected functionality entirely until a vendor-supplied update is released.

Proactive Monitoring: Security teams should monitor web server logs for suspicious GET requests containing SQL syntax or unusual query patterns targeting the delmemberinfo.php endpoint.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to detect and block SQL injection payloads targeting common parameters such as userid.

Exploitation Status

Public Exploit Available: Yes, a public proof-of-concept exists as documented in the provided GitHub repository issue.

Analyst Notes: As of April 6, 2026, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The vulnerability is highly exploitable due to the absence of authentication requirements and the simplicity of the attack vector.

Analyst Recommendation

Given the availability of public proof-of-concept code and the ease of exploitation, this vulnerability represents a significant risk to any environment hosting the Simple Laundry System. Administrators must prioritize implementing compensating controls or restricting access to the vulnerable script immediately, as the lack of an official patch leaves the system exposed to potential unauthorized data exfiltration or system compromise.

Description Summary:
A SQL injection vulnerability in the Simple Laundry System 1.0 searchguest.php file allows unauthenticated attackers to execute malicious database queries via the searchServiceId parameter.

Executive Summary:
An unauthenticated SQL injection vulnerability in code-projects Simple Laundry System 1.0 poses a critical risk of unauthorized database access and potential system compromise.

Vulnerability Details

CVE-ID: CVE-2026-5564

Affected Software: code-projects Simple Laundry System

Affected Versions: 1.0

Vulnerability: This is a SQL injection vulnerability located in the searchguest.php file. The application fails to properly sanitize the searchServiceId parameter, allowing an unauthenticated attacker to inject arbitrary SQL commands.

Business Impact

Successful exploitation of this flaw allows attackers to bypass authentication, extract sensitive information, modify or delete database records, and potentially gain full control over the underlying database server. Given the CVSS score of 7.3, this represents a significant risk to data confidentiality, integrity, and availability, which could lead to severe operational disruption and loss of proprietary data.

Remediation Plan

Immediate Action: As there is no official patch available, administrators should restrict access to the /searchguest.php endpoint or disable the affected functionality entirely until a secure update is provided by the vendor.

Proactive Monitoring: Review database access logs for anomalous query patterns, such as unexpected syntax characters (e.g., OR, SLEEP, UNION) originating from the searchServiceId parameter.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules specifically configured to detect and block SQL injection payloads targeting the searchServiceId parameter.

Exploitation Status

Public Exploit Available: Yes, a published proof-of-concept exists as documented in the GitHub security issue referenced by the vulnerability record.

Analyst Notes: As of April 6, 2026, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The vulnerability is highly accessible as it requires no authentication to trigger via the exposed HTTP parameter.

Analyst Recommendation

Given the availability of public proof-of-concept code and the ease of exploitation, this vulnerability should be prioritized for mitigation. Organizations currently running Simple Laundry System 1.0 must implement compensating controls or restrict network access to the application immediately to prevent unauthorized database access.

Description Summary:
A SQL injection vulnerability exists in the Concert Ticket Reservation System 1.0 login.php file, allowing unauthenticated remote attackers to manipulate database queries via the Email parameter.

Executive Summary:
A critical SQL injection vulnerability in the Concert Ticket Reservation System allows unauthenticated attackers to execute arbitrary database commands, posing a severe risk of data exfiltration and system compromise.

Vulnerability Details

CVE-ID: CVE-2026-5555

Affected Software: code-projects Concert Ticket Reservation System

Affected Versions: 1.0

Vulnerability: The application fails to properly sanitize the Email parameter within the login.php file before including it in SQL queries. This flaw allows an unauthenticated remote attacker to inject malicious SQL commands, enabling unauthorized database interaction.

Business Impact

Successful exploitation of this vulnerability grants an attacker the ability to bypass authentication, extract sensitive user information, modify or delete database records, and potentially achieve full control over the underlying database server. Given the CVSS score of 7.3, this represents a high-severity risk that could lead to significant data breaches, loss of customer trust, and long-term service disruption.

Remediation Plan

Immediate Action: As no official patch is currently available, administrators should restrict public access to the login interface or implement robust input validation filters to block malicious SQL syntax in the Email parameter.

Proactive Monitoring: Security teams should monitor database logs for anomalous query patterns, such as unexpected use of SQL keywords or syntax errors, which may indicate active exploitation attempts.

Compensating Controls: Deploy a Web Application Firewall (WAF) configured with rules to detect and block common SQL injection patterns targeting the login endpoint.

Exploitation Status

Public Exploit Available: Yes, a published proof-of-concept exists as detailed in the security research write-up referenced on GitHub.

Analyst Notes: As of April 7, 2026, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The vulnerability is inherently easy to exploit due to the lack of required authentication and the direct injection point in the login process.

Analyst Recommendation

Given the availability of public proof-of-concept code and the ease of exploitation, this vulnerability presents an immediate danger to any exposed instances of the Concert Ticket Reservation System. Administrators must treat this as a high-priority item, implementing WAF rules or network-level access controls immediately to mitigate the risk until a vendor-supplied security update is made available.

Description Summary:
A SQL injection vulnerability in the Concert Ticket Reservation System allows unauthenticated remote attackers to execute arbitrary database queries via the searching parameter.

Executive Summary:
A critical SQL injection vulnerability in the Concert Ticket Reservation System allows unauthenticated remote attackers to compromise backend database integrity and confidentiality.

Vulnerability Details

CVE-ID: CVE-2026-5554

Affected Software: code-projects Concert Ticket Reservation System

Affected Versions: 1.0

Vulnerability: The application fails to properly sanitize user input in the searching parameter within the process_search.php file. This allows an unauthenticated attacker to inject malicious SQL commands, which are then executed directly by the backend database.

Business Impact

Successful exploitation of this vulnerability enables unauthorized database access, which may lead to sensitive data leakage, unauthorized data modification, or complete system compromise. Given the CVSS score of 7.3, this flaw poses a significant risk to business continuity and data integrity, as it provides an unauthenticated entry point for attackers to bypass standard application security controls.

Remediation Plan

Immediate Action: As no official vendor patch is available, administrators should immediately restrict access to the affected web application or disable the vulnerable process_search.php endpoint until a secure version is released.

Proactive Monitoring: Review web server and database logs for anomalous POST requests to process_search.php, specifically looking for SQL syntax characters such as single quotes, comments, or union statements.

Compensating Controls: Implement a Web Application Firewall (WAF) rule to inspect and block incoming HTTP POST requests containing SQL injection patterns targeting the searching parameter.

Exploitation Status

Public Exploit Available: Yes, a published proof-of-concept exists as documented in the GitHub security issue referenced by the CVE record.

Analyst Notes: As of April 6, 2026, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The vulnerability is highly accessible as it requires no authentication to trigger via the exposed searching parameter.

Analyst Recommendation

Due to the lack of a formal vendor patch and the availability of public proof-of-concept material, this vulnerability presents an elevated risk to any instance of the Concert Ticket Reservation System. Organizations should prioritize isolating the application from external networks or applying strict input validation controls to the affected parameter to prevent unauthorized database manipulation.

Description Summary:
Simple Laundry System 1.0 is vulnerable to remote SQL injection in the firstName parameter of modifymember.php, allowing unauthenticated attackers to manipulate database queries.

Executive Summary:
A critical SQL injection vulnerability in code-projects Simple Laundry System 1.0 allows for unauthenticated remote data manipulation.

Vulnerability Details

CVE-ID: CVE-2026-5540

Affected Software: code-projects Simple Laundry System

Affected Versions: 1.0

Vulnerability: This is a SQL injection vulnerability (CWE-89) located in the modifymember.php file. An unauthenticated attacker can inject malicious SQL commands via the firstName argument to interact with the backend database.

Business Impact

The ability for an unauthenticated user to execute arbitrary SQL commands poses a severe risk to data confidentiality and integrity. Successful exploitation could lead to unauthorized data exposure, modification of administrative records, or complete compromise of the application database. Given the CVSS score of 7.3, this flaw presents a high risk to business operations and necessitates immediate attention.

Remediation Plan

Immediate Action: Since no official patch is currently available, administrators should restrict network access to the application or take the service offline until a secure version is released.

Proactive Monitoring: Monitor web server logs for suspicious HTTP requests targeting modifymember.php, specifically looking for SQL syntax patterns or unexpected special characters in the firstName parameter.

Compensating Controls: Implement a Web Application Firewall (WAF) with strict SQL injection protection rules to filter malicious input directed at the vulnerable endpoint.

Exploitation Status

Public Exploit Available: Yes, a published proof-of-concept exists as detailed in the referenced GitHub issue.

Analyst Notes: As of April 6, 2026, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The vulnerability is inherently dangerous because it allows unauthenticated remote access to the database layer.

Analyst Recommendation

The presence of a public proof-of-concept combined with the unauthenticated nature of this vulnerability significantly increases the risk of exploitation. Organizations currently running Simple Laundry System 1.0 must treat this as a high-priority incident and apply restrictive access controls or remove the software from public-facing environments until the vendor provides a formal security update.

Description Summary:
A SQL injection vulnerability in the Simple Laundry System 1.0 allows unauthenticated attackers to execute arbitrary SQL commands via the userid parameter in delstaffinfo.php.

Executive Summary:
The Simple Laundry System 1.0 contains an unauthenticated SQL injection vulnerability that permits remote attackers to compromise the underlying database.

Vulnerability Details

CVE-ID: CVE-2026-5257

Affected Software: code-projects Simple Laundry System

Affected Versions: 1.0

Vulnerability: This is a SQL injection flaw (CWE-89) located in the delstaffinfo.php file. The application fails to properly sanitize the userid parameter, which allows an unauthenticated remote attacker to manipulate database queries.

Business Impact

Successful exploitation allows an attacker to gain unauthorized access to the database, potentially leading to sensitive data leakage, unauthorized data modification, or complete system compromise. With a CVSS score of 7.3, this vulnerability represents a high risk to business continuity and data integrity, as it provides a direct vector for attackers to bypass application logic and extract proprietary information.

Remediation Plan

Immediate Action: As no official patch is available, administrators should restrict network access to the delstaffinfo.php endpoint or disable the affected functionality entirely until the vendor provides a secure update.

Proactive Monitoring: Review web server access logs for anomalous GET requests containing SQL syntax patterns, such as UNION, SELECT, or SLEEP commands, targeting the delstaffinfo.php file.

Compensating Controls: Implement a Web Application Firewall (WAF) rule to inspect and block incoming traffic containing common SQL injection payloads directed at the userid parameter.

Exploitation Status

Public Exploit Available: Yes, a published proof-of-concept exists, as documented in the referenced GitHub issue.

Analyst Notes: As of April 1, 2026, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The vulnerability is highly accessible as it requires no authentication or special privileges.

Analyst Recommendation

Given the availability of public exploit material and the lack of a vendor-supplied patch, this vulnerability poses a significant risk to any deployment of the Simple Laundry System. Organizations should prioritize isolating the affected system from public-facing networks and implement strict input validation at the WAF level to prevent unauthorized database access.

Description Summary:
A SQL injection vulnerability in the Simple Laundry System 1.0 /modify.php file allows unauthenticated attackers to execute arbitrary SQL queries via the firstName parameter.

Executive Summary:
A critical SQL injection vulnerability in code-projects Simple Laundry System 1.0 allows unauthenticated remote attackers to compromise the underlying database.

Vulnerability Details

CVE-ID: CVE-2026-5256

Affected Software: code-projects Simple Laundry System

Affected Versions: 1.0

Vulnerability: This is a SQL injection vulnerability (CWE-89) located in the /modify.php file. The application fails to sanitize the firstName parameter before passing it to database queries, enabling unauthenticated attackers to manipulate SQL commands.

Business Impact

Successful exploitation allows an attacker to gain unauthorized access to the database, leading to potential data theft, modification, or deletion of sensitive records. Given the CVSS score of 7.3, this represents a high risk to data integrity and confidentiality, potentially resulting in full system control or significant operational disruption.

Remediation Plan

Immediate Action: Since no official patch is available, administrators should restrict access to the /modify.php endpoint or disable the affected module entirely until a secure version is released.

Proactive Monitoring: Review database logs for unusual query patterns, such as unexpected use of RLIKE or SLEEP functions, and monitor web server access logs for anomalous POST requests to /modify.php.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to detect and block SQL injection payloads targeting the firstName parameter.

Exploitation Status

Public Exploit Available: Yes, a published proof-of-concept exists as documented in the linked GitHub security issue.

Analyst Notes: As of April 1, 2026, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The vulnerability is highly accessible as it requires no authentication to trigger.

Analyst Recommendation

The presence of a public proof-of-concept and the lack of a vendor-provided patch necessitate immediate defensive action. Organizations utilizing Simple Laundry System 1.0 must prioritize implementing network-level filtering and WAF protections to mitigate this threat until a permanent code-level fix is developed and applied.

Description Summary:
The Student Membership System 1.0 is vulnerable to unauthenticated SQL injection via the admin login page, allowing attackers to bypass authentication and gain full administrative access.

Executive Summary:
A critical SQL injection vulnerability in the code-projects Student Membership System allows unauthenticated attackers to bypass authentication and gain full administrative control over the application.

Vulnerability Details

CVE-ID: CVE-2026-5198

Affected Software: code-projects Student Membership System

Affected Versions: 1.0

Vulnerability: This vulnerability is a SQL injection flaw located in the admin/index.php file, where user-supplied input for the username and password fields is directly concatenated into database queries without sanitization. An unauthenticated attacker can supply crafted input to bypass the authentication mechanism entirely.

Business Impact

Successful exploitation grants an attacker full administrative access to the Student Membership System. This allows for unauthorized data modification, deletion of records, and the creation of new administrator accounts, posing a severe risk to data integrity and system security. With a CVSS score of 7.3, this high-severity vulnerability represents a significant threat to any organization relying on this software for identity or membership management.

Remediation Plan

Immediate Action: As no official vendor patch is currently available, administrators should immediately restrict access to the /admin/index.php endpoint at the network or web server level.

Proactive Monitoring: Review web server access logs for anomalous POST requests to the login page containing SQL syntax, such as single quotes, OR operators, or tautological logic like '1'='1'.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to detect and block SQL injection patterns targeting the login endpoint.

Exploitation Status

Public Exploit Available: Yes, a public proof-of-concept is available via the researcher's GitHub issue report.

Analyst Notes: As of April 1, 2026, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The vulnerability is highly exploitable due to the insecure use of direct string concatenation in SQL queries, which is a trivial vector for attackers to bypass authentication.

Analyst Recommendation

Given the ease of exploitation and the critical nature of gaining administrative access, this vulnerability must be treated with high urgency. Organizations are advised to implement strict access controls or disable the administrative interface until a formal patch is released by the developer. Implementing input validation or transitioning to prepared statements is the only viable long-term solution to eliminate this injection risk.

Description Summary:
A SQL injection vulnerability exists in the User Registration Handler of the code-projects Student Membership System 1.0, allowing remote unauthenticated attackers to manipulate database queries.

Executive Summary:
A remote SQL injection vulnerability in the code-projects Student Membership System 1.0 poses a significant risk of unauthorized database interaction.

Vulnerability Details

CVE-ID: CVE-2026-5195

Affected Software: code-projects Student Membership System

Affected Versions: 1.0

Vulnerability: This vulnerability is a SQL injection (CWE-89) located within the User Registration Handler component. The flaw permits an unauthenticated remote attacker to execute malicious SQL commands by manipulating input parameters.

Business Impact

The ability for an unauthenticated attacker to inject arbitrary SQL commands represents a severe risk to data integrity and confidentiality. Successful exploitation could lead to unauthorized access to sensitive user data, potential modification of registration records, or disruption of database services. With a CVSS score of 7.3, this high-severity vulnerability requires immediate attention to prevent unauthorized access to the underlying application database.

Remediation Plan

Immediate Action: As no official patch is currently available, administrators should restrict access to the registration module or disable the affected Student Membership System component until a vendor-supplied update is released.

Proactive Monitoring: Security teams should monitor database logs for abnormal query patterns, specifically looking for SQL syntax errors or unexpected data retrieval attempts originating from the registration handler.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to detect and block common SQL injection patterns in HTTP requests directed at the application registration endpoints.

Exploitation Status

Public Exploit Available: No (exploit_available: false).

Analyst Notes: As of April 1, 2026, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The vulnerability is inherently dangerous because it allows remote, unauthenticated access to the database layer.

Analyst Recommendation

Given the potential for unauthorized data access and the existence of a proof-of-concept, this vulnerability should be prioritized for mitigation. Organizations currently running version 1.0 of the Student Membership System must implement the suggested WAF controls or restrict network access to the application immediately. Close coordination with the vendor is advised to ensure that security updates are applied as soon as they become available.

Description Summary:
A SQL injection vulnerability exists in the Accounting System 1.0 /viewin_costumer.php file, allowing unauthenticated attackers to execute arbitrary database queries via the cos_id parameter.

Executive Summary:
An unauthenticated SQL injection vulnerability in code-projects Accounting System 1.0 poses a critical risk of unauthorized database access and potential system compromise.

Vulnerability Details

CVE-ID: CVE-2026-5150

Affected Software: code-projects Accounting System

Affected Versions: 1.0

Vulnerability: This is a SQL injection vulnerability (CWE-89) located in the /viewin_costumer.php file. An unauthenticated attacker can manipulate the cos_id parameter to inject malicious SQL commands, which are executed by the backend database without proper validation or sanitization.

Business Impact

Successful exploitation allows an attacker to gain unauthorized access to the underlying database, which may lead to sensitive data leakage, modification, or deletion of records. Given the CVSS score of 7.3, this flaw represents a significant risk to data integrity and confidentiality, potentially resulting in service interruption or full system compromise.

Remediation Plan

Immediate Action: As no official vendor patch is currently available, administrators should restrict network access to the affected /viewin_costumer.php endpoint or disable the vulnerable module entirely.

Proactive Monitoring: Monitor database query logs for unusual patterns, such as unexpected UNION statements, sleep commands, or concatenated strings that indicate automated SQL injection attempts.

Compensating Controls: Deploy a Web Application Firewall (WAF) with custom rules configured to block malicious SQL injection payloads targeting the cos_id parameter.

Exploitation Status

Public Exploit Available: Yes, a published proof-of-concept exists as detailed in the researcher write-up on GitHub.

Analyst Notes: As of April 1, 2026, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The vulnerability is highly exploitable due to the lack of authentication requirements and the direct reflection of user input in SQL queries.

Analyst Recommendation

Organizations utilizing code-projects Accounting System 1.0 must prioritize the mitigation of this vulnerability, as the lack of authentication makes it trivial for remote attackers to exploit. Until a vendor-supplied patch is released, implementing robust input validation and strict network access controls is essential to prevent unauthorized access to the application database.

Description Summary:
A SQL injection vulnerability in the view_work.php file of code-projects Accounting System 1.0 allows unauthenticated remote attackers to manipulate the en_id parameter to execute arbitrary SQL queries.

Executive Summary:
A critical SQL injection vulnerability in code-projects Accounting System 1.0 allows unauthenticated attackers to compromise database integrity and potentially gain full system control.

Vulnerability Details

CVE-ID: CVE-2026-5035

Affected Software: code-projects Accounting System

Affected Versions: 1.0

Vulnerability: The application fails to properly sanitize the en_id parameter within the /view_work.php file, which is directly processed in SQL queries. This flaw permits unauthenticated users to perform SQL injection attacks to bypass security controls and access sensitive information.

Business Impact

Successful exploitation of this vulnerability can lead to unauthorized access to the underlying database, resulting in the theft of sensitive financial or personal data. Furthermore, an attacker may be able to modify or delete critical records, leading to severe data integrity loss, operational downtime, and potential regulatory non-compliance. With a CVSS score of 7.3, this vulnerability represents a high-risk entry point that could be leveraged for comprehensive system compromise.

Remediation Plan

Immediate Action: As no official patch is currently available, administrators should restrict access to the Accounting System or disable the vulnerable /view_work.php file until the vendor releases a security update.

Proactive Monitoring: Security teams should review web server access logs for anomalous GET requests containing SQL syntax, such as UNION, SELECT, or SLEEP commands, targeting the en_id parameter.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to detect and block common SQL injection patterns targeting the Accounting System application.

Exploitation Status

Public Exploit Available: Yes, a published proof-of-concept exists, as documented in the GitHub research write-up referenced in the CVE record.

Analyst Notes: As of March 30, 2026, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The vulnerability is inherently easy to exploit due to the lack of required authentication.

Analyst Recommendation

Given the availability of public proof-of-concept code and the lack of a vendor-provided patch, this vulnerability poses a significant risk to any organization running Accounting System 1.0. Organizations must prioritize immediate isolation of the affected instance or the implementation of strict WAF filtering to prevent unauthorized database access. Continuous monitoring for indicators of compromise is essential until a formal update is released and applied.

Description Summary:
A SQL injection vulnerability in the /edit_costumer.php file of code-projects Accounting System 1.0 allows unauthenticated remote attackers to manipulate database queries via the cos_id parameter.

Executive Summary:
An unauthenticated SQL injection vulnerability in code-projects Accounting System 1.0 allows remote attackers to compromise database integrity and confidentiality.

Vulnerability Details

CVE-ID: CVE-2026-5034

Affected Software: code-projects Accounting System

Affected Versions: 1.0

Vulnerability: This is a SQL injection vulnerability (CWE-89) located in the /edit_costumer.php file. The application fails to sanitize the cos_id parameter, allowing an unauthenticated attacker to execute arbitrary SQL commands against the backend database.

Business Impact

Successful exploitation of this flaw allows attackers to bypass authentication, access sensitive information, modify or delete database records, and potentially achieve full system compromise. Given the CVSS score of 7.3, this represents a significant risk to data integrity and business continuity, as it allows unauthorized control over the primary accounting data store.

Remediation Plan

Immediate Action: As no official vendor patch is available, administrators must restrict access to the /edit_costumer.php endpoint or disable the affected module entirely until a secure version is released.

Proactive Monitoring: Review web server and database logs for anomalous query patterns, specifically looking for SQL syntax characters or error-based payloads targeting the cos_id parameter.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to detect and block SQL injection patterns, particularly those involving GET requests to the identified vulnerable script.

Exploitation Status

Public Exploit Available: Yes, a functional proof-of-concept exists as documented in the researcher's GitHub repository.

Analyst Notes: As of March 30, 2026, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The vulnerability is highly exploitable due to the lack of required authentication.

Analyst Recommendation

This vulnerability presents a high risk due to the ease of exploitation and the potential for total database compromise. Organizations utilizing this software must implement immediate network-level restrictions or WAF-based mitigations to prevent unauthenticated access, as no formal vendor patch is currently available to resolve the underlying code flaw.

Description Summary:
A SQL injection vulnerability in the view_costumer.php file of code-projects Accounting System 1.0 allows unauthenticated remote attackers to manipulate queries via the cos_id parameter.

Executive Summary:
An unauthenticated SQL injection vulnerability in code-projects Accounting System 1.0 allows remote attackers to compromise database integrity and access sensitive information.

Vulnerability Details

CVE-ID: CVE-2026-5033

Affected Software: code-projects Accounting System

Affected Versions: 1.0

Vulnerability: The application fails to properly sanitize user input provided to the cos_id parameter in the /view_costumer.php file. This allows an unauthenticated remote attacker to inject malicious SQL commands, facilitating unauthorized database queries or data modification.

Business Impact

Successful exploitation of this SQL injection vulnerability can lead to unauthorized database access, sensitive data leakage, and potential full system compromise. Given the CVSS score of 7.3, this represents a significant risk to data confidentiality and integrity, which may lead to severe reputational damage and regulatory noncompliance for organizations using this software.

Remediation Plan

Immediate Action: As no official patch is currently available, administrators should restrict network access to the application to trusted IP ranges and disable the affected functionality if it is not business-critical.

Proactive Monitoring: Monitor web server access logs for anomalous GET requests containing SQL syntax patterns, such as UNION, SELECT, or SLEEP commands, directed at the view_costumer.php endpoint.

Compensating Controls: Implement a Web Application Firewall (WAF) with rules configured to block common SQL injection patterns and sanitize incoming traffic to the application.

Exploitation Status

Public Exploit Available: Yes, a published proof-of-concept exists as documented in the security researcher's GitHub write-up.

Analyst Notes: As of March 30, 2026, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The vulnerability is highly exploitable due to the lack of required authentication.

Analyst Recommendation

The presence of a public proof-of-concept combined with the lack of authentication required to execute this attack makes this a high-priority risk. Organizations must treat this vulnerability as critical until the vendor releases an official security update and should prioritize the implementation of WAF rules or network segmentation to mitigate the risk of unauthorized database access.

Description Summary:
A critical SQL injection vulnerability exists in the Simple Food Order System 1.0 via the status parameter in all-orders.php, allowing unauthenticated remote attackers to manipulate database queries.

Executive Summary:
An unauthenticated SQL injection vulnerability in the Simple Food Order System 1.0 allows remote attackers to compromise the underlying database and potentially achieve full system control.

Vulnerability Details

CVE-ID: CVE-2026-5019

Affected Software: code-projects Simple Food Order System

Affected Versions: 1.0

Vulnerability: This is a SQL injection vulnerability (CWE-89) located in the all-orders.php file. The application fails to sanitize the status parameter before using it in SQL queries, allowing an unauthenticated remote attacker to execute arbitrary database commands.

Business Impact

Successful exploitation of this vulnerability permits unauthorized access to sensitive application data, including potential user credentials, order history, and administrative information. Given the CVSS score of 7.3, this flaw poses a high risk to business operations, as it enables data exfiltration, unauthorized modification of records, and potential service disruption. The ability for an unauthenticated user to interact directly with the database significantly lowers the barrier for malicious actors.

Remediation Plan

Immediate Action: As no official vendor patch is currently available, administrators should restrict network access to the application and implement strict input validation on the status parameter.

Proactive Monitoring: Monitor database query logs for suspicious patterns, such as unexpected use of SQL syntax (e.g., UNION, SLEEP, or boolean-based blind injection patterns) originating from the all-orders.php endpoint.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to block SQL injection attempts and malicious payloads targeting URL parameters.

Exploitation Status

Public Exploit Available: Yes, a published proof-of-concept exists and is documented in the referenced GitHub issue.

Analyst Notes: As of March 30, 2026, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The vulnerability is highly exploitable as it requires no prior authentication or administrative privileges to interact with the vulnerable parameter.

Analyst Recommendation

The vulnerability represents a significant security risk due to its unauthenticated nature and the existence of a public proof-of-concept. Organizations utilizing Simple Food Order System 1.0 must treat this as a high-priority issue. Until a formal vendor patch is released, administrators should prioritize network isolation and the deployment of WAF rules to mitigate the risk of unauthorized database manipulation.

Description Summary:
A SQL injection vulnerability exists in the register-router.php file of the Simple Food Order System 1.0, allowing remote unauthenticated attackers to manipulate the name parameter for unauthorized access.

Executive Summary:
A critical SQL injection vulnerability in the Code-Projects Simple Food Order System 1.0 enables remote, unauthenticated attackers to compromise database integrity and access sensitive data.

Vulnerability Details

CVE-ID: CVE-2026-5018

Affected Software: Code-Projects Simple Food Order System

Affected Versions: 1.0

Vulnerability: The application fails to properly sanitize the name parameter within the register-router.php script before incorporating it into database queries. This flaw allows an unauthenticated remote attacker to perform SQL injection attacks to manipulate database operations.

Business Impact

Successful exploitation of this vulnerability can lead to unauthorized database access, sensitive data exfiltration, and potential system-wide compromise. Given the CVSS score of 7.3, this flaw presents a high risk to business operations, as it allows attackers to bypass security controls to read, modify, or destroy information stored within the application database.

Remediation Plan

Immediate Action: As no official patch is currently available, administrators should restrict access to the register-router.php endpoint or disable the registration functionality if it is not business-critical until a vendor update is released.

Proactive Monitoring: Review web server and database logs for anomalous query patterns, specifically looking for SQL keywords or time-based delay signatures associated with the name parameter.

Compensating Controls: Implement a Web Application Firewall (WAF) rule to inspect and block incoming POST requests containing SQL injection payloads targeting the name parameter.

Exploitation Status

Public Exploit Available: Yes, a published proof-of-concept exists and is documented in the referenced GitHub issue.

Analyst Notes: As of March 30, 2026, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The vulnerability is highly accessible because it requires no authentication and utilizes standard SQL injection techniques.

Analyst Recommendation

The presence of a publicly available proof-of-concept combined with the lack of authentication requirements makes this vulnerability a significant risk. Organizations utilizing the Simple Food Order System 1.0 must prioritize the implementation of compensating controls, such as WAF filtering, and actively monitor for unauthorized database activity until a formal security update is provided by the vendor.

Description Summary:
A SQL injection vulnerability in the Simple Food Order System 1.0 allows unauthenticated remote attackers to execute arbitrary database queries via the status parameter in all-tickets.php.

Executive Summary:
An unauthenticated SQL injection vulnerability in the Simple Food Order System 1.0 poses a critical risk of full database compromise and unauthorized data access.

Vulnerability Details

CVE-ID: CVE-2026-5017

Affected Software: code-projects Simple Food Order System

Affected Versions: 1.0

Vulnerability: This is a SQL injection vulnerability (CWE-89) located in the all-tickets.php file. The application fails to properly sanitize the status parameter before using it in database queries, allowing an unauthenticated remote attacker to inject malicious SQL commands.

Business Impact

Successful exploitation of this flaw allows attackers to bypass authentication and execute arbitrary commands against the underlying database. This can lead to the exfiltration of sensitive information, unauthorized modification or deletion of data, and potential full system compromise, resulting in significant business disruption and reputational damage. Given the CVSS score of 7.3, this vulnerability represents a high-severity risk that requires immediate attention.

Remediation Plan

Immediate Action: As no official vendor patch is currently available, administrators should immediately restrict network access to the application or take the service offline until a fix is implemented. Developers must refactor the affected code to use prepared statements with parameterized queries instead of direct input concatenation.

Proactive Monitoring: Monitor web server access logs for anomalous GET requests containing SQL syntax, such as UNION, SLEEP, or boolean-based injection patterns targeting the all-tickets.php endpoint.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to detect and block common SQL injection payloads in the status parameter to provide a layer of virtual patching.

Exploitation Status

Public Exploit Available: Yes — a published proof-of-concept exists, as documented in the security researcher's write-up on GitHub.

Analyst Notes: As of March 30, 2026, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The vulnerability is highly exploitable due to the lack of required authentication.

Analyst Recommendation

The presence of a public proof-of-concept combined with the lack of authentication requirements makes this a high-priority risk. Organizations currently running Simple Food Order System 1.0 must prioritize isolating these instances from public access and implementing strict input validation or WAF protections to mitigate the threat of database exploitation until a definitive security update is released.

Description Summary:
A SQL injection vulnerability exists in the Simple Laundry System 1.0 checklogin.php file, allowing unauthenticated remote attackers to manipulate database queries via the userName parameter.

Executive Summary:
A critical SQL injection vulnerability in the Simple Laundry System 1.0 allows unauthenticated attackers to execute arbitrary database queries, leading to potential data compromise and system control.

Vulnerability Details

CVE-ID: CVE-2026-4581

Affected Software: code-projects Simple Laundry System

Affected Versions: 1.0

Vulnerability: The application fails to properly sanitize user input provided to the userName parameter in the /checklogin.php file. This allows an unauthenticated attacker to inject malicious SQL commands directly into the backend database.

Business Impact

Successful exploitation of this vulnerability grants an attacker the ability to bypass authentication, exfiltrate sensitive data, modify or delete database records, and potentially gain full control over the underlying server. With a CVSS score of 7.3, this flaw represents a significant risk to the confidentiality, integrity, and availability of business information stored within the system.

Remediation Plan

Immediate Action: As no official patch is available, administrators should restrict access to the /checklogin.php endpoint via network controls or firewall rules until the vendor releases a secure update.

Proactive Monitoring: Review web server access logs for anomalous POST requests to /checklogin.php, particularly those containing SQL syntax characters such as single quotes, semicolons, or comments.

Compensating Controls: Deploy a Web Application Firewall (WAF) with strict SQL injection filtering rules to inspect and block malicious payloads targeting the userName parameter.

Exploitation Status

Public Exploit Available: Yes, a published proof-of-concept exists as documented in the GitHub issue referenced by the researcher.

Analyst Notes: As of March 24, 2026, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The vulnerability is highly exploitable as it requires no prior authentication or specialized privileges.

Analyst Recommendation

The presence of a functional proof-of-concept for this SQL injection vulnerability necessitates immediate defensive action. Organizations utilizing Simple Laundry System 1.0 must prioritize the implementation of compensating controls, such as WAF rules, and monitor for unauthorized database activity while awaiting a formal vendor security update.

Description Summary:
A SQL injection vulnerability in the Simple Laundry System 1.0 allows unauthenticated remote attackers to execute arbitrary SQL commands via the serviceId parameter in /checkupdatestatus.php.

Executive Summary:
A critical SQL injection vulnerability in code-projects Simple Laundry System 1.0 allows unauthenticated remote attackers to compromise the underlying database.

Vulnerability Details

CVE-ID: CVE-2026-4580

Affected Software: code-projects Simple Laundry System

Affected Versions: 1.0

Vulnerability: This vulnerability is a SQL injection flaw (CWE-89) located in the /checkupdatestatus.php file. An unauthenticated attacker can supply malicious input to the serviceId parameter to manipulate database queries directly.

Business Impact

Successful exploitation allows an attacker to gain unauthorized access to the application database, potentially leading to sensitive data exfiltration, unauthorized modification or deletion of records, and complete system compromise. Given the CVSS score of 7.3 and the unauthenticated nature of the attack vector, this represents a significant risk to data confidentiality and integrity.

Remediation Plan

Immediate Action: Since no official patch is available, administrators should restrict access to the /checkupdatestatus.php endpoint at the network or web server level. If the functionality is not required, disable or remove the affected file from the production environment.

Proactive Monitoring: Monitor web server access logs for suspicious patterns in the serviceId parameter, specifically looking for SQL keywords, boolean logic, or time-based delay commands.

Compensating Controls: Implement a Web Application Firewall (WAF) with strict SQL injection protection rules to inspect and filter incoming traffic targeting the /checkupdatestatus.php endpoint.

Exploitation Status

Public Exploit Available: Yes, a published proof-of-concept exists, as documented in the associated GitHub security issue.

Analyst Notes: As of March 24, 2026, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The vulnerability is inherently easy to exploit due to the lack of required authentication and the direct usage of unsanitized user input in SQL queries.

Analyst Recommendation

Due to the availability of a public proof-of-concept and the ease of exploitation, this vulnerability poses a credible threat to any deployment of Simple Laundry System 1.0. Organizations should treat this as a high priority and apply the recommended compensating controls immediately, as the lack of a vendor-provided patch leaves the system exposed to unauthorized database manipulation.

Description Summary:
A SQL injection vulnerability in the Simple Laundry System 1.0 /viewdetail.php file allows unauthenticated attackers to manipulate the serviceId parameter to execute unauthorized database queries.

Executive Summary:
A critical SQL injection vulnerability in code-projects Simple Laundry System 1.0 exposes the underlying database to unauthorized manipulation by unauthenticated remote attackers.

Vulnerability Details

CVE-ID: CVE-2026-4579

Affected Software: code-projects Simple Laundry System

Affected Versions: 1.0

Vulnerability: This is a SQL injection flaw (CWE-89) located in the /viewdetail.php file. An unauthenticated attacker can supply malicious input via the serviceId GET parameter, which is processed by the application without sufficient validation or parameterization.

Business Impact

The exploitation of this vulnerability allows for unauthorized database access, which may lead to the exfiltration of sensitive information, data tampering, or total system compromise. Given the CVSS score of 7.3, this represents a high-severity risk that could result in significant service interruption and loss of data integrity for the affected organization.

Remediation Plan

Immediate Action: As no official patch is currently available, administrators should restrict access to the /viewdetail.php endpoint or disable the affected module entirely until the vendor releases a security update.

Proactive Monitoring: Review web server access logs for anomalous GET requests targeting /viewdetail.php, specifically searching for SQL-related keywords or characters like 'UNION', 'SELECT', 'SLEEP', or hexadecimal patterns.

Compensating Controls: Deploy a Web Application Firewall (WAF) rule to block or sanitize requests containing SQL injection patterns targeting the serviceId parameter.

Exploitation Status

Public Exploit Available: Yes, a published proof-of-concept exists and is documented in the security researcher's GitHub repository.

Analyst Notes: As of March 24, 2026, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The vulnerability is highly accessible because it requires no authentication to trigger via a simple GET request.

Analyst Recommendation

The presence of a public proof-of-concept significantly elevates the risk of automated exploitation. Organizations utilizing Simple Laundry System 1.0 must prioritize implementing compensating controls, such as WAF rules, and restrict network access to the application immediately while awaiting a formal vendor patch.

Description Summary:
A SQL injection vulnerability exists in the Simple Food Order System 1.0 via the price parameter in add-item.php, allowing unauthenticated attackers to execute arbitrary database queries.

Executive Summary:
The Simple Food Order System 1.0 contains a critical SQL injection vulnerability that permits unauthenticated remote attackers to compromise database integrity and confidentiality.

Vulnerability Details

CVE-ID: CVE-2026-4319

Affected Software: code-projects Simple Food Order System

Affected Versions: 1.0

Vulnerability: This is a SQL injection vulnerability (CWE-89) located in the add-item.php file. It occurs because the application fails to sanitize or validate the price parameter before incorporating it into SQL queries, allowing an unauthenticated attacker to manipulate database operations.

Business Impact

Successful exploitation of this vulnerability allows an attacker to gain unauthorized access to the underlying database, potentially leading to the leakage of sensitive data, unauthorized modification or deletion of records, and total system compromise. Given the CVSS score of 7.3, this represents a high-severity risk that could lead to significant operational disruption and loss of data integrity.

Remediation Plan

Immediate Action: As no official vendor patch is currently available, administrators should restrict network access to the application or disable the vulnerable add-item.php functionality until a fix can be implemented.

Proactive Monitoring: Security teams should monitor web access logs for suspicious POST requests to add-item.php, specifically looking for SQL syntax patterns or time-based delay signatures consistent with SQL injection attempts.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to block common SQL injection payloads and restrict input to the price parameter to numeric values only.

Exploitation Status

Public Exploit Available: Yes, a public proof-of-concept is available via the researcher's GitHub issue report.

Analyst Notes: As of March 19, 2026, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The vulnerability is highly accessible as it requires no authentication to trigger.

Analyst Recommendation

The presence of a publicly available proof-of-concept significantly increases the risk of exploitation by malicious actors. Organizations currently running Simple Food Order System 1.0 must prioritize the implementation of compensating controls or isolate the application from external networks to prevent unauthorized data access. If the software is no longer maintained, consider migrating to a more secure and supported alternative.

Description Summary:
A high-severity vulnerability in code-projects Student Web Portal 1 could allow an attacker to gain unauthorized access to sensitive academic and personal data.

Executive Summary:
The code-projects Student Web Portal 1 is affected by a security vulnerability that could lead to a complete compromise of student information systems.

Vulnerability Details

CVE-ID: CVE-2026-3744

Affected Software: code-projects Student Web Portal

Affected Versions: 1

Vulnerability: A vulnerability was identified in version 1 of the Student Web Portal. The flaw likely involves improper input validation or broken access control, potentially allowing an attacker to interact with the portal's backend without appropriate authorization.

Business Impact

The impact of this vulnerability is severe, as it threatens the privacy of student records and institutional data. With a CVSS score of 7.3, the risk includes unauthorized data modification and potential identity theft, which could lead to legal non-compliance and a loss of trust within the educational community.

Remediation Plan

Immediate Action: Update the Student Web Portal to the latest version provided by the vendor to close the identified security gap.

Proactive Monitoring: Review application access logs for any anomalous administrative activity or unauthorized attempts to access student profiles.

Compensating Controls: Restrict access to the web portal via a VPN or IP allowlisting to ensure only authorized users can reach the vulnerable interface.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of March 9, 2026, there is no public information indicating active exploitation of this vulnerability. However, student portals are frequent targets for unauthorized data harvesting, making rapid remediation essential.

Analyst Recommendation

The High-severity rating and the sensitive nature of student data necessitate immediate intervention. IT departments should verify their current software version and apply the necessary security updates without delay to prevent potential exploitation.

Description Summary:
A SQL injection vulnerability in the Simple Flight Ticket Booking System allows unauthenticated remote attackers to execute arbitrary database queries via the from parameter in SearchResultRoundtrip.php.

Executive Summary:
The Simple Flight Ticket Booking System version 1.0 is vulnerable to unauthenticated SQL injection, which could allow a remote attacker to compromise the underlying database.

Vulnerability Details

CVE-ID: CVE-2026-3736

Affected Software: code-projects Simple Flight Ticket Booking System

Affected Versions: 1.0

Vulnerability: This is a SQL injection vulnerability (CWE-89) located in the SearchResultRoundtrip.php file. The application fails to properly sanitize the from parameter before including it in SQL queries, allowing an unauthenticated attacker to manipulate database operations.

Business Impact

Successful exploitation allows an attacker to gain unauthorized access to the application database, potentially leading to sensitive data leakage, data modification, or complete system compromise. Given the CVSS score of 7.3, this represents a significant security risk, as the vulnerability is remotely exploitable without authentication and could lead to total loss of confidentiality and integrity within the booking system.

Remediation Plan

Immediate Action: As no official patch is currently available, administrators should immediately restrict access to the application via network-level controls until code-level remediation is implemented.

Proactive Monitoring: Monitor web server logs for suspicious POST requests to SearchResultRoundtrip.php containing SQL syntax characters, such as single quotes, RLIKE keywords, or sleep commands.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to detect and block SQL injection patterns specifically targeting the from parameter.

Exploitation Status

Public Exploit Available: Yes, a published proof-of-concept exists as documented in the GitHub issue referenced by the researcher.

Analyst Notes: As of March 10, 2026, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The vulnerability is highly accessible due to the lack of required authentication.

Analyst Recommendation

The severity of this vulnerability, combined with the availability of public proof-of-concept material, necessitates immediate defensive action. Organizations utilizing this system must prioritize restricting external access to the vulnerable endpoint and should actively seek to replace the vulnerable component or implement the recommended prepared statements to prevent further exposure.

Description Summary:
A SQL injection vulnerability exists in the SearchResultOneway.php file of the Simple Flight Ticket Booking System 1.0, allowing unauthenticated attackers to manipulate database queries.

Executive Summary:
An unauthenticated SQL injection vulnerability in the Simple Flight Ticket Booking System 1.0 allows remote attackers to compromise the underlying database, posing a high risk to data integrity and confidentiality.

Vulnerability Details

CVE-ID: CVE-2026-3735

Affected Software: code-projects Simple Flight Ticket Booking System

Affected Versions: 1.0

Vulnerability: This vulnerability occurs due to improper neutralization of special elements used in an SQL command within the 'from' parameter of the SearchResultOneway.php script. An unauthenticated remote attacker can inject arbitrary SQL commands to manipulate database operations.

Business Impact

The exploitation of this flaw can result in unauthorized access to sensitive passenger and system data, potential data modification or deletion, and unauthorized administrative control over the database. Given the CVSS score of 7.3, this represents a high-severity risk that could lead to significant reputational damage and business disruption if the database is utilized for processing flight bookings or personal information.

Remediation Plan

Immediate Action: As no official patch is currently available, administrators should restrict access to the application via a firewall or by placing the application behind a VPN/authentication proxy. Developers should implement prepared statements with parameterized queries for the 'from' parameter in SearchResultOneway.php to eliminate the injection vector.

Proactive Monitoring: Review web server access logs for anomalous POST requests containing SQL keywords or characters such as single quotes, parentheses, or RLIKE/SLEEP functions directed at the SearchResultOneway.php endpoint.

Compensating Controls: Deploy a Web Application Firewall (WAF) configured with rules to detect and block common SQL injection patterns targeting the application's search parameters.

Exploitation Status

Public Exploit Available: Yes, a published proof-of-concept exists, as documented in the GitHub issue referenced by the researcher.

Analyst Notes: As of March 10, 2026, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The vulnerability is highly exploitable due to the lack of required authentication.

Analyst Recommendation

Given the availability of a public proof-of-concept and the trivial nature of the exploit, immediate attention is required. Organizations using this software must treat this as a high-priority risk and implement the suggested compensating controls or code-level mitigations to prevent unauthorized database access.

Description Summary:
Another security flaw has been discovered in version 1 of the code-projects Simple Flight Ticket Booking System, affecting its overall security.

Executive Summary:
The Simple Flight Ticket Booking System version 1 contains an additional high-severity vulnerability that further increases the risk of system compromise.

Vulnerability Details

CVE-ID: CVE-2026-3723

Affected Software: code-projects Simple Flight Ticket Booking System

Affected Versions: Version 1

Vulnerability: This is yet another security flaw identified in version 1 of the Simple Flight Ticket Booking System. The vulnerability likely pertains to session management or insecure data storage, which could be exploited by an attacker to gain persistent access to the system.

Business Impact

The CVSS score of 7.3 confirms the High severity of this flaw. If exploited alongside other vulnerabilities in this product, an attacker could achieve complete control over the application, leading to massive data exfiltration and the total disruption of booking services.

Remediation Plan

Immediate Action: Apply all available security updates for the Simple Flight Ticket Booking System version 1 immediately.

Proactive Monitoring: Implement comprehensive logging for all administrative actions and monitor for any unauthorized changes to the application's source code or configuration files.

Compensating Controls: Deploy the application within a containerized environment to limit the impact of a potential compromise and use a WAF to block known exploit payloads.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of March 9, 2026, there is no public information indicating active exploitation of this vulnerability. The clustering of several CVEs for this product highlights a critical need for immediate remediation.

Analyst Recommendation

The cumulative risk of multiple high-severity vulnerabilities in a single product version is extreme. Administrators must apply all relevant patches immediately or consider transitioning to a more robust and frequently audited booking solution to ensure data security.

Description Summary:
A weakness in code-projects Simple Flight Ticket Booking System version 1 has been identified, potentially allowing for data manipulation or unauthorized access.

Executive Summary:
A high-severity weakness in the Simple Flight Ticket Booking System version 1 poses a risk to the integrity and confidentiality of the booking database.

Vulnerability Details

CVE-ID: CVE-2026-3709

Affected Software: code-projects Simple Flight Ticket Booking System

Affected Versions: Version 1

Vulnerability: This vulnerability represents a distinct weakness from other flaws in the same product version. It likely involves improper input validation, which could be exploited to perform SQL injection or bypass authentication mechanisms within the booking workflow.

Business Impact

With a CVSS score of 7.3, this High severity vulnerability could result in the theft of user credentials or the unauthorized modification of flight prices and booking statuses, leading to financial discrepancies and a loss of organizational integrity.

Remediation Plan

Immediate Action: Update the application to the latest version provided by the vendor to resolve the identified security weakness.

Proactive Monitoring: Monitor database logs for unusual query patterns and implement alerts for failed authentication attempts to the administrative backend.

Compensating Controls: Implement strict input validation and output encoding across the entire application to mitigate the risk of common web-based attacks.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of March 9, 2026, there is no public information indicating active exploitation of this vulnerability. However, the discovery of multiple flaws in the same version suggests a broader need for a security audit of the software.

Analyst Recommendation

The presence of multiple vulnerabilities in version 1 of this software indicates a high risk for any organization using it. We recommend an immediate update and a review of the application's security posture to prevent potential data breaches.

Description Summary:
A security flaw in code-projects Simple Flight Ticket Booking System version 1 could lead to unauthorized access to booking records or user data.

Executive Summary:
The Simple Flight Ticket Booking System version 1 is vulnerable to a high-severity flaw that could expose sensitive traveler information and booking details.

Vulnerability Details

CVE-ID: CVE-2026-3708

Affected Software: code-projects Simple Flight Ticket Booking System

Affected Versions: Version 1

Vulnerability: A security flaw has been discovered in version 1 of this booking system. While the specific type is not defined, these systems are often susceptible to Broken Access Control (BAC) or Cross-Site Scripting (XSS), which could allow attackers to view or modify ticket information.

Business Impact

The CVSS score of 7.3 classifies this as a High severity vulnerability. Exploitation could lead to the exposure of Personal Identifiable Information (PII) of travelers, unauthorized ticket cancellations, and significant reputational damage to the service provider.

Remediation Plan

Immediate Action: Apply the latest security patches from code-projects or upgrade to a more modern booking platform.

Proactive Monitoring: Review web server logs for attempts to access booking IDs sequentially or other signs of insecure direct object reference (IDOR) attacks.

Compensating Controls: Use a Web Application Firewall (WAF) to filter malicious requests and ensure that all user sessions are properly validated before granting access to data.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of March 9, 2026, there is no public information indicating active exploitation of this vulnerability. These types of open-source projects are often utilized as templates, increasing the potential attack surface.

Analyst Recommendation

Protecting traveler data is a critical requirement for booking systems. Administrators should apply the necessary updates immediately and conduct a thorough review of access control logic to ensure that users can only access their own booking information.

Description Summary:
A SQL injection vulnerability in the Simple Flight Ticket Booking System 1.0 allows unauthenticated remote attackers to extract sensitive database information via the flightno parameter in Adminsearch.php.

Executive Summary:
The Simple Flight Ticket Booking System 1.0 is vulnerable to unauthenticated SQL injection, posing a significant risk of unauthorized data exposure.

Vulnerability Details

CVE-ID: CVE-2026-3705

Affected Software: code-projects Simple Flight Ticket Booking System

Affected Versions: 1.0

Vulnerability: This is a SQL injection vulnerability (CWE-89) located in the Adminsearch.php file. An unauthenticated attacker can supply a malicious payload through the flightno GET parameter, which the application fails to sanitize before executing a database query.

Business Impact

Successful exploitation allows an attacker to bypass security controls and extract sensitive information from the backend database, including user credentials and flight records. With a CVSS score of 7.3, this high-severity vulnerability could lead to significant data breaches, loss of customer privacy, and compromise of the underlying server environment.

Remediation Plan

Immediate Action: As no official patch is currently available, administrators should restrict access to the /Adminsearch.php file or disable the affected module entirely if it is not business critical.

Proactive Monitoring: Monitor web server access logs for anomalous GET requests containing SQL syntax, such as UNION, SELECT, or SLEEP commands directed at the /Adminsearch.php endpoint.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to detect and block common SQL injection patterns targeting the flightno parameter.

Exploitation Status

Public Exploit Available: Yes, a published proof-of-concept exists via the researcher's GitHub repository referenced in the CVE record.

Analyst Notes: As of March 9, 2026, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment, a proof-of-concept exists, so exploitation risk should be treated as credible. The vulnerability is inherently exploitable because the underlying code directly concatenates user-supplied input into a SQL statement.

Analyst Recommendation

Given the availability of public proof-of-concept code and the ease of remote exploitation, this vulnerability presents an urgent risk. Organizations using this software must implement immediate defensive measures, such as WAF filtering or access restrictions, until a vendor-supplied patch is released and verified. Prioritize the transition to a more secure booking platform if the vendor does not provide timely security updates.

Description Summary:
A security vulnerability has been identified in code-projects Online Reviewer System 1, which could allow an attacker to compromise the integrity and confidentiality of the application data.

Executive Summary:
The code-projects Online Reviewer System 1 contains a high-severity vulnerability that could allow attackers to perform unauthorized actions, potentially leading to a full system compromise.

Vulnerability Details

CVE-ID: CVE-2026-2912

Affected Software: code-projects Online Reviewer System

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: A vulnerability of an unspecified type was discovered in the Online Reviewer System 1. Based on the context of the platform, this likely involves a flaw in how the application handles user-supplied input or session management, potentially accessible to remote attackers.

Business Impact

A successful exploit of this vulnerability could lead to unauthorized access to sensitive reviewer data, modification of system records, or total administrative takeover. With a CVSS score of 7.3, this flaw represents a significant risk to organizational data integrity and could result in substantial reputational damage if student or reviewer information is leaked.

Remediation Plan

Immediate Action: IT administrators should apply the latest security updates provided by code-projects immediately to mitigate the risk of exploitation.

Proactive Monitoring: Organizations should monitor web server logs for unusual traffic patterns or unauthorized attempts to access administrative functions within the Reviewer System.

Compensating Controls: Implementing a Web Application Firewall (WAF) with updated signatures for common web attacks can provide temporary protection while updates are being deployed.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of February 23, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw and the high CVSS score, the potential for exploitation remains a serious concern for users of this software.

Analyst Recommendation

The high severity of this vulnerability necessitates immediate remediation. Organizations using the code-projects Online Reviewer System should prioritize the application of vendor-supplied patches and ensure that the application is not exposed to the public internet without robust authentication and monitoring controls.

Description Summary:
A SQL injection vulnerability in code-projects Online Reviewer System 1.0 allows remote, unauthenticated attackers to manipulate database queries via the ID argument in a specific PHP script.

Executive Summary:
The Online Reviewer System 1.0 is susceptible to remote SQL injection, which could allow an unauthenticated attacker to compromise backend database integrity.

Vulnerability Details

CVE-ID: CVE-2026-2223

Affected Software: code-projects Online Reviewer System

Affected Versions: 1.0

Vulnerability: This vulnerability is a SQL injection (CWE-89) flaw located in the file /system/system/students/assessments/pretest/take/index.php. The application fails to properly sanitize the ID argument, allowing an unauthenticated remote attacker to execute arbitrary SQL commands.

Business Impact

Successful exploitation of this vulnerability can lead to unauthorized access to sensitive data, modification of assessment records, or potential disruption of service within the Online Reviewer System. With a CVSS score of 7.3, this high-severity flaw poses a significant risk to data confidentiality and application availability, particularly if the database stores user or academic information.

Remediation Plan

Immediate Action: As no official patch is currently available, administrators should immediately restrict access to the affected script or disable the vulnerable module until a vendor-provided update is released.

Proactive Monitoring: Review web server access logs for suspicious patterns, specifically looking for SQL syntax characters or unexpected parameter values targeting the /system/system/students/assessments/pretest/take/index.php endpoint.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to detect and block common SQL injection payloads targeting the identified URL parameter.

Exploitation Status

Public Exploit Available: Yes, a published proof-of-concept exists as documented in the research write-up at the referenced GitHub repository.

Analyst Notes: As of February 10, 2026, there is no confirmed active exploitation in the wild; however, a public proof-of-concept exists, and the vulnerability is classified as exploitable by unauthenticated remote actors. Due to the lack of a vendor patch, the risk of exploitation remains elevated.

Analyst Recommendation

Given the availability of a public proof-of-concept and the ease of exploitation, organizations using the Online Reviewer System must prioritize isolating the affected application from public networks. IT teams should monitor the vendor for security patches and apply them immediately upon release to remediate this critical injection flaw.

Description Summary:
A SQL injection vulnerability exists in the login component of code-projects Online Reviewer System 1.0, allowing remote unauthenticated attackers to manipulate the username argument.

Executive Summary:
The Online Reviewer System 1.0 contains a critical SQL injection vulnerability that allows unauthenticated remote attackers to compromise the application database.

Vulnerability Details

CVE-ID: CVE-2026-2221

Affected Software: code-projects Online Reviewer System

Affected Versions: 1.0

Vulnerability: This vulnerability is a SQL injection flaw (CWE-89) located in the login index file. It allows an unauthenticated attacker to inject malicious SQL commands via the Username parameter.

Business Impact

Successful exploitation of this SQL injection vulnerability could lead to unauthorized access to sensitive application data, potential modification of database records, or a complete compromise of the backend database. With a CVSS score of 7.3, this represents a high-severity risk that could result in significant data breaches and loss of system integrity.

Remediation Plan

Immediate Action: Since no official patch is currently available, administrators should restrict access to the login portal via network-level controls or consider disabling the service until a fix is provided by the vendor.

Proactive Monitoring: Review application logs for anomalous SQL syntax or unexpected character patterns in login requests, particularly those targeting the Username field.

Compensating Controls: Deploy a Web Application Firewall (WAF) with specific rulesets designed to detect and block common SQL injection patterns in HTTP requests.

Exploitation Status

Public Exploit Available: Yes — a published proof-of-concept exists as documented in the referenced GitHub issue.

Analyst Notes: As of February 10, 2026, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The vulnerability is highly exploitable due to the lack of required authentication.

Analyst Recommendation

Given the availability of a public proof-of-concept and the ease of exploitation through the login interface, this vulnerability poses a significant risk to affected systems. Organizations should prioritize isolating the affected component from the public internet and implementing robust input validation or WAF protections while awaiting a formal vendor security update.

Description Summary:
An unauthenticated SQL injection vulnerability exists in code-projects Online Reviewer System 1.0 via the difficulty_id parameter in the admin assessment module.

Executive Summary:
A critical SQL injection vulnerability in code-projects Online Reviewer System 1.0 allows unauthenticated remote attackers to manipulate database queries.

Vulnerability Details

CVE-ID: CVE-2026-2220

Affected Software: code-projects Online Reviewer System

Affected Versions: 1.0

Vulnerability: This flaw is a SQL injection (CWE-89) triggered through the difficulty_id argument within the file /system/system/admins/assessments/pretest/btn_functions.php. The vulnerability is remotely exploitable without requiring authentication.

Business Impact

The ability for an unauthenticated attacker to inject arbitrary SQL commands poses a severe risk to data integrity, confidentiality, and availability. With a CVSS score of 7.3, this high-severity flaw could lead to unauthorized access to sensitive administrative data or total compromise of the database backend, resulting in significant operational disruption.

Remediation Plan

Immediate Action: As no official patch is currently available, administrators should restrict access to the affected administrative directory using network-level controls or disable the vulnerable component entirely.

Proactive Monitoring: Monitor server logs for suspicious HTTP requests containing SQL syntax, specifically targeting the /system/system/admins/assessments/pretest/btn_functions.php endpoint.

Compensating Controls: Deploy a Web Application Firewall (WAF) rule to inspect and block incoming requests containing SQL injection patterns targeting the identified vulnerable parameter.

Exploitation Status

Public Exploit Available: Yes — a published proof-of-concept exists, attributed to the GitHub issue report referenced in the vulnerability documentation.

Analyst Notes: As of February 10, 2026, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The vulnerability is inherently dangerous because it allows unauthenticated interaction with backend database functions.

Analyst Recommendation

Given the availability of a public proof-of-concept and the lack of a vendor-provided patch, this vulnerability presents an immediate risk. Organizations utilizing this software must implement strict access controls and WAF filtering to prevent exploitation until the vendor releases a secure update.

Description Summary:
A SQL injection vulnerability in the Online Music Site 1.0 file AdminEditCategory.php allows unauthenticated remote attackers to manipulate the ID argument and execute arbitrary SQL commands.

Executive Summary:
A critical SQL injection vulnerability exists in code-projects Online Music Site 1.0, posing a significant risk of unauthorized database manipulation by unauthenticated remote attackers.

Vulnerability Details

CVE-ID: CVE-2026-2212

Affected Software: code-projects Online Music Site

Affected Versions: 1.0

Vulnerability: This vulnerability is a SQL injection (CWE-89) flaw located within the AdminEditCategory.php script. It allows an unauthenticated attacker to inject malicious SQL queries via the ID parameter, bypassing standard authentication requirements.

Business Impact

The exploitation of this vulnerability could lead to unauthorized access to sensitive data, potential modification of administrative records, or complete compromise of the underlying database. With a CVSS score of 7.3, this flaw is categorized as High, reflecting the ease of remote exploitation and the potential for significant data integrity loss.

Remediation Plan

Immediate Action: As no official patch is currently available, administrators should immediately restrict network access to the administrative interface or take the affected application offline until a fix is provided by the vendor.

Proactive Monitoring: Security teams should monitor web server logs for suspicious HTTP requests targeting the AdminEditCategory.php file, particularly those containing SQL syntax or unusual character strings in the ID parameter.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to detect and block SQL injection patterns specifically targeting administrative endpoints.

Exploitation Status

Public Exploit Available: Yes, a published proof-of-concept exists as documented in the referenced GitHub issue.

Analyst Notes: As of February 10, 2026, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The vulnerability is highly accessible due to the lack of required authentication.

Analyst Recommendation

Given the availability of a public proof-of-concept and the ease of remote execution, this vulnerability poses a substantial risk to any organization hosting this software. Administrators must prioritize isolating the affected application from public-facing networks until the vendor releases a secure update to remediate the underlying SQL injection flaw.

Description Summary:
A SQL injection vulnerability in code-projects Online Music Site 1.0 allows remote attackers to manipulate the ID argument in the AdminDeleteCategory.php script.

Executive Summary:
A critical SQL injection vulnerability in code-projects Online Music Site 1.0 enables unauthenticated remote attackers to execute arbitrary database queries, posing a significant risk to data integrity.

Vulnerability Details

CVE-ID: CVE-2026-2211

Affected Software: code-projects Online Music Site

Affected Versions: 1.0

Vulnerability: This is a SQL injection vulnerability (CWE-89) located in the /Administrator/PHP/AdminDeleteCategory.php file. The application fails to properly sanitize the ID parameter, allowing an unauthenticated remote attacker to inject malicious SQL commands.

Business Impact

Successful exploitation of this vulnerability permits unauthorized access to the application database. This could lead to the exposure, modification, or deletion of sensitive music site data, resulting in potential service disruption and loss of data confidentiality. Given the CVSS score of 7.3, this flaw is categorized as high severity and requires immediate attention to prevent unauthorized administrative actions.

Remediation Plan

Immediate Action: Since no official patch is currently available, administrators should restrict network access to the administrative interface and implement strict input validation on the affected file.

Proactive Monitoring: Monitor server access logs for anomalous HTTP requests targeting the AdminDeleteCategory.php file, specifically looking for unusual patterns in the ID parameter.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to detect and block SQL injection patterns targeting the identified administrative endpoint.

Exploitation Status

Public Exploit Available: Yes, a published proof-of-concept exists, as documented in the linked GitHub repository.

Analyst Notes: As of February 10, 2026, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The simplicity of this injection vector makes it highly accessible to attackers.

Analyst Recommendation

The presence of a public proof-of-concept elevates the risk of this vulnerability to an urgent status. Organizations utilizing this software must prioritize restricting access to the administrative backend and applying robust WAF filtering to mitigate the potential for SQL injection until a vendor-supplied patch is released.

Description Summary:
A SQL injection vulnerability in code-projects Online Reviewer System 1.0 allows remote attackers to manipulate the ID argument in the user-delete.php file.

Executive Summary:
A critical SQL injection vulnerability in code-projects Online Reviewer System 1.0 allows for remote, unauthenticated database manipulation.

Vulnerability Details

CVE-ID: CVE-2026-2199

Affected Software: code-projects Online Reviewer System

Affected Versions: 1.0

Vulnerability: This vulnerability is a SQL injection flaw (CWE-89) located in the /reviewer/system/system/admins/manage/users/user-delete.php script. The application fails to properly sanitize the ID parameter, allowing an unauthenticated remote attacker to execute arbitrary SQL commands.

Business Impact

Successful exploitation of this flaw allows an attacker to interact directly with the backend database, potentially leading to unauthorized data access, modification, or deletion. Given the CVSS score of 7.3, this represents a significant risk to data integrity and confidentiality, which could result in compliance violations and loss of sensitive user information.

Remediation Plan

Immediate Action: Since no official patch is currently available, administrators should immediately restrict access to the affected directory or disable the vulnerable component until a vendor update is released.

Proactive Monitoring: Review application access logs for suspicious patterns, such as unexpected SQL syntax or URL parameters containing non-alphanumeric characters, targeting the user-delete.php endpoint.

Compensating Controls: Deploy a Web Application Firewall (WAF) with custom rules designed to block and alert on SQL injection attempts targeting the identified vulnerable path.

Exploitation Status

Public Exploit Available: Yes — a public proof-of-concept exists as documented in the provided GitHub issue reference.

Analyst Notes: As of February 10, 2026, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The vulnerability is highly accessible as it requires no authentication to trigger the flaw.

Analyst Recommendation

Due to the availability of a public proof-of-concept and the ease of exploitation, this vulnerability poses a clear and present danger to affected systems. Organizations utilizing code-projects Online Reviewer System 1.0 must take immediate steps to isolate the application or apply compensating controls to prevent unauthorized database access. Prioritize the replacement of this system if the vendor fails to provide a security update in a timely manner.

Description Summary:
The Online Reviewer System 1.0 contains a SQL injection vulnerability in the difficulty_id parameter of the loaddata.php file, allowing remote unauthenticated attackers to execute malicious queries.

Executive Summary:
A critical SQL injection vulnerability in code-projects Online Reviewer System 1.0 enables unauthenticated remote attackers to manipulate database queries.

Vulnerability Details

CVE-ID: CVE-2026-2198

Affected Software: code-projects Online Reviewer System

Affected Versions: 1.0

Vulnerability: This is a SQL injection vulnerability (CWE-89) located in the /system/system/admins/assessments/pretest/loaddata.php file. An unauthenticated attacker can manipulate the difficulty_id argument to execute arbitrary SQL commands against the backend database.

Business Impact

The ability for an unauthenticated user to perform SQL injection poses a significant risk to data confidentiality and integrity. Successful exploitation could lead to unauthorized access to sensitive assessment data, potential modification of records, or the exposure of administrative credentials. With a CVSS score of 7.3, this flaw is categorized as high severity and requires immediate attention to prevent unauthorized data exfiltration.

Remediation Plan

Immediate Action: Since no official patch is currently available, administrators should restrict network access to the vulnerable loaddata.php endpoint or disable the affected assessment component entirely until a vendor update is released.

Proactive Monitoring: Review web server access logs for anomalous requests containing SQL syntax patterns or unexpected parameters directed at the /system/system/admins/assessments/pretest/ directory.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to detect and block SQL injection payloads targeting the difficulty_id parameter.

Exploitation Status

Public Exploit Available: Yes — a published proof-of-concept exists, as documented in the technical write-up provided by the researcher at https://github.com/tiancesec/CVE/issues/19.

Analyst Notes: As of February 10, 2026, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The flaw is highly accessible as it does not require authentication or user interaction.

Analyst Recommendation

Given the availability of a public proof-of-concept and the lack of a vendor patch, this vulnerability presents a tangible risk to the environment. Security teams must prioritize identifying instances of this software within their infrastructure and implement strict network-level access controls to negate the potential for remote exploitation.

Description Summary:
A SQL injection vulnerability exists in the Online Reviewer System 1.0, specifically within the exam-delete.php file, allowing remote attackers to manipulate database queries via the test_id argument.

Executive Summary:
An unauthenticated SQL injection vulnerability in code-projects Online Reviewer System 1.0 poses a significant risk of unauthorized database manipulation and information disclosure.

Vulnerability Details

CVE-ID: CVE-2026-2197

Affected Software: code-projects Online Reviewer System

Affected Versions: 1.0

Vulnerability: The vulnerability is a SQL injection flaw (CWE-89) located in the file /system/system/admins/assessments/pretest/exam-delete.php. An unauthenticated remote attacker can trigger this flaw by manipulating the test_id parameter to execute arbitrary SQL commands against the backend database.

Business Impact

The exploitation of this SQL injection vulnerability could lead to unauthorized data access, modification, or deletion within the database, potentially compromising the integrity and confidentiality of the Online Reviewer System. With a CVSS score of 7.3, this high-severity flaw requires immediate attention to prevent unauthorized administrative actions or data breaches that could disrupt business operations.

Remediation Plan

Immediate Action: Since a vendor-supplied patch is currently unknown, administrators should restrict access to the affected directory /system/system/admins/assessments/pretest/ via network-level controls until a fix is provided.

Proactive Monitoring: Monitor web server access logs for anomalous requests containing SQL syntax patterns or unexpected characters targeting the exam-delete.php endpoint.

Compensating Controls: Deploy a Web Application Firewall (WAF) rule designed to detect and block SQL injection attempts targeting the test_id parameter.

Exploitation Status

Public Exploit Available: Yes — a published proof-of-concept exists via the technical disclosure at https://github.com/tiancesec/CVE/issues/18.

Analyst Notes: As of February 10, 2026, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment, a proof-of-concept exists, so exploitation risk should be treated as credible. The flaw is highly accessible as it does not require authentication to trigger.

Analyst Recommendation

Given the availability of a public proof-of-concept and the ease of exploitation, this vulnerability presents a credible risk to the integrity of the application. Organizations should prioritize isolating the affected component and implementing robust input validation or WAF rules to mitigate the threat until an official security update is released by the vendor.

Description Summary:
A SQL injection vulnerability exists in the Online Reviewer System 1.0, specifically within the exam-update.php file, allowing unauthenticated attackers to manipulate the test_id argument.

Executive Summary:
The code-projects Online Reviewer System 1.0 contains a critical SQL injection vulnerability that allows unauthenticated remote attackers to compromise system data.

Vulnerability Details

CVE-ID: CVE-2026-2196

Affected Software: code-projects Online Reviewer System

Affected Versions: 1.0

Vulnerability: This flaw is a SQL injection vulnerability (CWE-89) triggered via the test_id parameter in the /system/system/admins/assessments/pretest/exam-update.php script. The vulnerability allows unauthenticated remote attackers to inject malicious SQL queries into the application database.

Business Impact

Successful exploitation of this vulnerability could lead to unauthorized access to the underlying database, potentially resulting in the exposure, modification, or deletion of sensitive assessment data. Given the CVSS score of 7.3, this represents a significant risk to the confidentiality and integrity of the system, which may lead to operational disruption and loss of trust in the review process.

Remediation Plan

Immediate Action: As no official patch is currently available, administrators should restrict network access to the vulnerable endpoint or take the application offline until a secure update is released by the vendor.

Proactive Monitoring: Review web server access logs for anomalous requests containing SQL syntax patterns targeting the exam-update.php file, and monitor database audit logs for unauthorized query activity.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to detect and block common SQL injection payloads directed at the vulnerable URL path.

Exploitation Status

Public Exploit Available: Yes, a published proof-of-concept exists as documented in the referenced GitHub issue.

Analyst Notes: As of February 10, 2026, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The flaw is inherently dangerous due to the lack of authentication requirements for the affected endpoint.

Analyst Recommendation

Given the availability of a public proof-of-concept, the risk of exploitation is elevated. Organizations currently running Online Reviewer System 1.0 must treat this as a high-priority issue. If an official update is not provided by the vendor, migration to a more secure platform or complete isolation of the vulnerable system is strongly advised to prevent unauthorized database access.

Description Summary:
Code-projects Online Reviewer System version 1.0 contains a SQL injection vulnerability in the questions-view.php file that allows remote attackers to manipulate the ID argument.

Executive Summary:
An unauthenticated remote SQL injection vulnerability in code-projects Online Reviewer System version 1.0 poses a significant risk of unauthorized database interaction and data exposure.

Vulnerability Details

CVE-ID: CVE-2026-2195

Affected Software: code-projects Online Reviewer System

Affected Versions: 1.0

Vulnerability: This flaw is a SQL injection vulnerability (CWE-89) located in the /system/system/admins/assessments/pretest/questions-view.php file. The application fails to properly sanitize the ID parameter, allowing an unauthenticated remote attacker to inject malicious SQL queries.

Business Impact

The vulnerability carries a CVSS score of 7.3, indicating a high-severity risk. Successful exploitation could lead to unauthorized access to sensitive application data, potential modification of database records, or the loss of data integrity within the assessment system. Given the nature of SQL injection, this could also serve as a vector for further system compromise or administrative account takeover.

Remediation Plan

Immediate Action: Since no official patch is currently available, administrators should restrict access to the affected directory or implement strict input validation rules at the web application firewall level to block malicious SQL patterns in the ID parameter.

Proactive Monitoring: Monitor server access logs for anomalous HTTP requests targeting the questions-view.php file, specifically looking for characters commonly used in SQL injection attacks such as single quotes, semicolons, and comment sequences.

Compensating Controls: Deploy a Web Application Firewall (WAF) with updated rulesets designed to detect and block SQL injection attempts. Additionally, ensure the database user account associated with the web application follows the principle of least privilege to minimize potential damage.

Exploitation Status

Public Exploit Available: Yes — a public proof-of-concept exists as documented in the GitHub issue reported by tiancesec.

Analyst Notes: As of February 10, 2026, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The vulnerability is inherently dangerous because it allows unauthenticated interaction with the backend database.

Analyst Recommendation

Given the availability of a public proof-of-concept and the ease of exploitation over a network, this vulnerability presents a credible threat to organizational security. Security teams should prioritize isolating the affected component until a vendor patch is released or the code is manually remediated to include parameterized queries.

Description Summary:
A remote authentication bypass vulnerability exists in code-projects Contact Management System 1.0 due to improper handling of the ID argument in a CRUD endpoint.

Executive Summary:
A critical authentication vulnerability in code-projects Contact Management System 1.0 allows remote, unauthenticated attackers to bypass security controls.

Vulnerability Details

CVE-ID: CVE-2026-2174

Affected Software: code-projects Contact Management System

Affected Versions: 1.0

Vulnerability: This vulnerability involves improper authentication within the CRUD endpoint of the application. An unauthenticated remote attacker can manipulate the ID argument to bypass security checks.

Business Impact

Successful exploitation of this flaw allows unauthorized actors to bypass authentication mechanisms, potentially granting them access to sensitive contact data managed by the system. Given the CVSS score of 7.3, this represents a high-severity risk that could lead to unauthorized data exposure or administrative manipulation of the system.

Remediation Plan

Immediate Action: Since no official patch is currently available, users should restrict access to the affected Contact Management System via network-level controls or by placing the application behind an authenticated proxy.

Proactive Monitoring: Security teams should audit access logs for suspicious requests targeting CRUD endpoints, specifically monitoring for anomalies in the ID parameter.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to inspect and block malformed or unexpected input within URI parameters associated with the application's CRUD functions.

Exploitation Status

Public Exploit Available: No (exploit_available: false)

Analyst Notes: As of February 10, 2026, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The flaw is inherently dangerous due to its remote, unauthenticated nature and the ease of automating the attack vector.

Analyst Recommendation

Organizations currently utilizing code-projects Contact Management System 1.0 must prioritize mitigating this exposure. Because no vendor patch is confirmed, immediate implementation of network-level restrictions and monitoring is necessary to prevent unauthorized access until an official security update is provided by the vendor.

Description Summary:
A SQL injection vulnerability exists in the login.php file of code-projects Online Examination System 1.0, allowing remote unauthenticated attackers to manipulate username and password arguments.

Executive Summary:
The Online Examination System 1.0 contains a critical SQL injection vulnerability that allows remote, unauthenticated attackers to interact with the underlying database.

Vulnerability Details

CVE-ID: CVE-2026-2173

Affected Software: code-projects Online Examination System

Affected Versions: 1.0

Vulnerability: This is a SQL injection vulnerability (CWE-89) located in the login.php file. The flaw permits an unauthenticated attacker to inject malicious SQL commands via the username or password parameters, potentially leading to unauthorized database access.

Business Impact

Successful exploitation of this SQL injection vulnerability could result in unauthorized access to sensitive user data stored within the examination system database. Given the CVSS score of 7.3, this represents a significant risk to data confidentiality and integrity, potentially leading to a complete compromise of the application user base.

Remediation Plan

Immediate Action: As no official patch is currently identified, administrators should restrict access to the login.php endpoint using network-level controls or consider disabling the application until a security update is provided by the vendor.

Proactive Monitoring: Security teams should review web server access logs for anomalous SQL syntax patterns, such as UNION, SELECT, or OR statements, within the username and password fields.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to detect and block common SQL injection payloads targeting authentication forms.

Exploitation Status

Public Exploit Available: Unknown.

Analyst Notes: As of February 10, 2026, there is no public information indicating active exploitation or a published proof-of-concept for this vulnerability. SQL injection remains a high-risk vector for web applications, and the lack of authentication requirements makes this flaw particularly easy to target.

Analyst Recommendation

The presence of a remote, unauthenticated SQL injection vulnerability in an authentication component poses a high risk to the confidentiality of stored credentials and system data. Administrators are urged to monitor this product for vendor-supplied security patches and apply them immediately upon release. In the interim, isolating the affected system from public exposure is the most effective way to mitigate this risk.

Description Summary:
The Online Application System for Admission 1.0 contains a SQL injection vulnerability in the login endpoint, allowing remote attackers to manipulate database queries via the enrollment/index.php file.

Executive Summary:
A critical SQL injection vulnerability in the code-projects Online Application System for Admission 1.0 allows for unauthenticated remote exploitation, posing a significant risk to database integrity.

Vulnerability Details

CVE-ID: CVE-2026-2172

Affected Software: code-projects Online Application System for Admission

Affected Versions: 1.0

Vulnerability: This vulnerability is an SQL injection (CWE-89) flaw located within the enrollment/index.php file. An unauthenticated remote attacker can inject malicious SQL commands into the login endpoint to manipulate backend database operations.

Business Impact

The ability to perform unauthorized SQL queries can lead to the exposure of sensitive student or applicant data, unauthorized modification of records, or potential bypass of authentication mechanisms. Given the CVSS score of 7.3, this high-severity vulnerability could result in severe reputational damage and the compromise of institutional data systems if left unaddressed.

Remediation Plan

Immediate Action: As no official patch is currently available, administrators should restrict access to the affected login endpoint or disable the vulnerable module until a security update is released by the vendor.

Proactive Monitoring: Review web server access logs for anomalous request patterns or strings commonly associated with SQL injection attempts, such as the use of single quotes or SQL syntax keywords in input fields.

Compensating Controls: Implement a Web Application Firewall (WAF) with rules configured to detect and block SQL injection signatures targeting the enrollment/index.php endpoint.

Exploitation Status

Public Exploit Available: Yes, a public proof-of-concept exists as documented in the referenced technical write-up from VulDB.

Analyst Notes: As of February 10, 2026, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The vulnerability is highly accessible due to the unauthenticated nature of the attack vector.

Analyst Recommendation

The presence of a public proof-of-concept significantly increases the risk of exploitation for this software. Organizations currently using version 1.0 of the Online Application System for Admission must prioritize the implementation of compensating controls, such as WAF filtering, while actively monitoring for official vendor guidance or patches to remediate this flaw permanently.

Description Summary:
The Online Student Management System 1.0 is vulnerable to remote SQL injection in the login component via the accounts.php file, allowing unauthenticated attackers to manipulate database queries.

Executive Summary:
A critical SQL injection vulnerability in the code-projects Online Student Management System 1.0 allows unauthenticated remote attackers to compromise database integrity.

Vulnerability Details

CVE-ID: CVE-2026-2171

Affected Software: code-projects Online Student Management System

Affected Versions: 1.0

Vulnerability: This vulnerability is a SQL injection flaw (CWE-89) located in the accounts.php file within the login component. It allows an unauthenticated, remote attacker to execute arbitrary SQL commands by injecting malicious input into the username or password fields.

Business Impact

Successful exploitation of this vulnerability can lead to unauthorized access to student records, sensitive user credentials, and potential database manipulation or data exfiltration. Given the CVSS score of 7.3, this represents a high-severity risk that could lead to significant reputational damage and a breach of data privacy compliance requirements.

Remediation Plan

Immediate Action: As no official patch is currently available, administrators should restrict network access to the login interface and consider disabling the affected service until a secure version is released.

Proactive Monitoring: Security teams should monitor web server logs for anomalous patterns in login requests, specifically looking for SQL syntax characters or unexpected input lengths in the username and password fields.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to detect and block SQL injection attempts targeting the login endpoint.

Exploitation Status

Public Exploit Available: Yes — a public proof-of-concept exists as documented in the referenced security vulnerability database entries.

Analyst Notes: As of February 10, 2026, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The vulnerability is highly accessible to attackers due to the lack of required authentication.

Analyst Recommendation

Due to the public availability of exploit material and the lack of a vendor-provided patch, this vulnerability poses a significant risk to the confidentiality and integrity of the system. Organizations currently running version 1.0 of the Online Student Management System should move to implement strict network-level mitigations immediately and prioritize the transition to a more secure platform or version as soon as one becomes available.

Description Summary:
The Online Reviewer System 1.0 contains an unauthenticated SQL injection vulnerability in the login component, specifically within the username and password fields of the login index page.

Executive Summary:
An unauthenticated SQL injection vulnerability in the code-projects Online Reviewer System 1.0 allows remote attackers to compromise the database integrity, confidentiality, and availability.

Vulnerability Details

CVE-ID: CVE-2026-2166

Affected Software: code-projects Online Reviewer System

Affected Versions: 1.0

Vulnerability: This vulnerability is a SQL injection (CWE-89) flaw located in the /login/index.php file. An unauthenticated remote attacker can manipulate the username or password arguments to execute arbitrary SQL commands against the backend database.

Business Impact

The ability for an unauthenticated attacker to inject malicious SQL commands poses a severe risk to data integrity and system security. Successful exploitation could lead to unauthorized access to sensitive user credentials, modification of application data, or total database compromise. Given the CVSS score of 7.3, this represents a high-severity risk that demands immediate attention to prevent potential service disruption or data exfiltration.

Remediation Plan

Immediate Action: As no official patch is currently available, administrators should restrict access to the affected login interface or consider disabling the service until a secure update is released by the vendor.

Proactive Monitoring: Security teams should review web server access logs for anomalous patterns in login requests, specifically looking for SQL syntax characters or unusual payload lengths in the username and password fields.

Compensating Controls: Deploy a Web Application Firewall (WAF) with strict SQL injection filtering rules to inspect incoming traffic and block malformed requests targeting the login endpoint.

Exploitation Status

Public Exploit Available: Yes, a public proof-of-concept exists as documented in the linked research write-up on GitHub.

Analyst Notes: As of February 10, 2026, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The flaw is inherently dangerous due to its lack of authentication requirements and ease of remote execution.

Analyst Recommendation

The presence of a public proof-of-concept for an unauthenticated SQL injection vulnerability makes this a high-priority risk. Organizations using code-projects Online Reviewer System 1.0 must implement immediate defensive measures, such as network segmentation or WAF rules, to mitigate the risk of unauthorized database access while awaiting an official vendor security update.

Description Summary:
The Student Web Portal 1.0 is vulnerable to unauthenticated SQL injection via the Username argument in the check_user.php file, allowing remote attackers to manipulate database queries.

Executive Summary:
A critical SQL injection vulnerability in the code-projects Student Web Portal allows unauthenticated remote attackers to compromise database integrity.

Vulnerability Details

CVE-ID: CVE-2026-2158

Affected Software: code-projects Student Web Portal

Affected Versions: 1.0

Vulnerability: This flaw is a SQL injection vulnerability (CWE-89) located in the check_user.php script, specifically affecting the Username parameter. The vulnerability allows an unauthenticated remote attacker to inject malicious SQL commands, potentially leading to unauthorized data access or manipulation.

Business Impact

Successful exploitation of this vulnerability poses a significant risk to the confidentiality and integrity of student data stored within the portal. Given the CVSS score of 7.3, this high-severity flaw could lead to unauthorized database access, potentially facilitating further lateral movement or data exfiltration. The ability for an unauthenticated attacker to interact with the back-end database makes this an urgent security concern for organizations hosting this software.

Remediation Plan

Immediate Action: As no official patch is currently available, administrators should restrict network access to the Student Web Portal and specifically block requests targeting the check_user.php file until a vendor-supplied update is released.

Proactive Monitoring: Security teams should review server access logs for anomalous HTTP requests containing SQL syntax, particularly those directed at check_user.php, and monitor database logs for unexpected query patterns.

Compensating Controls: Implement a Web Application Firewall (WAF) rule to detect and block common SQL injection patterns targeting the Username parameter, which can serve as a effective virtual patch while awaiting a formal fix.

Exploitation Status

Public Exploit Available: Yes, a public proof-of-concept exists, attributed to the research documentation provided via the VulDB and GitHub references.

Analyst Notes: As of February 10, 2026, there is no public information indicating active exploitation in the wild. The vulnerability is highly accessible due to the lack of required authentication, making it a prime candidate for automated scanning and exploitation.

Analyst Recommendation

The presence of a public proof-of-concept for this SQL injection vulnerability significantly lowers the barrier for exploitation by malicious actors. Organizations currently utilizing code-projects Student Web Portal 1.0 must immediately implement WAF-based mitigations and restrict access to the affected endpoint to prevent potential data compromise. Prioritize migration to a more secure platform if the vendor does not provide a timely security update.

Description Summary:
A critical unrestricted file upload vulnerability exists in the Online Music Site 1.0 administrator module, allowing remote attackers to potentially upload malicious files.

Executive Summary:
A critical unrestricted file upload vulnerability in the code-projects Online Music Site 1.0 allows remote, unauthenticated attackers to potentially compromise system integrity.

Vulnerability Details

CVE-ID: CVE-2026-2133

Affected Software: code-projects Online Music Site

Affected Versions: 1.0

Vulnerability: This vulnerability involves an unrestricted file upload flaw within the AdminUpdateCategory.php file, which lacks sufficient access controls. An unauthenticated attacker can remotely manipulate the txtimage argument to upload arbitrary files to the server.

Business Impact

The ability to upload arbitrary files to a web server presents a severe risk of remote code execution, which could lead to a complete system compromise. Given the CVSS score of 7.3, this vulnerability poses a significant threat to data confidentiality and system availability. Successful exploitation could result in unauthorized access to sensitive music site data or the hosting server environment.

Remediation Plan

Immediate Action: As no official patch is currently available, administrators should immediately restrict access to the /Administrator/PHP/ directory to authorized personnel only and monitor the server for suspicious file uploads.

Proactive Monitoring: Review web server access logs for requests directed at AdminUpdateCategory.php and inspect the uploads directory for unrecognized or executable file extensions.

Compensating Controls: Deploy a Web Application Firewall (WAF) rule to block requests containing suspicious file upload patterns or attempts to access the vulnerable administrative endpoint from untrusted networks.

Exploitation Status

Public Exploit Available: Yes, a published proof-of-concept exists, as documented in the referenced GitHub issue.

Analyst Notes: As of February 9, 2026, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The flaw is inherently dangerous due to the lack of server-side validation on user-supplied file uploads.

Analyst Recommendation

Due to the lack of a vendor-supplied patch, users of code-projects Online Music Site 1.0 must prioritize the implementation of strict network-level access controls to the administrative interface. It is recommended to disable the vulnerable upload functionality if it is not business-critical until a secure version is released. Continuous monitoring of server logs is essential to detect any unauthorized exploitation attempts.

Description Summary:
A SQL injection vulnerability in the Online Music Site 1.0 administrative component allows remote, unauthenticated attackers to manipulate database queries via the txtcat parameter.

Executive Summary:
A critical SQL injection vulnerability in code-projects Online Music Site 1.0 allows unauthenticated remote attackers to compromise database integrity.

Vulnerability Details

CVE-ID: CVE-2026-2132

Affected Software: code-projects Online Music Site

Affected Versions: 1.0

Vulnerability: This is a SQL injection vulnerability (CWE-89) located in the /Administrator/PHP/AdminUpdateCategory.php file. The application fails to properly sanitize the txtcat argument, allowing an unauthenticated remote attacker to inject malicious SQL commands.

Business Impact

The ability to perform remote SQL injection allows an attacker to bypass authentication, extract sensitive data, or modify records within the application database. Given the CVSS score of 7.3, this flaw poses a significant risk to data confidentiality and integrity, potentially leading to total compromise of the application backend and associated user information.

Remediation Plan

Immediate Action: As no official vendor patch is currently available, administrators should restrict network access to the administrative directory or disable the affected Online Music Site instance until a secure update is released.

Proactive Monitoring: Review web server access logs for anomalous requests directed at /Administrator/PHP/AdminUpdateCategory.php, specifically looking for SQL syntax patterns or unexpected characters in the txtcat parameter.

Compensating Controls: Deploy a Web Application Firewall (WAF) rule to block requests containing common SQL injection payloads targeted at the identified vulnerable PHP endpoint.

Exploitation Status

Public Exploit Available: Yes, a published proof-of-concept exists via the technical write-up provided in the referenced GitHub issue.

Analyst Notes: As of February 9, 2026, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The vulnerability is inherently exploitable because the affected endpoint does not require authentication to process the malicious input.

Analyst Recommendation

Given the availability of a public proof-of-concept and the lack of a vendor-supplied patch, this vulnerability presents an immediate risk. Organizations utilizing code-projects Online Music Site 1.0 must prioritize isolating the affected application from public-facing networks to prevent potential exploitation until a remediation path is provided by the vendor.

Description Summary:
A security flaw has been discovered in code-projects Social Networking Site 1, potentially enabling unauthorized actions or data exposure within the platform.

Executive Summary:
The code-projects Social Networking Site 1 contains a high-severity security flaw that could result in unauthorized access or the exposure of private user information.

Vulnerability Details

CVE-ID: CVE-2026-2083

Affected Software: code-projects Social Networking Site

Affected Versions: 1

Vulnerability: A security vulnerability has been detected in the code-projects Social Networking Site application. The attacker's required authentication level is not specified, but the flaw likely exists in components managing user sessions or social interactions.

Business Impact

The compromise of a social networking platform can lead to widespread data breaches, including the exposure of personal user data and private communications. With a CVSS score of 7.3, this High-severity issue poses a severe threat to user privacy and the overall trust in the platform's security architecture.

Remediation Plan

Immediate Action: Administrators should immediately apply any available security patches or updates from code-projects to secure the affected environment.

Proactive Monitoring: Review application logs for anomalous user behavior or unauthorized attempts to escalate privileges within the social networking site.

Compensating Controls: Deploying robust input validation and using a WAF can provide an additional layer of defense against potential exploit attempts.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of February 9, 2026, there is no public information indicating active exploitation of this vulnerability. Given the popularity of social networking scripts for community projects, the impact of a potential exploit could be widespread.

Analyst Recommendation

It is strongly recommended that all instances of the code-projects Social Networking Site 1 be updated immediately. Failure to address this High-severity vulnerability could leave the platform and its users vulnerable to significant data compromise.

Description Summary:
A SQL injection vulnerability exists in the Simple Blood Donor Management System 1.0, allowing remote attackers to manipulate the ID argument in editcampaignform.php to execute unauthorized queries.

Executive Summary:
The Simple Blood Donor Management System 1.0 contains a critical SQL injection vulnerability that allows unauthenticated remote attackers to compromise database integrity.

Vulnerability Details

CVE-ID: CVE-2026-2060

Affected Software: code-projects Simple Blood Donor Management System

Affected Versions: 1.0

Vulnerability: This is a SQL injection vulnerability (CWE-89) located in the editcampaignform.php file. The application fails to properly sanitize the ID parameter, enabling unauthenticated remote attackers to inject malicious SQL commands.

Business Impact

Successful exploitation of this vulnerability can lead to unauthorized access to sensitive blood donor data and potential database manipulation. Given the CVSS score of 7.3, this represents a significant risk to data confidentiality and integrity, which may result in severe reputational damage and regulatory non-compliance for organizations managing donor health records.

Remediation Plan

Immediate Action: As no official patch is currently available, administrators should immediately restrict access to the application or take the system offline until a secure version is released. If the application must remain online, input validation and parameterization must be implemented manually within the editcampaignform.php source code.

Proactive Monitoring: Security teams should review web server access logs for anomalous requests containing SQL syntax patterns targeting the editcampaignform.php endpoint.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to detect and block common SQL injection patterns targeting the vulnerable ID parameter.

Exploitation Status

Public Exploit Available: Yes, a published proof-of-concept exists, as documented in the research write-up at https://github.com/kyxh001/CVE/issues/1.

Analyst Notes: As of February 8, 2026, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The vulnerability is highly accessible due to the lack of required authentication.

Analyst Recommendation

The presence of a public proof-of-concept significantly increases the risk of opportunistic attacks against this software. Organizations currently running version 1.0 of the Simple Blood Donor Management System must prioritize compensating controls or service suspension to mitigate the risk of data exfiltration until a formal vendor patch is developed and verified.

Description Summary:
The Online Shopping System by code-projects is vulnerable to SQL injection, which may allow unauthenticated attackers to manipulate database queries.

Executive Summary:
An unauthenticated SQL injection vulnerability in the code-projects Online Shopping System exposes the underlying database to unauthorized manipulation and data exfiltration.

Vulnerability Details

CVE-ID: CVE-2026-19919

Affected Software: code-projects Online Shopping System

Affected Versions: 1.0

Vulnerability: This vulnerability involves CWE-89 (SQL Injection) and CWE-74 (Injection), allowing unauthenticated attackers to interact with the database through malicious input.

Business Impact

The ability to perform SQL injection allows an attacker to bypass authentication, access sensitive customer or transaction data, and potentially modify or delete records. With a CVSS score of 7.3, this vulnerability represents a high risk to business operations, data privacy, and overall platform security.

Remediation Plan

Immediate Action: Review the application for available security patches from the vendor and implement parameterized queries to sanitize all user-supplied input.

Proactive Monitoring: Monitor database query logs for suspicious patterns, such as unexpected SQL keywords or syntax errors that suggest injection attempts.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to detect and block common SQL injection attack signatures.

Exploitation Status

Public Exploit Available: No

Analyst Notes: As of August 16, 2026, there is no public information indicating active exploitation or a confirmed weaponized public exploit for this vulnerability. While a proof-of-concept has been identified in external research, it should not be confused with active exploitation in the wild.

Analyst Recommendation

Due to the ease of exploitation for SQL injection flaws, organizations using this software must treat this as a high-priority issue. If a patch is not currently available, immediate implementation of robust input validation and WAF protection is required to mitigate the risk of data compromise.

Description Summary:
A SQL injection vulnerability in code-projects Task Management System version 1.0 allows unauthenticated attackers to execute arbitrary SQL commands via unsanitized input.

Executive Summary:
The Task Management System by code-projects contains a critical SQL injection vulnerability that allows unauthenticated attackers to gain unauthorized access to backend data.

Vulnerability Details

CVE-ID: CVE-2026-19344

Affected Software: code-projects Task Management System

Affected Versions: 1.0

Vulnerability: This is a SQL injection vulnerability (CWE-89) resulting from a failure to validate user input before processing it in database queries. The vulnerability is accessible to unauthenticated remote attackers.

Business Impact

Successful exploitation allows an attacker to bypass authentication, extract sensitive information, or modify the application database. With a CVSS score of 7.3, this vulnerability represents a high risk to business operations and data privacy.

Remediation Plan

Immediate Action: Contact the vendor or monitor the official project repository for a security patch; if none is available, restrict external access to the application.

Proactive Monitoring: Monitor database query performance and access logs for unusual patterns or signs of SQL injection attacks.

Compensating Controls: Implement a Web Application Firewall (WAF) to filter and block SQL injection attempts targeting the affected system.

Exploitation Status

Public Exploit Available: No (no confirmed public exploit found in curated sources).

Analyst Notes: As of August 10, 2026, there is no public information indicating active exploitation or a confirmed public proof-of-concept for this vulnerability. While the EPSS score indicates low current probability of exploitation, the nature of the flaw makes it a prime target for automated scanning.

Analyst Recommendation

Because no formal patch is currently identified, users should treat this application as inherently insecure. We strongly recommend limiting exposure by placing the system behind a VPN or firewall and immediately applying any vendor-provided security updates as soon as they are released.

Description Summary:
A SQL injection vulnerability in code-projects Task Management System version 1.0 allows for unauthorized database queries and data manipulation.

Executive Summary:
A SQL injection flaw in the code-projects Task Management System allows unauthenticated attackers to interact with the backend database, risking data integrity.

Vulnerability Details

CVE-ID: CVE-2026-19343

Affected Software: code-projects Task Management System

Affected Versions: 1.0

Vulnerability: The application is susceptible to SQL injection (CWE-89) because it fails to properly sanitize user-supplied input before using it in database queries. This vulnerability is accessible to unauthenticated attackers over the network.

Business Impact

Successful exploitation permits an attacker to read, modify, or delete sensitive information stored within the application database. With a CVSS score of 7.3, this vulnerability threatens the confidentiality and integrity of project data, which could lead to significant operational disruption or the exposure of proprietary information.

Remediation Plan

Immediate Action: Since a formal patch is currently unavailable, users should restrict network access to the application or consider disabling the software until a secure update is released by the vendor.

Proactive Monitoring: Inspect web application logs for suspicious query strings or patterns indicative of SQL injection attempts, such as unexpected characters or database syntax in input fields.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to detect and block common SQL injection payloads before they reach the application.

Exploitation Status

Public Exploit Available: Unknown.

Analyst Notes: As of August 9, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The presence of injection flaws in web applications remains a common attack vector that requires diligent input validation and sanitization.

Analyst Recommendation

The Task Management System should be removed from public-facing exposure immediately. Organizations using this software should transition to a more secure alternative or implement strict WAF filtering until the vendor provides a version that includes the necessary security fixes.

Description Summary:
An improper authentication vulnerability in code-projects Task Management System version 1.0 allows attackers to bypass security controls.

Executive Summary:
An authentication bypass vulnerability in the code-projects Task Management System allows unauthenticated attackers to gain unauthorized access to the application.

Vulnerability Details

CVE-ID: CVE-2026-19342

Affected Software: code-projects Task Management System

Affected Versions: 1.0

Vulnerability: The application suffers from improper authentication (CWE-287), where the system fails to correctly verify the identity of users. This flaw allows an unauthenticated, remote attacker to gain unauthorized access to the system.

Business Impact

An attacker who successfully exploits this vulnerability can gain unauthorized access to the system, potentially accessing all project data and management functions. Given the CVSS score of 7.3, this vulnerability poses a high risk to business operations, as it effectively nullifies the primary security barrier of the software.

Remediation Plan

Immediate Action: As there is no patch currently available, the application should be taken offline or placed behind a restricted access portal that requires secondary authentication before access to the software is granted.

Proactive Monitoring: Monitor application access logs for unusual login activity or access from unexpected IP addresses that indicate unauthorized user sessions.

Compensating Controls: Implement network-level access controls, such as a VPN or IP allowlisting, to ensure that only authorized users can connect to the application server.

Exploitation Status

Public Exploit Available: Unknown.

Analyst Notes: As of August 9, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The failure to properly enforce authentication is a critical security oversight that provides attackers with a direct path to sensitive system functions.

Analyst Recommendation

Due to the severity of an authentication bypass, this system should be considered insecure for production use. Administrators must implement compensating controls immediately to restrict access and monitor for any signs of unauthorized entry until a vendor-supplied patch is available.

Description Summary:
The Hospital Bed Management System contains a SQL injection vulnerability that allows unauthenticated attackers to potentially access or manipulate database information.

Executive Summary:
An unauthenticated SQL injection vulnerability in the code-projects Hospital Bed Management System poses a significant risk of unauthorized database interaction.

Vulnerability Details

CVE-ID: CVE-2026-16014

Affected Software: code-projects Hospital Bed Management System

Affected Versions: 1.0

Vulnerability: This is a SQL injection flaw, categorized under CWE-89, resulting from improper neutralization of special elements used in an SQL command. The vulnerability is remotely exploitable by an unauthenticated attacker, as indicated by the CVSS vector PR:N.

Business Impact

Successful exploitation of this SQL injection vulnerability could allow an attacker to read sensitive data, modify database contents, or potentially bypass authentication mechanisms. Given the CVSS score of 7.3, this represents a high-severity risk that could lead to significant data compromise and loss of system integrity within the healthcare management environment.

Remediation Plan

Immediate Action: Review the vendor's security documentation for available patches or updates to the Hospital Bed Management System. If no official patch is provided, restrict network access to the application to trusted segments only.

Proactive Monitoring: Monitor database query logs for unusual patterns, such as unexpected syntax characters or large-scale data extraction attempts.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to detect and block common SQL injection attack strings targeting the application.

Exploitation Status

Public Exploit Available: No (exploit_available: unknown)

Analyst Notes: As of July 19, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The flaw is inherently dangerous due to its unauthenticated nature, which lowers the barrier to entry for potential attackers.

Analyst Recommendation

The high severity of this vulnerability requires immediate attention from system administrators. Organizations using the Hospital Bed Management System must prioritize applying any available vendor patches and implementing strict network segmentation to minimize exposure until a permanent fix is verified and deployed.

Description Summary:
A SQL injection vulnerability in code-projects Online Music Site 1.0 allows remote attackers to manipulate the ID argument in the AdminReply.php file.

Executive Summary:
A critical SQL injection vulnerability in the Online Music Site platform allows unauthenticated remote attackers to compromise database integrity and potentially access sensitive information.

Vulnerability Details

CVE-ID: CVE-2026-1535

Affected Software: code-projects Online Music Site

Affected Versions: 1.0

Vulnerability: This vulnerability is a SQL injection flaw (CWE-89) located in the /Administrator/PHP/AdminReply.php file, which fails to properly sanitize the ID parameter. The attack can be triggered by an unauthenticated remote user via the network.

Business Impact

Successful exploitation of this SQL injection vulnerability could lead to unauthorized access to the underlying database, potentially resulting in the exfiltration of user data, administrative credentials, or full application compromise. Given the CVSS score of 7.3, this represents a high-severity risk that could lead to significant data breaches and loss of system confidentiality and integrity.

Remediation Plan

Immediate Action: As no official patch is currently available, administrators should restrict access to the /Administrator/ directory using IP allowlisting or VPN-only access to prevent remote exploitation.

Proactive Monitoring: Monitor web server logs for suspicious HTTP requests targeting AdminReply.php, particularly those containing SQL syntax or unusual characters in the ID parameter.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to detect and block common SQL injection patterns targeting administrative endpoints.

Exploitation Status

Public Exploit Available: Yes — a published proof-of-concept exists, as documented in the GitHub issue referenced by the vulnerability record.

Analyst Notes: As of January 30, 2026, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The vulnerability is highly exploitable due to the lack of required authentication and the ease of manipulating the vulnerable parameter.

Analyst Recommendation

Given the availability of a public proof-of-concept and the ease of exploitation, immediate action is required to secure the administrative interface. If an official vendor update is not available, administrators must implement network-level access controls to ensure the vulnerable endpoint is not exposed to the public internet.

Description Summary:
A SQL injection vulnerability in code-projects Online Music Site 1.0 allows remote, unauthenticated attackers to manipulate database queries via the ID argument in AdminEditUser.php.

Executive Summary:
A critical SQL injection vulnerability in code-projects Online Music Site 1.0 exposes the application to remote, unauthenticated database manipulation.

Vulnerability Details

CVE-ID: CVE-2026-1534

Affected Software: code-projects Online Music Site

Affected Versions: 1.0

Vulnerability: This is a SQL injection flaw (CWE-89) located in the /Administrator/PHP/AdminEditUser.php file. The vulnerability allows an unauthenticated remote attacker to inject malicious SQL commands via the ID parameter.

Business Impact

The ability for an unauthenticated attacker to execute arbitrary SQL queries poses a severe risk to data confidentiality and integrity. Successful exploitation could lead to unauthorized access to sensitive user data, administrative credentials, or potential system compromise. With a CVSS score of 7.3, this high-severity vulnerability requires immediate attention to prevent unauthorized database access.

Remediation Plan

Immediate Action: Since a specific patch is not currently available, administrators should restrict network access to the /Administrator/ directory to trusted IP addresses only.

Proactive Monitoring: Review web server access logs for anomalous requests containing SQL syntax patterns directed at the AdminEditUser.php endpoint.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to detect and block common SQL injection payloads targeting URL parameters.

Exploitation Status

Public Exploit Available: Yes, a published proof-of-concept exists, as documented in the researcher's write-up at the referenced GitHub issue.

Analyst Notes: As of January 30, 2026, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The vulnerability is highly accessible due to the lack of required authentication.

Analyst Recommendation

Given the availability of a public proof-of-concept and the ease of remote, unauthenticated exploitation, this vulnerability presents a significant risk to the integrity of the affected application. Organizations must prioritize restricting access to the administrative interface and implementing WAF protections until a formal vendor security update is released and applied.

Description Summary:
A SQL injection vulnerability in code-projects Real State Services 1.0 allows remote, unauthenticated attackers to execute arbitrary SQL commands via the Bankname argument in /pay.php.

Executive Summary:
An unauthenticated SQL injection vulnerability in code-projects Real State Services 1.0 permits remote attackers to manipulate database queries and potentially access sensitive data.

Vulnerability Details

CVE-ID: CVE-2026-14769

Affected Software: code-projects Real State Services

Affected Versions: 1.0

Vulnerability: The /pay.php file fails to properly sanitize the Bankname parameter, allowing an unauthenticated attacker to inject malicious SQL commands. This provides a direct vector for unauthorized database interaction without requiring user authentication.

Business Impact

This vulnerability carries a CVSS score of 7.3, indicating a high risk of unauthorized data access and potential database manipulation. Exploitation could lead to the exposure of customer or financial information, resulting in significant reputational damage and potential regulatory non-compliance for the organization managing the service.

Remediation Plan

Immediate Action: Identify and restrict access to the vulnerable /pay.php file until the vendor provides a security update.

Proactive Monitoring: Monitor application logs for anomalous database activity or attempts to submit malformed input via the Bankname field.

Compensating Controls: Utilize a Web Application Firewall (WAF) to filter and block input containing SQL injection patterns directed at the /pay.php file.

Exploitation Status

Public Exploit Available: True

Analyst Notes: As of July 6, 2026, public exploit code exists for this vulnerability. Organizations using this software should treat the risk as elevated and implement immediate protective measures to prevent unauthorized database access.

Analyst Recommendation

The combination of unauthenticated access and public exploit availability necessitates immediate action. Organizations must apply compensating controls such as WAF filtering or access restrictions to mitigate this high-risk vulnerability until a vendor patch is issued.

Description Summary:
A critical SQL injection vulnerability in code-projects Real State Services 1.0 allows unauthenticated remote attackers to execute arbitrary SQL commands via the 'loc' parameter in /builderHome.php.

Executive Summary:
An unauthenticated SQL injection vulnerability in code-projects Real State Services 1.0 allows attackers to execute arbitrary SQL commands, risking total database compromise.

Vulnerability Details

CVE-ID: CVE-2026-14768

Affected Software: code-projects Real State Services

Affected Versions: 1.0

Vulnerability: The application contains a flaw in /builderHome.php where the 'loc' parameter is not properly sanitized, facilitating SQL injection. This allows an unauthenticated attacker to inject and execute arbitrary SQL commands, compromising the database layer.

Business Impact

With a CVSS score of 7.3, this vulnerability represents a significant risk to the integrity and confidentiality of the organization's data. Successful exploitation could allow attackers to bypass security controls, extract sensitive information, or disrupt service availability, potentially leading to severe business consequences.

Remediation Plan

Immediate Action: Restrict access to the /builderHome.php script immediately and seek guidance from the vendor regarding a security patch.

Proactive Monitoring: Review web server traffic and database logs for unusual query patterns or attempts to manipulate the 'loc' parameter in web requests.

Compensating Controls: Implement WAF rules specifically designed to detect and block SQL injection strings targeting the 'loc' parameter within the /builderHome.php file.

Exploitation Status

Public Exploit Available: True

Analyst Notes: As of July 6, 2026, public exploit information is available. The ease of exploitation via simple parameter manipulation makes this a critical issue that requires immediate defensive action.

Analyst Recommendation

The presence of a public exploit for this unauthenticated SQL injection vulnerability requires urgent attention. Organizations should implement defensive measures, such as WAF filtering, and restrict access to the affected script until the vendor releases a permanent fix.

Description Summary:
A SQL injection vulnerability in the add_event.php file of Code-Projects Hotel and Tourism Reservation 1.0 allows for remote, unauthenticated database manipulation.

Executive Summary:
A critical SQL injection vulnerability in Code-Projects Hotel and Tourism Reservation 1.0 allows unauthenticated remote attackers to manipulate the backend database, potentially leading to full data compromise.

Vulnerability Details

CVE-ID: CVE-2026-14764

Affected Software: Code-Projects Hotel and Tourism Reservation

Affected Versions: Code-Projects Hotel and Tourism Reservation 1.0

Vulnerability: This is a SQL injection flaw (CWE-89) located in the add_event.php file. The application fails to properly sanitize user-supplied input, allowing an unauthenticated attacker to inject malicious SQL commands directly into the database.

Business Impact

With a CVSS score of 7.3, this vulnerability poses a severe risk to the confidentiality and integrity of the application's data. Successful exploitation could allow an attacker to dump sensitive reservation information, modify administrative records, or potentially gain unauthorized access to the underlying server environment, resulting in significant reputational and financial damage.

Remediation Plan

Immediate Action: Given the lack of a specific patch, immediately restrict access to the add_event.php file or the entire application until a secure version is released or the code is manually sanitized.

Proactive Monitoring: Review web server access logs for unusual patterns, such as SQL keywords or URL-encoded characters in request parameters, which may indicate active exploitation attempts.

Compensating Controls: Deploy a Web Application Firewall (WAF) with strict SQL injection protection rules to block malicious input patterns targeting the application.

Exploitation Status

Public Exploit Available: True

Analyst Notes: As of July 7, 2026, there is a public exploit available for this vulnerability. Because the exploit is publicly disclosed, the risk of active exploitation is elevated and immediate action is required.

Analyst Recommendation

This vulnerability is highly dangerous due to the lack of authentication requirements and the availability of public exploit code. If this software is currently in use, it should be considered compromised until verified otherwise; isolate the application from the network until remediation is fully implemented.

Description Summary:
A SQL injection vulnerability exists in the Hotel and Tourism Reservation system, allowing unauthenticated remote attackers to manipulate the database via the 'tour' parameter in tour_reserves.php.

Executive Summary:
An unauthenticated SQL injection vulnerability in code-projects Hotel and Tourism Reservation 1.0 poses a significant risk of unauthorized database access and data manipulation.

Vulnerability Details

CVE-ID: CVE-2026-14763

Affected Software: code-projects Hotel and Tourism Reservation

Affected Versions: 1.0

Vulnerability: This is a SQL injection (CWE-89) vulnerability located in the /admin/tour_reserves.php file. The flaw allows unauthenticated remote attackers to inject malicious SQL commands via the 'tour' parameter, bypassing existing security controls.

Business Impact

Successful exploitation of this vulnerability can lead to unauthorized access to the backend database, potentially resulting in the compromise of sensitive reservation records and personal user information. Given the CVSS score of 7.3, this flaw represents a high-severity risk to business operations, specifically regarding data confidentiality and integrity. The ability for unauthenticated actors to interact directly with the database could also lead to significant reputational damage and regulatory non-compliance.

Remediation Plan

Immediate Action: As no official patch is currently available, restrict network access to the /admin/ directory and implement strict input validation on the 'tour' parameter to neutralize the SQL injection vector.

Proactive Monitoring: Monitor web server logs for anomalous HTTP requests targeting the tour_reserves.php file, specifically looking for SQL syntax patterns or unexpected character sequences in the 'tour' parameter.

Compensating Controls: Deploy a Web Application Firewall (WAF) with updated rulesets designed to detect and block common SQL injection payloads before they reach the application layer.

Exploitation Status

Public Exploit Available: true

Analyst Notes: As of July 6, 2026, while public exploit code is available for this vulnerability, there is no confirmed evidence of widespread exploitation in the wild. However, the availability of proof-of-concept code increases the likelihood of targeted attacks, necessitating immediate defensive measures.

Analyst Recommendation

Due to the high severity of this SQL injection vulnerability and the confirmed availability of public exploit code, organizations using the affected version of the Hotel and Tourism Reservation software must act immediately. Prioritize implementing the suggested compensating controls and strictly limit access to administrative interfaces until a formal vendor patch is released.

Description Summary:
A SQL injection vulnerability exists in the rooms.php component of code-projects Hotel and Tourism Reservation 1.0, allowing unauthenticated remote attackers to compromise database integrity.

Executive Summary:
An unauthenticated SQL injection vulnerability in code-projects Hotel and Tourism Reservation 1.0 poses a significant risk of unauthorized database access and data manipulation.

Vulnerability Details

CVE-ID: CVE-2026-14762

Affected Software: code-projects Hotel and Tourism Reservation

Affected Versions: 1.0

Vulnerability: This vulnerability is a SQL injection (CWE-89) flaw located in the rooms.php file. It allows an unauthenticated attacker to inject malicious SQL commands into the application's database, potentially bypassing existing security controls.

Business Impact

Successful exploitation of this vulnerability could lead to unauthorized access to sensitive reservation data, loss of confidentiality, and potential modification of system records. Given the CVSS score of 7.3, this is classified as a High-severity issue that could result in significant operational disruption and data breach risks if not addressed promptly.

Remediation Plan

Immediate Action: Since a specific patch is currently unknown, administrators should restrict public access to the affected application and disable the vulnerable rooms.php functionality if not required.

Proactive Monitoring: Monitor server access logs for suspicious SQL syntax patterns, such as UNION SELECT statements or unexpected characters in URL parameters.

Compensating Controls: Implement a Web Application Firewall (WAF) with strict SQL injection filtering rules to inspect and block malicious incoming requests targeting the application.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of July 6, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

This SQL injection vulnerability represents a critical risk to the integrity of the application database. Organizations using version 1.0 of this software must prioritize the implementation of WAF protections immediately and monitor vendor channels for the release of an official security patch.

Description Summary:
A SQL injection vulnerability in the add_tour.php script of code-projects Hotel and Tourism Reservation 1.0 permits unauthenticated attackers to perform unauthorized database operations.

Executive Summary:
An unauthenticated SQL injection vulnerability in code-projects Hotel and Tourism Reservation 1.0 creates a high risk of unauthorized database interaction and information disclosure.

Vulnerability Details

CVE-ID: CVE-2026-14756

Affected Software: code-projects Hotel and Tourism Reservation

Affected Versions: 1.0

Vulnerability: This is a SQL injection (CWE-89) vulnerability residing in the add_tour.php file. By failing to properly sanitize user-supplied input, the application allows an unauthenticated attacker to execute malicious SQL statements.

Business Impact

The ability for an unauthenticated user to inject SQL commands poses a severe threat to data integrity and confidentiality. Given the CVSS score of 7.3, this vulnerability could be leveraged to compromise the entire reservation system, leading to significant reputational and financial consequences.

Remediation Plan

Immediate Action: Restrict access to the add_tour.php script to authorized personnel only, and monitor the application for any signs of unauthorized configuration changes.

Proactive Monitoring: Regularly audit database transaction logs for anomalous activity or unexpected modifications to tour-related data tables.

Compensating Controls: Utilize a Web Application Firewall to intercept and sanitize malicious traffic before it reaches the add_tour.php script, effectively neutralizing the injection vector.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of July 6, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Given the high-severity rating, immediate action is required to harden the application against this SQL injection risk. Security teams should implement the aforementioned compensating controls and maintain a state of heightened vigilance until a permanent patch is released by the vendor.

Description Summary:
A SQL injection vulnerability exists in the add_event.php file of code-projects Hotel and Tourism Reservation 1.0, enabling unauthenticated remote attackers to execute arbitrary SQL queries.

Executive Summary:
An unauthenticated SQL injection vulnerability in code-projects Hotel and Tourism Reservation 1.0 exposes the underlying database to unauthorized manipulation and potential data exfiltration.

Vulnerability Details

CVE-ID: CVE-2026-14755

Affected Software: code-projects Hotel and Tourism Reservation

Affected Versions: 1.0

Vulnerability: The application is susceptible to SQL injection (CWE-89) within the add_event.php script. An unauthenticated attacker can supply crafted input to this parameter, resulting in the execution of unauthorized database commands.

Business Impact

Exploitation of this vulnerability allows an attacker to interact directly with the application database, potentially leading to the theft of reservation records or administrative credentials. With a CVSS score of 7.3, the vulnerability presents a high risk to business operations, necessitating immediate defensive measures to prevent unauthorized data access.

Remediation Plan

Immediate Action: As no patch is currently available, restrict network access to the add_event.php endpoint to authorized internal users only.

Proactive Monitoring: Review database logs for unusual query activity or errors originating from the add_event.php script that suggest injection attempts.

Compensating Controls: Deploy WAF rules specifically designed to detect and block SQL injection payloads targeting input parameters used in the event management module.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of July 6, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

The presence of a high-severity SQL injection vulnerability requires immediate attention to protect the application backend. Administrators should apply perimeter security measures immediately to mitigate the risk until an official vendor update is provided.

Description Summary:
A SQL injection vulnerability in the code-projects Hotel and Tourism Reservation system allows unauthenticated attackers to execute arbitrary database queries.

Executive Summary:
A critical SQL injection vulnerability in the code-projects Hotel and Tourism Reservation system enables unauthenticated attackers to compromise sensitive backend database information.

Vulnerability Details

CVE-ID: CVE-2026-14754

Affected Software: code-projects Hotel and Tourism Reservation

Affected Versions: 1.0

Vulnerability: The application fails to properly sanitize user-supplied input before using it in database queries (CWE-89, CWE-74), facilitating SQL injection attacks that can be performed by unauthenticated users.

Business Impact

A successful SQL injection attack can lead to total compromise of the database, including the theft of sensitive customer information or credentials. Given the 7.3 CVSS score, this vulnerability represents a high risk to business operations, as it may result in data breaches and non-compliance with data protection regulations.

Remediation Plan

Immediate Action: Audit the source code for vulnerable input fields and apply parameterized queries to neutralize the SQL injection vector.

Proactive Monitoring: Monitor database query logs for suspicious syntax, such as UNION SELECT statements or unauthorized access attempts to sensitive tables.

Compensating Controls: Deploy a Web Application Firewall (WAF) configured with SQL injection protection rules to filter malicious input before it reaches the application.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of July 6, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

SQL injection remains a primary vector for data exfiltration; therefore, addressing this flaw is critical. Organizations using version 1.0 should restrict access to the application immediately and prioritize the implementation of input validation and parameterized queries.

Description Summary:
A SQL injection vulnerability in code-projects Real State Services 1.0 allows unauthenticated remote attackers to manipulate database queries via the 'amen' parameter in /addprojectsale.php.

Executive Summary:
An unauthenticated SQL injection vulnerability in code-projects Real State Services 1.0 poses a significant risk of unauthorized data access and database manipulation.

Vulnerability Details

CVE-ID: CVE-2026-14747

Affected Software: code-projects Real State Services

Affected Versions: code-projects Real State Services 1.0

Vulnerability: This is a SQL injection vulnerability within the /addprojectsale.php file, specifically triggered via the 'amen' parameter. The flaw allows an unauthenticated remote attacker to inject malicious SQL commands, enabling unauthorized interaction with the underlying database.

Business Impact

The vulnerability carries a CVSS score of 7.3, reflecting its high severity and potential for significant impact. Successful exploitation could lead to the exposure of sensitive real estate data, unauthorized modification or deletion of records, and potential privilege escalation, resulting in severe operational disruption and reputational damage.

Remediation Plan

Immediate Action: As no patch is currently available, restrict access to the /addprojectsale.php endpoint and implement strict input validation for the 'amen' parameter.

Proactive Monitoring: Review web server and database logs for anomalous query patterns, specifically those containing SQL syntax characters (e.g., ' OR 1=1 --) originating from external IP addresses.

Compensating Controls: Deploy a Web Application Firewall (WAF) with updated rulesets configured to detect and block SQL injection attempts targeting the affected application parameters.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of July 6, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Given the ability for unauthenticated actors to compromise the database, organizations using this software should prioritize isolating the affected component. Until a formal vendor patch is released, strict input sanitization and WAF filtering are essential to mitigate the risk of unauthorized data manipulation.

Description Summary:
A SQL injection vulnerability in code-projects Real State Services 1.0 allows remote unauthenticated attackers to execute arbitrary database commands via the 'amen' parameter in /addprojectrent.php.

Executive Summary:
An unauthenticated SQL injection vulnerability in code-projects Real State Services 1.0 permits remote command execution against the database, with public exploit code currently available.

Vulnerability Details

CVE-ID: CVE-2026-14746

Affected Software: code-projects Real State Services

Affected Versions: code-projects Real State Services 1.0

Vulnerability: This is a SQL injection vulnerability affecting the /addprojectrent.php file, specifically within the 'amen' parameter. An unauthenticated attacker can manipulate this parameter to execute unauthorized SQL commands, allowing for the extraction or destruction of database contents.

Business Impact

The CVSS score of 7.3 underscores the severity of this flaw, which is further elevated by the existence of public exploit code. The potential for data breaches, loss of data integrity, and unauthorized access to the underlying database structure poses a critical risk to business operations and data confidentiality.

Remediation Plan

Immediate Action: Immediately restrict access to the /addprojectrent.php endpoint and implement strict input validation for the 'amen' parameter to prevent malicious query injection.

Proactive Monitoring: Increase logging levels for database interactions and monitor for unusual query strings that suggest SQL injection attempts, especially those targeting the 'amen' parameter.

Compensating Controls: Implement a Web Application Firewall (WAF) to filter and block requests containing malicious SQL injection payloads targeting the identified vulnerable script.

Exploitation Status

Public Exploit Available: true

Analyst Notes: As of July 6, 2026, public exploits are available, which allows even low-skill attackers to target this system. Organizations should assume that scanners are actively searching for this vulnerability.

Analyst Recommendation

The availability of public exploit code, combined with the lack of required authentication, makes this a high-urgency issue. It is recommended to implement the suggested compensating controls immediately until a vendor-supplied patch is available.

Description Summary:
A SQL injection vulnerability exists in code-projects Real State Services 1.0, allowing unauthenticated attackers to compromise database security via the 'ID' parameter in /single-list_rent.php.

Executive Summary:
A critical SQL injection vulnerability in code-projects Real State Services 1.0 is currently susceptible to public exploit code, increasing the risk of immediate compromise.

Vulnerability Details

CVE-ID: CVE-2026-14745

Affected Software: code-projects Real State Services

Affected Versions: code-projects Real State Services 1.0

Vulnerability: This is a SQL injection vulnerability located in the /single-list_rent.php file, which fails to properly sanitize the 'ID' parameter. An unauthenticated attacker can leverage this flaw to execute arbitrary database queries, leading to full database compromise.

Business Impact

With a CVSS score of 7.3 and the confirmed availability of public exploit code, this vulnerability represents an urgent threat. Successful exploitation can result in the complete breach of sensitive information, unauthorized modification or deletion of real estate listings, and unauthorized access to administrative functions.

Remediation Plan

Immediate Action: Given the availability of public exploits, immediately restrict access to the /single-list_rent.php file and implement robust server-side input validation for the 'ID' parameter.

Proactive Monitoring: Monitor database query logs for suspicious activity, particularly queries that deviate from expected patterns or attempt to bypass authentication via the 'ID' parameter.

Compensating Controls: Utilize a Web Application Firewall (WAF) to inspect incoming traffic for SQL injection signatures specifically targeting the 'ID' parameter in the affected URI.

Exploitation Status

Public Exploit Available: true

Analyst Notes: As of July 6, 2026, public exploits for this vulnerability are available, significantly lowering the barrier for entry for malicious actors. Immediate mitigation is required.

Analyst Recommendation

The combination of unauthenticated access and available public exploit code makes this a high-priority vulnerability. System administrators must treat this as an active threat and apply protective measures immediately to prevent unauthorized database access.

Description Summary:
An SQL injection vulnerability in the Real State Services application allows unauthenticated remote attackers to execute unauthorized database queries via the 'loc' parameter.

Executive Summary:
A critical SQL injection vulnerability in code-projects Real State Services 1.0 permits unauthenticated attackers to execute arbitrary database commands, posing a significant risk of data compromise.

Vulnerability Details

CVE-ID: CVE-2026-14744

Affected Software: code-projects Real State Services

Affected Versions: code-projects Real State Services 1.0

Vulnerability: This is an SQL injection vulnerability located within the /normalHomeRent.php file. It allows unauthenticated remote attackers to manipulate the 'loc' parameter to inject and execute arbitrary SQL commands against the backend database.

Business Impact

Successful exploitation of this vulnerability could lead to unauthorized access to sensitive information, potential data modification, or complete database compromise. Given the CVSS score of 7.3 (High), the ability for unauthenticated remote attackers to bypass security controls and interact directly with the database poses a severe threat to the confidentiality and integrity of business data.

Remediation Plan

Immediate Action: Since no specific patch version is currently available, contact the vendor for security updates or, if possible, remove the vulnerable component from public access.

Proactive Monitoring: Monitor web server logs for suspicious HTTP requests targeting /normalHomeRent.php containing SQL-related characters or patterns.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to detect and block SQL injection attempts targeting the 'loc' parameter.

Exploitation Status

Public Exploit Available: true

Analyst Notes: As of July 6, 2026, there is no public information indicating active exploitation of this vulnerability in the wild. However, due to the public availability of exploit code, the potential for exploitation is high, and immediate defensive measures are required.

Analyst Recommendation

The presence of a public exploit for this unauthenticated SQL injection flaw makes it a high-priority risk. Organizations using code-projects Real State Services 1.0 must prioritize the implementation of WAF filtering and strict access controls until an official security patch is released by the vendor.

Description Summary:
A SQL injection vulnerability in code-projects Real State Services 1.0 allows unauthenticated remote attackers to execute arbitrary database commands via the 'loc' argument in /normalHomeSale.php.

Executive Summary:
An unauthenticated SQL injection vulnerability in code-projects Real State Services 1.0 poses a significant risk of unauthorized database manipulation and potential data compromise.

Vulnerability Details

CVE-ID: CVE-2026-14743

Affected Software: code-projects Real State Services

Affected Versions: code-projects Real State Services 1.0

Vulnerability: This vulnerability is a classic SQL injection flaw (CWE-89) triggered by insufficient input validation in the 'loc' parameter within the /normalHomeSale.php file. Because this endpoint does not require authentication, remote attackers can interact with the application database without prior access credentials.

Business Impact

Successful exploitation of this vulnerability allows an attacker to execute arbitrary SQL commands against the backend database. Given the CVSS score of 7.3, this represents a high-severity risk that could lead to unauthorized data exfiltration, modification, or deletion of sensitive real estate records. Such an incident could result in significant reputational damage, loss of data integrity, and potential non-compliance with data privacy regulations.

Remediation Plan

Immediate Action: Since no official patch is currently available, administrators should restrict access to the vulnerable /normalHomeSale.php endpoint or take the application offline until the vendor releases a security update.

Proactive Monitoring: Security teams should review web server and database logs for anomalous query patterns, particularly those containing SQL syntax or unexpected input strings directed at the loc parameter.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to detect and block SQL injection payloads targeting the application's input parameters.

Exploitation Status

Public Exploit Available: true

Analyst Notes: As of July 6, 2026, public proof-of-concept exploits are available for this vulnerability. Organizations should treat this as an active threat, as the low complexity of the attack vector makes it a prime target for automated scanning and exploitation.

Analyst Recommendation

Due to the availability of public exploits and the unauthenticated nature of the attack vector, this vulnerability should be prioritized for immediate remediation. Organizations using code-projects Real State Services 1.0 must implement strict WAF filtering or isolate the affected service to prevent unauthorized database access until an official vendor patch is released.

Description Summary:
A SQL injection vulnerability exists in the code-projects Smart Parking System 1.0, allowing unauthenticated remote attackers to execute arbitrary SQL commands and read files.

Executive Summary:
An unauthenticated SQL injection vulnerability in the code-projects Smart Parking System allows remote attackers to compromise database integrity and potentially access sensitive files.

Vulnerability Details

CVE-ID: CVE-2026-14735

Affected Software: code-projects Smart Parking System

Affected Versions: code-projects Smart Parking System 1.0

Vulnerability: The application is susceptible to SQL injection via the /parkings/parkings.php script. Unauthenticated remote attackers can manipulate parameters such as 'street', 'city', or 'status' to inject malicious SQL commands, leading to unauthorized database interaction.

Business Impact

With a CVSS score of 7.3 (High), this vulnerability poses a significant risk to data confidentiality and integrity. Successful exploitation could lead to unauthorized access to the application’s backend database, potentially resulting in the exfiltration of sensitive information or the exposure of arbitrary files on the host system.

Remediation Plan

Immediate Action: Contact the vendor for official security patches. In the absence of a vendor-provided update, restrict network access to the application to trusted IP addresses only.

Proactive Monitoring: Review web server and database access logs for anomalous query patterns, specifically looking for SQL syntax characters (e.g., ', --, UNION) in input parameters.

Compensating Controls: Deploy a Web Application Firewall (WAF) with updated rulesets to detect and block common SQL injection patterns targeting the identified parameters.

Exploitation Status

Public Exploit Available: True

Analyst Notes: As of July 6, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the availability of public exploit details and the ease of unauthenticated access, the risk remains high.

Analyst Recommendation

Given the High severity rating and the presence of public exploit scripts, administrators should prioritize securing this application immediately. If an official patch is not available, implement strict input validation and WAF filtering to prevent exploitation until a permanent remediation can be applied.

Description Summary:
A SQL injection vulnerability in the 'head.php' file of code-projects Online Examination 1.0 allows unauthenticated remote attackers to manipulate database queries.

Executive Summary:
An unauthenticated SQL injection vulnerability in code-projects Online Examination 1.0 poses a critical risk of unauthorized database access and data compromise.

Vulnerability Details

CVE-ID: CVE-2026-14705

Affected Software: code-projects Online Examination

Affected Versions: code-projects Online Examination 1.0

Vulnerability: This is a SQL injection vulnerability (CWE-89) located in the 'head.php' file. Unauthenticated remote attackers can manipulate the 'uname' and 'password' parameters to execute arbitrary SQL commands, potentially exposing user accounts, examination data, and system configurations.

Business Impact

Successful exploitation of this vulnerability could lead to a complete compromise of the application's backend database. Given the CVSS score of 7.3, this represents a high-severity risk that could result in unauthorized data exfiltration, loss of academic integrity, or system-wide disruption. The availability of public exploit code lowers the barrier for attackers to gain unauthorized access to sensitive institutional information.

Remediation Plan

Immediate Action: Since no official patch is currently available, administrators should restrict network access to the application and implement input validation routines to sanitize the 'uname' and 'password' parameters.

Proactive Monitoring: Review web server access logs for anomalous request patterns, specifically looking for SQL syntax characters (e.g., ', --, UNION) within the 'head.php' request parameters.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to detect and block common SQL injection patterns targeting authentication parameters.

Exploitation Status

Public Exploit Available: True

Analyst Notes: As of July 6, 2026, there is public exploit code available for this vulnerability. The risk is elevated as threat actors can leverage existing attack frameworks to target this flaw, making immediate defensive measures mandatory.

Analyst Recommendation

Organizations utilizing this software must treat this as a high-priority issue due to the confirmed public exploit availability. Until a vendor-supplied patch is released, ensure that the application is isolated from public internet access where possible and that WAF rules are strictly enforced to mitigate potential SQL injection attempts.

Description Summary:
A critical SQL injection vulnerability in the employer/login.php file of code-projects Internship Management System 1.0 allows for unauthenticated remote command injection.

Executive Summary:
An unauthenticated SQL injection vulnerability in code-projects Internship Management System 1.0 poses a severe risk of unauthorized data access and potential system compromise.

Vulnerability Details

CVE-ID: CVE-2026-14700

Affected Software: code-projects Internship Management System

Affected Versions: code-projects Internship Management System 1.0

Vulnerability: This is a SQL injection vulnerability located in the employer/login.php component. The application fails to properly sanitize the email and password parameters, allowing an unauthenticated attacker to inject malicious SQL commands directly into the backend database.

Business Impact

The vulnerability carries a CVSS score of 7.3, indicating a high level of technical risk. Successful exploitation could lead to unauthorized access to sensitive internship and employer records, potentially resulting in full database compromise, data exfiltration, or modification of administrative credentials. Such a breach could cause significant reputational damage and legal liability regarding the protection of user data.

Remediation Plan

Immediate Action: Since no official patch is currently available, administrators should immediately restrict network access to the affected system and implement strict input validation on the login interface.

Proactive Monitoring: Review web server access logs for anomalous characters or SQL keywords in login attempts, and monitor database audit logs for unauthorized queries or unexpected modifications.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to detect and block common SQL injection patterns targeting the login.php endpoint.

Exploitation Status

Public Exploit Available: true

Analyst Notes: As of July 5, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the existence of public proof-of-concept code, the potential for exploitation is high.

Analyst Recommendation

Given the availability of public exploits and the unauthenticated nature of the attack vector, this vulnerability should be treated with high priority. Organizations using this software must implement compensating controls immediately to mitigate the risk of exploitation while waiting for official vendor guidance or security updates.

Description Summary:
A SQL injection vulnerability exists in code-projects Online Job Portal 1.0, allowing unauthenticated attackers to execute arbitrary database queries.

Executive Summary:
The code-projects Online Job Portal is vulnerable to an unauthenticated SQL injection attack, which could lead to unauthorized database access and data exfiltration.

Vulnerability Details

CVE-ID: CVE-2026-14660

Affected Software: code-projects Online Job Portal

Affected Versions: 1.0

Vulnerability: This is a SQL Injection (CWE-89) vulnerability where input is not properly sanitized before being processed in database queries. The attack vector is network-based and requires no authentication from the attacker.

Business Impact

The ability for an unauthenticated attacker to inject malicious SQL commands poses a severe risk to the confidentiality, integrity, and availability of the underlying database. With a CVSS score of 7.3, this flaw could be leveraged to dump sensitive user information or compromise portal functionality, resulting in significant reputational and operational damage.

Remediation Plan

Immediate Action: Contact the vendor for a security update or patch; if unavailable, restrict network access to the application interface.

Proactive Monitoring: Inspect web server and database logs for suspicious SQL syntax patterns or unexpected query strings originating from external IP addresses.

Compensating Controls: Deploy a Web Application Firewall (WAF) with SQL injection protection rules enabled to filter malicious traffic before it reaches the application.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of July 5, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Given the severity of SQL injection vulnerabilities, immediate action is required to secure the environment. Administrators should verify the installation and contact the vendor for a fix, while implementing strict input validation and WAF rules to mitigate the risk of unauthorized database interaction.

Description Summary:
A SQL injection vulnerability exists in the test_input function of /saveVote.php in code-projects Online Voting System 1.0, allowing unauthenticated remote attackers to execute malicious SQL commands.

Executive Summary:
An unauthenticated SQL injection vulnerability in code-projects Online Voting System 1.0 allows attackers to remotely manipulate input parameters, risking the integrity of the voting data.

Vulnerability Details

CVE-ID: CVE-2026-14649

Affected Software: code-projects Online Voting System

Affected Versions: code-projects Online Voting System 1.0

Vulnerability: The vulnerability is located in the test_input function within the /saveVote.php file. The system fails to properly secure the voterName, voterEmail, voterID, and selectedCandidate parameters, allowing an attacker to inject arbitrary SQL commands without any authentication or user interaction.

Business Impact

The CVSS score of 7.3 highlights a high-severity threat to the system's data integrity. Exploitation could allow an attacker to manipulate voting results, exfiltrate voter PII (Personally Identifiable Information), or compromise the underlying database, which undermines the entire purpose of an online voting platform.

Remediation Plan

Immediate Action: In the absence of an official patch, administrators should take the system offline if possible or restrict access to the voting portal until the code can be manually hardened.

Proactive Monitoring: Review application logs for suspicious entries in the parameters passed to /saveVote.php and monitor database performance for signs of unauthorized query execution.

Compensating Controls: Deploy WAF rules designed to block SQL injection patterns specifically targeting the /saveVote.php endpoint to mitigate the risk of automated exploitation.

Exploitation Status

Public Exploit Available: true

Analyst Notes: As of July 5, 2026, there is no public information indicating active exploitation of this vulnerability. However, the availability of public exploits necessitates immediate defensive action.

Analyst Recommendation

This vulnerability is critical due to the potential for data tampering in a system designed for sensitive information collection. Administrators must implement immediate defensive measures and monitor for any signs of unauthorized access, as the lack of authentication requirements makes this an attractive target for attackers.

Description Summary:
A SQL injection vulnerability in the login component of code-projects Online Voting System allows unauthenticated attackers to compromise the system via the test_input function.

Executive Summary:
An unauthenticated SQL injection vulnerability in the code-projects Online Voting System poses a critical risk of administrative account compromise.

Vulnerability Details

CVE-ID: CVE-2026-14648

Affected Software: code-projects Online Voting System

Affected Versions: code-projects Online Voting System up to 0.x/1.0

Vulnerability: This is a SQL injection vulnerability located in the test_input function within /authentication.php. An unauthenticated remote attacker can exploit this by manipulating the adminUserName or adminPassword parameters to bypass authentication or gain unauthorized administrative access.

Business Impact

The vulnerability carries a CVSS score of 7.3, indicating a high risk of unauthorized access to sensitive application data. Successful exploitation could allow an attacker to gain full administrative control over the voting system, potentially leading to the manipulation of voting results, data exfiltration, or complete system compromise, causing significant reputational and operational damage.

Remediation Plan

Immediate Action: Since no official patch is available, restrict access to the login interface via IP allowlisting or VPN requirements until a secure version is released.

Proactive Monitoring: Monitor application logs for abnormal patterns in the adminUserName or adminPassword fields, specifically looking for SQL syntax characters such as single quotes, semicolons, or comment indicators.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to detect and block common SQL injection payloads targeting authentication endpoints.

Exploitation Status

Public Exploit Available: true

Analyst Notes: As of July 5, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw and the existence of public exploit code, the potential for exploitation is high.

Analyst Recommendation

Given the ease of exploitation and the critical nature of the compromised component, organizations currently running the Online Voting System should treat this as a high-priority risk. If the software cannot be updated or patched, it should be taken offline or placed behind robust network-level access controls to prevent unauthorized remote exploitation.

Description Summary:
A SQL injection vulnerability in code-projects Online Music Site 1.0 allows remote, unauthenticated attackers to manipulate the ID argument in AdminDeleteUser.php.

Executive Summary:
An unauthenticated SQL injection vulnerability in code-projects Online Music Site 1.0 poses a significant risk to data integrity and system availability.

Vulnerability Details

CVE-ID: CVE-2026-1443

Affected Software: code-projects Online Music Site

Affected Versions: 1.0

Vulnerability: This vulnerability is a SQL injection flaw (CWE-89) located in the /Administrator/PHP/AdminDeleteUser.php file. It allows an unauthenticated remote attacker to inject malicious SQL queries by manipulating the ID parameter.

Business Impact

The ability for an unauthenticated attacker to inject arbitrary SQL commands into the backend database can lead to unauthorized data access, modification, or deletion. Given the CVSS score of 7.3, this represents a high-severity risk that could result in the compromise of user accounts or sensitive administrative information, directly impacting the confidentiality and integrity of the platform.

Remediation Plan

Immediate Action: As no official vendor patch is currently confirmed, administrators should restrict access to the /Administrator/ directory to trusted IP addresses only.

Proactive Monitoring: Review web server access logs for anomalous requests to the AdminDeleteUser.php endpoint, specifically looking for characters indicative of SQL injection, such as single quotes, semicolons, or SQL keywords.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to detect and block common SQL injection patterns targeting the identified vulnerable parameter.

Exploitation Status

Public Exploit Available: Yes, a published proof-of-concept exists via the GitHub repository referenced in the vulnerability record.

Analyst Notes: As of January 28, 2026, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment and the existence of a public proof-of-concept, exploitation risk should be treated as credible. The vulnerability is highly accessible to attackers due to the lack of required authentication.

Analyst Recommendation

The presence of a public proof-of-concept for this SQL injection vulnerability necessitates urgent attention. Because this flaw is unauthenticated and remotely exploitable, administrators must implement network-level access controls or WAF protections immediately to prevent potential database compromise. Constant monitoring for exploitation attempts is advised until a vendor-supplied security update is released and applied.

Description Summary:
A SQL injection vulnerability in the code-projects Online Examination System 1.0 login page allows unauthenticated remote attackers to manipulate database queries via the User argument.

Executive Summary:
A critical SQL injection vulnerability in the code-projects Online Examination System 1.0 login page enables unauthenticated attackers to bypass authentication and compromise database integrity.

Vulnerability Details

CVE-ID: CVE-2026-1422

Affected Software: code-projects Online Examination System

Affected Versions: 1.0

Vulnerability: This vulnerability is a SQL injection flaw located in the index.php file of the login page. An unauthenticated attacker can supply malicious input to the User parameter to execute arbitrary SQL commands against the backend database.

Business Impact

Successful exploitation of this vulnerability allows unauthorized access to the application, potentially leading to a full bypass of the authentication mechanism. This poses a significant risk of data exfiltration, unauthorized administrative access, and potential compromise of sensitive user examination records. Given the CVSS score of 7.3, this represents a high-severity risk that could result in substantial reputational damage and loss of system integrity.

Remediation Plan

Immediate Action: As no official patch is currently available, administrators should immediately restrict access to the login interface or take the system offline until a secure version is released.

Proactive Monitoring: Security teams should monitor database access logs for anomalous query patterns, such as unexpected syntax or large volumes of unsuccessful login attempts originating from unknown sources.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to detect and block SQL injection payloads targeting the login parameter.

Exploitation Status

Public Exploit Available: Yes, a published proof-of-concept exists as documented in the research write-up by the vulnerability discoverer.

Analyst Notes: As of January 27, 2026, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The vulnerability is highly exploitable due to the insecure usage of deprecated mysql functions in the codebase.

Analyst Recommendation

The presence of a public proof-of-concept and the lack of a vendor-supplied patch necessitate immediate defensive action. Organizations currently utilizing the code-projects Online Examination System 1.0 must isolate the application from public networks to prevent exploitation while awaiting a permanent security update.

Description Summary:
A security weakness has been identified in the code-projects Real State Services application that could potentially lead to system compromise.

Executive Summary:
A high-severity vulnerability in the code-projects Real State Services platform may allow unauthorized actors to compromise system integrity.

Vulnerability Details

CVE-ID: CVE-2026-13559

Affected Software: code-projects Real State Services

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: The application contains an unspecified security weakness within its core functionality. While authentication requirements are not explicitly detailed, such flaws often impact the integrity and availability of the service.

Business Impact

This vulnerability carries a CVSS score of 7.3, indicating a high risk to organizational security. Successful exploitation could result in unauthorized access to sensitive real estate data, potential service disruption, and significant reputational damage to the organization hosting the software.

Remediation Plan

Immediate Action: Consult the vendor’s security portal to identify and apply the latest security patches or configuration updates.

Proactive Monitoring: Monitor server logs for unusual traffic patterns or unauthorized access attempts targeting the application's core modules.

Compensating Controls: Deploy a Web Application Firewall (WAF) with updated rulesets to filter potentially malicious requests aimed at exploiting known application weaknesses.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of June 30, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Given the High severity rating, administrators must prioritize the assessment of their specific deployment version against vendor guidance. Promptly applying available updates is essential to mitigate the risk of exploitation and ensure the continued security of the Real State Services environment.

Description Summary:
An SQL injection vulnerability in code-projects Online Music Site 1.0 allows attackers to manipulate the 'Category' argument in /Frontend/Search.php.

Executive Summary:
An unauthenticated SQL injection vulnerability in the code-projects Online Music Site enables remote attackers to execute unauthorized database queries.

Vulnerability Details

CVE-ID: CVE-2026-11490

Affected Software: code-projects Online Music Site

Affected Versions: code-projects Online Music Site 1.0

Vulnerability: The application improperly validates the 'Category' argument in the /Frontend/Search.php file. An unauthenticated attacker can exploit this to inject arbitrary SQL commands into the backend database.

Business Impact

With a CVSS score of 7.3, this flaw presents a significant risk to the confidentiality and integrity of the application. Exploitation could allow attackers to dump the contents of the database, including user credentials or sensitive configuration information, potentially leading to a full system compromise.

Remediation Plan

Immediate Action: Upgrade to the latest version of the Online Music Site provided by the vendor to remediate the vulnerable parameter.

Proactive Monitoring: Review database query logs for evidence of unusual query structures or unauthorized access attempts originating from the search functionality.

Compensating Controls: Implement strict input validation and parameterized queries at the application layer, and utilize a WAF to filter malicious input strings targeting the search module.

Exploitation Status

Public Exploit Available: true

Analyst Notes: As of June 8, 2026, a public exploit is available. The lack of authentication required for this vulnerability makes it an attractive target for automated scanning and exploitation.

Analyst Recommendation

Organizations running this software must act quickly to mitigate this risk. Ensure that all database interactions are performed using prepared statements to prevent further injection vulnerabilities, and apply vendor-supplied patches as soon as they are available.

Description Summary:
A security vulnerability has been identified within the code-projects Online Music Site application.

Executive Summary:
A high-severity flaw in the code-projects Online Music Site could allow attackers to compromise the application's integrity or availability.

Vulnerability Details

CVE-ID: CVE-2026-11489

Affected Software: code-projects Online Music Site

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: This vulnerability affects the Online Music Site platform, potentially allowing unauthorized users to interact with sensitive components of the application.

Business Impact

A CVSS score of 7.3 indicates a High-severity risk, representing a potential threat to user data and the overall availability of the music hosting platform. Unauthorized access could result in the defacement of the site, loss of user content, or broader service disruption, negatively impacting the platform's reputation.

Remediation Plan

Immediate Action: Check the vendor's security portal for updates and apply all relevant patches to the Online Music Site immediately.

Proactive Monitoring: Review application logs for anomalous user activities or unauthorized administrative commands.

Compensating Controls: Deploy a Web Application Firewall (WAF) to filter malicious traffic and mitigate potential exploitation attempts while awaiting a formal patch.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of June 8, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Security teams should treat this vulnerability with urgency by applying available patches to all production instances of the Online Music Site. Maintaining robust logging and monitoring is critical to identifying and responding to any potential exploitation attempts.

Description Summary:
A security vulnerability has been identified in the code-projects Simple Flight Ticket Booking System.

Executive Summary:
A vulnerability in the code-projects Simple Flight Ticket Booking System poses a high risk to organizational data integrity and system availability.

Vulnerability Details

CVE-ID: CVE-2026-11488

Affected Software: code-projects Simple Flight Ticket Booking System

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: This vulnerability involves a flaw within the Simple Flight Ticket Booking System. Due to the lack of specific technical details, it is assumed that an attacker could potentially leverage this flaw to compromise the application, pending further authentication analysis.

Business Impact

Successful exploitation of this vulnerability could lead to unauthorized access to flight booking data or system compromise, resulting in potential data theft or operational disruption. With a CVSS score of 7.3, this flaw is categorized as High, indicating that while it may not be trivially wormable, it represents a significant security risk to the confidentiality and integrity of the hosting environment.

Remediation Plan

Immediate Action: Review the vendor's official security disclosures and apply all available patches or updates to the Simple Flight Ticket Booking System immediately.

Proactive Monitoring: Monitor application and web server logs for suspicious request patterns, unauthorized access attempts, or anomalous database query behavior originating from the booking module.

Compensating Controls: Deploy or update Web Application Firewall (WAF) rules to filter malicious traffic and block common attack vectors that may target booking systems until a patch is verified and applied.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of June 8, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation remains a concern for any organization running this software in a production environment.

Analyst Recommendation

Given the High severity rating, administrators must prioritize the assessment of their deployment of the Simple Flight Ticket Booking System. We recommend identifying all instances of the affected software within the environment and applying the necessary updates as soon as the vendor provides them to mitigate the risk of unauthorized system access.

Description Summary:
A SQL injection vulnerability in code-projects Online Music Site 1.0 allows remote, unauthenticated attackers to manipulate the ID argument via /Administrator/PHP/AdminUpdateUser.php.

Executive Summary:
A critical SQL injection vulnerability in code-projects Online Music Site 1.0 allows unauthenticated remote attackers to compromise database integrity and potentially access administrative functions.

Vulnerability Details

CVE-ID: CVE-2026-0852

Affected Software: code-projects Online Music Site

Affected Versions: 1.0

Vulnerability: This vulnerability is an SQL injection flaw (CWE-89) located in the /Administrator/PHP/AdminUpdateUser.php file. The issue arises from improper sanitization of the ID argument, which can be triggered by an unauthenticated attacker via a remote network request.

Business Impact

Successful exploitation of this vulnerability can lead to unauthorized access to the underlying database, potentially allowing attackers to view, modify, or delete sensitive user and administrative data. Given the CVSS score of 7.3, this represents a high-severity risk that could lead to full application compromise, loss of data confidentiality, and potential reputational damage for organizations hosting the platform.

Remediation Plan

Immediate Action: As no official patch is currently available, administrators should restrict access to the /Administrator/ directory to trusted IP addresses only.

Proactive Monitoring: Monitor server access logs for suspicious patterns in the URL, specifically looking for unusual characters or SQL syntax in the ID parameter within requests to /Administrator/PHP/AdminUpdateUser.php.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to detect and block SQL injection attempts targeting the identified vulnerable script.

Exploitation Status

Public Exploit Available: Yes, a public proof-of-concept exists, as documented in the GitHub issue referenced in the vulnerability record.

Analyst Notes: As of January 13, 2026, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The flaw is inherently dangerous due to its remote, unauthenticated nature and the ease of triggering the injection via standard HTTP requests.

Analyst Recommendation

Due to the presence of a public proof-of-concept and the ease of exploitation, this vulnerability poses a significant threat. Administrators must prioritize isolating the affected component from the public internet and implementing stringent WAF filtering. Continuous monitoring is essential until the vendor provides a secure update to address the underlying code flaw.

Description Summary:
A SQL injection vulnerability in code-projects Online Music Site 1.0 allows unauthenticated remote attackers to execute arbitrary database commands via the txtusername parameter.

Executive Summary:
An unauthenticated SQL injection vulnerability in code-projects Online Music Site 1.0 poses a significant risk of unauthorized database access and potential data compromise.

Vulnerability Details

CVE-ID: CVE-2026-0851

Affected Software: code-projects Online Music Site

Affected Versions: 1.0

Vulnerability: This vulnerability is a SQL injection flaw (CWE-89) located in the /Administrator/PHP/AdminAddUser.php file, which fails to properly sanitize input provided through the txtusername argument. The vulnerability is remotely exploitable by an unauthenticated attacker, allowing for unauthorized interaction with the underlying database.

Business Impact

Successful exploitation of this flaw allows attackers to bypass authentication or manipulate database queries, potentially leading to unauthorized data exfiltration or administrative account compromise. Given the CVSS score of 7.3, this represents a high-severity risk that could lead to significant reputational damage and loss of sensitive user information.

Remediation Plan

Immediate Action: As no official patch is currently available, administrators should restrict network access to the administrative directory and implement strict input validation for all user-supplied data.

Proactive Monitoring: Review web server access logs for anomalous requests to /Administrator/PHP/AdminAddUser.php, particularly those containing SQL syntax or unusual string lengths in the txtusername parameter.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to detect and block common SQL injection patterns, which can provide effective virtual patching while a permanent fix is developed.

Exploitation Status

Public Exploit Available: Yes, a published proof-of-concept exists, as documented in the GitHub issue referenced in the vulnerability report.

Analyst Notes: As of January 13, 2026, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The simplicity of the attack vector makes this vulnerability highly susceptible to automated scanning and exploitation tools.

Analyst Recommendation

Due to the lack of an official patch and the public availability of a proof-of-concept, the risk of exploitation is elevated. Organizations should prioritize isolating the affected application from public networks or implementing robust WAF filtering to prevent unauthorized database access until a vendor-supplied update is released.

Description Summary:
A SQL injection vulnerability exists in the check_admin.php file of the Intern Membership Management System 1.0, allowing unauthenticated remote attackers to manipulate the Username argument.

Executive Summary:
A critical SQL injection vulnerability in the code-projects Intern Membership Management System 1.0 allows unauthenticated attackers to compromise sensitive database information.

Vulnerability Details

CVE-ID: CVE-2026-0700

Affected Software: code-projects Intern Membership Management System

Affected Versions: 1.0

Vulnerability: The application is vulnerable to SQL injection within the check_admin.php file. An unauthenticated attacker can execute malicious SQL commands by manipulating the Username parameter during a POST request to the administrative login endpoint.

Business Impact

Successful exploitation of this vulnerability permits unauthorized access to the backend database, potentially leading to the theft of sensitive user data or administrative credentials. Given the CVSS score of 7.3, this represents a high-risk security flaw that could result in significant data exfiltration and compromise the integrity of the membership management platform.

Remediation Plan

Immediate Action: As no official patch is currently available, administrators should restrict network access to the /intern/admin/ directory, specifically the check_admin.php file, to trusted IP addresses only.

Proactive Monitoring: Security teams should audit web server logs for suspicious POST requests containing SQL syntax or unusual characters within the username field, particularly targeting the /intern/admin/check_admin.php endpoint.

Compensating Controls: Deploy a Web Application Firewall (WAF) with strict SQL injection protection rules to inspect and block malicious traffic targeting the vulnerable login parameter before it reaches the application.

Exploitation Status

Public Exploit Available: Yes, a published proof-of-concept exists as documented in the linked researcher write-up on GitHub.

Analyst Notes: As of January 9, 2026, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The vulnerability is highly accessible as it does not require authentication to trigger.

Analyst Recommendation

Given the availability of a public proof-of-concept and the ease of exploitation, this vulnerability poses a significant risk to affected systems. Organizations utilizing this software should prioritize network-level restrictions and WAF filtering immediately, while monitoring for vendor updates to address the underlying code flaw.

Description Summary:
The code-projects Online Music Site 1.0 contains an unauthenticated SQL injection vulnerability in the AdminViewSongs.php file, allowing remote attackers to extract sensitive data.

Executive Summary:
A critical unauthenticated SQL injection vulnerability exists in code-projects Online Music Site 1.0, posing a significant risk of unauthorized database access and data exfiltration.

Vulnerability Details

CVE-ID: CVE-2026-0607

Affected Software: code-projects Online Music Site

Affected Versions: 1.0

Vulnerability: The application is vulnerable to SQL injection within the Administrator/PHP/AdminViewSongs.php file due to improper validation of the id parameter. This vulnerability is reachable by an unauthenticated attacker, allowing for the manipulation of database queries.

Business Impact

Successful exploitation of this vulnerability enables attackers to bypass security controls and access the underlying database, potentially leading to the theft of administrative credentials or sensitive user information. Given the CVSS score of 7.3, this flaw presents a high risk to the confidentiality and integrity of the application, which could result in significant reputational damage and data compromise.

Remediation Plan

Immediate Action: As there is currently no official vendor patch available, administrators should restrict network access to the administrative directory and consider disabling the vulnerable component until a fix is released.

Proactive Monitoring: Security teams should review web server access logs for anomalous GET requests targeting AdminViewSongs.php, specifically looking for SQL syntax patterns in the id parameter.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to detect and block common SQL injection payloads targeting the application URL structure.

Exploitation Status

Public Exploit Available: Yes, a published proof-of-concept exists, as documented in the linked research write-up on GitHub.

Analyst Notes: As of January 7, 2026, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The vulnerability is inherently easy to exploit due to the lack of input sanitization on a public-facing parameter.

Analyst Recommendation

The presence of a publicly available proof-of-concept, combined with the lack of authentication required to trigger the flaw, necessitates immediate defensive action. Organizations utilizing this software must implement strict access controls and WAF filtering to mitigate the risk of exploitation until an official security update is provided by the vendor.

Description Summary:
A SQL injection vulnerability in the FrontEnd/Albums.php file of code-projects Online Music Site 1.0 allows remote, unauthenticated attackers to manipulate the ID argument to access sensitive data.

Executive Summary:
An unauthenticated SQL injection vulnerability in code-projects Online Music Site 1.0 poses a significant risk of unauthorized data exposure and database manipulation.

Vulnerability Details

CVE-ID: CVE-2026-0606

Affected Software: code-projects Online Music Site

Affected Versions: 1.0

Vulnerability: The application fails to sanitize the ID parameter within the /FrontEnd/Albums.php script, which allows an unauthenticated attacker to inject malicious SQL commands directly into the database query.

Business Impact

Successful exploitation of this SQL injection vulnerability can result in the unauthorized extraction of sensitive information from the underlying database, potentially including user credentials or private music data. Given the CVSS score of 7.3, this flaw represents a significant risk to data confidentiality and integrity, which could lead to severe reputational damage and regulatory non-compliance.

Remediation Plan

Immediate Action: As no official patch is currently available, administrators should restrict public access to the affected application or disable the vulnerable FrontEnd/Albums.php script.

Proactive Monitoring: Review database access logs for anomalous query patterns, such as unexpected SQL syntax or high volumes of unexpected character sets, which may indicate exploitation attempts.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to detect and block common SQL injection payloads targeting the application's input parameters.

Exploitation Status

Public Exploit Available: Yes, a published proof-of-concept exists and is documented in the technical write-up referenced by the CVE record.

Analyst Notes: As of January 7, 2026, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The vulnerability is highly accessible due to the lack of required authentication.

Analyst Recommendation

The presence of a public proof-of-concept, combined with the ease of exploitation for unauthenticated users, necessitates immediate defensive action. Organizations currently running Online Music Site 1.0 should treat this vulnerability as a high priority and implement the suggested compensating controls until a vendor-supplied security update is released and applied.

Description Summary:
A SQL injection vulnerability exists in the login.php file of code-projects Online Music Site 1.0, allowing unauthenticated remote attackers to manipulate username and password parameters.

Executive Summary:
An unauthenticated SQL injection vulnerability in code-projects Online Music Site 1.0 poses a significant risk of unauthorized data access and potential account compromise.