Campcodes vulnerabilities
Published CVEs affecting Campcodes products: 87 record(s), with severity, exploitation and fixes.
Supplier Management System 13Online Learning Management System 11Retro Basketball Shoes Online Store 10School Fees Payment Management System 8Online Beauty Parlor Management System 6Online Apartment Visitor Management System 6Computer Sales And Inventory System 5Advanced Online Voting Management System 5Complete Online Beauty Parlor Management System 5Advanced Online Voting System 5School File Management System 4Online Student Enrollment System 2Division Regional Athletic Meet Game Result Matrix System 2Online Polling System 2Park Ticketing System 1Online Hospital Management System 1Farm Management System 1Advanced Online Examination System 1Advanced Voting Management System 1Point Of Sale System 1Gym Management System 1Society Membership Information System 1Complete POS Management and Inventory System 1Complete Online Learning Management System 1School File Management 1Point of Sale System POS 1
CVE-2026-5561
Medium · 6.3
CWE-74 Apr 5, 2026
Campcodes Complete POS Management and Inventory System Environment Variable SettingsController.php injection
A vulnerability was determined in Campcodes Complete POS Management and Inventory System up to 4.0.6. This affects an unknown function of the file app/Http/Controllers/SettingsController.php of the component Environment Variable Handler. Executing a manipulation can lead to injection. It is possible to launch the attack remotely. The exploit has been publicly disclosed and may be utilized.
CVE-2026-5546
Medium · 6.3
CWE-284 Apr 5, 2026
Campcodes Complete Online Learning Management System Crud_model.php add_lesson unrestricted upload
A flaw has been found in Campcodes Complete Online Learning Management System 1.0. This impacts the function add_lesson of the file /application/models/Crud_model.php. This manipulation causes unrestricted upload. It is possible to initiate the attack remotely. The exploit has been published and may be used.
CVE-2026-3984
Low · 3.5
CWE-79 Mar 12, 2026
Campcodes Division Regional Athletic Meet Game Result Matrix System save_up_athlete.php cross site scripting
A weakness has been identified in Campcodes Division Regional Athletic Meet Game Result Matrix System 2.1. This vulnerability affects unknown code of the file save_up_athlete.php. This manipulation of the argument a_name causes cross site scripting. It is possible to initiate the attack remotely. The exploit has been made available to the public and could be used for attacks.
CVE-2026-3983
Low · 3.5
CWE-79 Mar 12, 2026
Campcodes Division Regional Athletic Meet Game Result Matrix System save-games.php cross site scripting
A security flaw has been discovered in Campcodes Division Regional Athletic Meet Game Result Matrix System 2.1. This affects an unknown part of the file save-games.php. The manipulation of the argument game_name results in cross site scripting. The attack may be performed from remote. The exploit has been released to the public and may be used for attacks.
CVE-2026-0597
Critical · 9.8
CWE-89 Jan 5, 2026
Campcodes Supplier Management System edit_profile.php sql injection
A flaw has been found in Campcodes Supplier Management System 1.0. Affected by this issue is some unknown functionality of the file /retailer/edit_profile.php. This manipulation of the argument txtRetailerAddress causes sql injection. Remote exploitation of the attack is possible. The exploit has been published and may be used.
CVE-2025-15404
High · 8.8
CWE-434 Jan 1, 2026
campcodes School File Management System save_file.php unrestricted upload
A security vulnerability has been detected in campcodes School File Management System 1.0. The affected element is an unknown function of the file /save_file.php. The manipulation of the argument File leads to unrestricted upload. The attack may be initiated remotely. The exploit has been disclosed publicly and may be used.
CVE-2025-15214
Medium · 4.8
CWE-79 Dec 29, 2025
Campcodes Park Ticketing System admin_class.php save_pricing cross site scripting
A vulnerability was found in Campcodes Park Ticketing System 1.0. The impacted element is the function save_pricing of the file admin_class.php. The manipulation of the argument name/ride results in cross site scripting. The attack may be performed from remote. The exploit has been made public and could be used.
CVE-2025-15207
Critical · 9.8
CWE-74 Dec 29, 2025
Campcodes Supplier Management System view_products.php sql injection
A vulnerability has been found in Campcodes Supplier Management System 1.0. Affected is an unknown function of the file /admin/view_products.php. The manipulation of the argument chkId[] leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.
CVE-2025-15206
Critical · 9.8
CWE-74 Dec 29, 2025
Campcodes Supplier Management System add_area.php sql injection
A flaw has been found in Campcodes Supplier Management System 1.0. This impacts an unknown function of the file /admin/add_area.php. Executing a manipulation of the argument txtAreaCode can lead to sql injection. The attack may be performed from remote. The exploit has been published and may be used.
CVE-2025-15188
Medium · 4.8
CWE-79 Dec 29, 2025
Campcodes Complete Online Beauty Parlor Management System search-invoices.php cross site scripting
A vulnerability was determined in Campcodes Complete Online Beauty Parlor Management System 1.0. This vulnerability affects unknown code of the file /admin/search-invoices.php. Executing a manipulation of the argument searchdata can lead to cross site scripting. The attack can be launched remotely. The exploit has been publicly disclosed and may be utilized.
CVE-2025-14991
Medium · 4.8
CWE-79 Dec 21, 2025
Campcodes Complete Online Beauty Parlor Management System bwdates-reports-details.php cross site scripting
A weakness has been identified in Campcodes Complete Online Beauty Parlor Management System 1.0. The affected element is an unknown function of the file /admin/bwdates-reports-details.php. Executing a manipulation of the argument fromdate can lead to cross site scripting. The attack may be launched remotely. The exploit has been made available to the public and could be used for attacks.
CVE-2025-14990
Critical · 9.8
CWE-74 Dec 21, 2025
Campcodes Complete Online Beauty Parlor Management System view-appointment.php sql injection
A security flaw has been discovered in Campcodes Complete Online Beauty Parlor Management System 1.0. Impacted is an unknown function of the file /admin/view-appointment.php. Performing a manipulation of the argument viewid results in sql injection. The attack may be initiated remotely. The exploit has been released to the public and may be used for attacks.
CVE-2025-14989
Critical · 9.8
CWE-74 Dec 20, 2025
Campcodes Complete Online Beauty Parlor Management System search-invoices.php sql injection
A vulnerability was identified in Campcodes Complete Online Beauty Parlor Management System 1.0. This issue affects some unknown processing of the file /admin/search-invoices.php. Such manipulation leads to sql injection. The attack can be launched remotely. The exploit is publicly available and might be used.
CVE-2025-14952
Critical · 9.8
CWE-74 Dec 19, 2025
Campcodes Supplier Management System add_category.php sql injection
A vulnerability was detected in Campcodes Supplier Management System 1.0. This affects an unknown function of the file /admin/add_category.php. Performing a manipulation of the argument txtCategoryName results in sql injection. The attack is possible to be carried out remotely. The exploit is now public and may be used.
CVE-2025-14889
Medium · 6.3
CWE-266 Dec 18, 2025
Campcodes Advanced Voting Management System Password voters_edit.php improper authorization
A security flaw has been discovered in Campcodes Advanced Voting Management System 1.0. The impacted element is an unknown function of the file /admin/voters_edit.php of the component Password Handler. Performing a manipulation of the argument ID results in improper authorization. The attack is possible to be carried out remotely. The exploit has been released to the public and may be used for attacks.
CVE-2025-14877
Critical · 9.8
CWE-74 Dec 18, 2025
Campcodes Supplier Management System add_retailer.php sql injection
A vulnerability was identified in Campcodes Supplier Management System 1.0. This affects an unknown function of the file /admin/add_retailer.php. The manipulation of the argument cmbAreaCode leads to sql injection. The attack is possible to be carried out remotely. The exploit is publicly available and might be used.
CVE-2025-14668
Critical · 9.8
CWE-89 Dec 14, 2025
campcodes Advanced Online Examination System loginExe.php sql injection
A vulnerability was detected in campcodes Advanced Online Examination System 1.0. This affects an unknown function of the file /query/loginExe.php. Performing a manipulation of the argument Username results in sql injection. It is possible to initiate the attack remotely. The exploit is now public and may be used.
CVE-2025-14664
Critical · 9.8
CWE-89 Dec 14, 2025
Campcodes Supplier Management System view_unit.php sql injection
A vulnerability was identified in Campcodes Supplier Management System 1.0. This issue affects some unknown processing of the file /admin/view_unit.php. The manipulation of the argument chkId[] leads to sql injection. Remote exploitation of the attack is possible. The exploit is publicly available and might be used.
CVE-2025-14583
Critical · 9.8
CWE-434 Dec 12, 2025
campcodes Online Student Enrollment System register.php unrestricted upload
A flaw has been found in campcodes Online Student Enrollment System 1.0. This impacts an unknown function of the file /admin/register.php. Executing a manipulation of the argument photo can lead to unrestricted upload. The attack can be launched remotely. The exploit has been published and may be used.
CVE-2025-14582
High · 7.2
CWE-434 Dec 12, 2025
campcodes Online Student Enrollment System index.php unrestricted upload
A vulnerability was detected in campcodes Online Student Enrollment System 1.0. This affects an unknown function of the file /admin/index.php?page=user-profile. Performing a manipulation of the argument userphoto results in unrestricted upload. The attack can be initiated remotely. The exploit is now public and may be used.
CVE-2025-14529
Critical · 9.8
CWE-89 Dec 11, 2025
Campcodes Retro Basketball Shoes Online Store admin_running.php sql injection
A flaw has been found in Campcodes Retro Basketball Shoes Online Store 1.0. The affected element is an unknown function of the file /admin/admin_running.php. This manipulation of the argument pid causes sql injection. It is possible to initiate the attack remotely. The exploit has been published and may be used.
CVE-2025-14515
Critical · 9.8
CWE-89 Dec 11, 2025
Campcodes Supplier Management System add_unit.php sql injection
A vulnerability has been found in Campcodes Supplier Management System 1.0. Affected by this vulnerability is an unknown functionality of the file /admin/add_unit.php. Such manipulation of the argument txtunitDetails leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used.
CVE-2025-14514
Critical · 9.8
CWE-89 Dec 11, 2025
Campcodes Supplier Management System add_distributor.php sql injection
A flaw has been found in Campcodes Supplier Management System 1.0. Affected is an unknown function of the file /admin/add_distributor.php. This manipulation of the argument txtDistributorAddress causes sql injection. The attack can be initiated remotely. The exploit has been published and may be used.
CVE-2025-14219
High · 7.2
CWE-284 Dec 8, 2025
Campcodes Retro Basketball Shoes Online Store admin_running.php unrestricted upload
A weakness has been identified in Campcodes Retro Basketball Shoes Online Store 1.0. The impacted element is an unknown function of the file /admin/admin_running.php. Executing a manipulation of the argument product_image can lead to unrestricted upload. It is possible to launch the attack remotely. The exploit has been made available to the public and could be used for attacks.
CVE-2025-14209
Critical · 9.8
CWE-89 Dec 7, 2025
Campcodes School File Management System update_query.php sql injection
A weakness has been identified in Campcodes School File Management System 1.0. This impacts an unknown function of the file /update_query.php. This manipulation of the argument stud_id causes sql injection. The attack can be initiated remotely. The exploit has been made available to the public and could be used for attacks.