Code-projects vulnerabilities
Published CVEs affecting Code-projects products: 558 record(s), with severity, exploitation and fixes.
Online Music Site 23Simple Laundry System 21Employee Management System 17Simple Food Ordering System 16Online Reviewer System 15E-Commerce Website 13Online Product Reservation System 13Student File Management System 13Vehicle Showroom Management System 12Refugee Food Management System 12Assessment Management 10Simple IT Discussion Forum 10Online Shopping System 10Simple Flight Ticket Booking System 10Real State Services 9Exam Form Submission 8Intern Membership Management System 8Student Information System 8Invoice System in Laravel 7Client Details System 7Content Management System 6Online Food Ordering System 6Online Hospital Management System 6Accounting System 6Simple Stock System 6Nero Social Networking Site 6Responsive Hotel Site 6Online Event Judging System 6Simple Scheduling System 6Hospital Information System 6Task Management System 6Hotel and Tourism Reservation 6Employee Profile Management System 5Online Examination System 5Courier Management System 5Online Complaint Site 5Online Job Portal 5Patient Record Management System 4Student Membership System 4Easy Blog Site 4
CVE-2026-5255
Medium · 6.1
CWE-79 Apr 1, 2026
code-projects Simple Laundry System Parameter delstaffinfo.php cross site scripting
A vulnerability was detected in code-projects Simple Laundry System 1.0. This affects an unknown part of the file /delstaffinfo.php of the component Parameter Handler. The manipulation of the argument userid results in cross site scripting. The attack may be launched remotely. The exploit is now public and may be used.
CVE-2026-5240
Medium · 4.3
CWE-79 Mar 31, 2026
code-projects BloodBank Managing System admin_state.php cross site scripting
A security vulnerability has been detected in code-projects BloodBank Managing System 1.0. This affects an unknown part of the file /admin_state.php. The manipulation of the argument statename leads to cross site scripting. It is possible to initiate the attack remotely. The exploit has been disclosed publicly and may be used.
CVE-2026-5206
Medium · 6.3
CWE-74 Mar 31, 2026
code-projects Simple Gym Management System Payment sql injection
A security vulnerability has been detected in code-projects Simple Gym Management System 1.0. This vulnerability affects unknown code of the component Payment Handler. The manipulation of the argument Payment_id/Amount/customer_id/payment_type/customer_name leads to sql injection. Remote exploitation of the attack is possible. The exploit has been disclosed publicly and may be used.
CVE-2026-5198
High · 7.3
CWE-74 Mar 31, 2026
code-projects Student Membership System Admin Login index.php sql injection
A vulnerability was determined in code-projects Student Membership System 1.0. The impacted element is an unknown function of the file /admin/index.php of the component Admin Login. This manipulation of the argument username/password causes sql injection. Remote exploitation of the attack is possible. The exploit has been publicly disclosed and may be utilized.
CVE-2026-5197
Medium · 6.3
CWE-74 Mar 31, 2026
code-projects Student Membership System delete_user.php sql injection
A vulnerability was found in code-projects Student Membership System 1.0. The affected element is an unknown function of the file /delete_user.php. The manipulation of the argument ID results in sql injection. The attack may be launched remotely. The exploit has been made public and could be used.
CVE-2026-5196
Medium · 6.3
CWE-74 Mar 31, 2026
code-projects Student Membership System delete_member.php sql injection
A vulnerability has been found in code-projects Student Membership System 1.0. Impacted is an unknown function of the file /delete_member.php. The manipulation of the argument ID leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used.
CVE-2026-5195
High · 7.3
CWE-74 Mar 31, 2026
code-projects Student Membership System User Registration sql injection
A flaw has been found in code-projects Student Membership System 1.0. This issue affects some unknown processing of the component User Registration Handler. Executing a manipulation can lead to sql injection. The attack can be launched remotely.
CVE-2026-5157
Medium · 4.3
CWE-79 Mar 30, 2026
code-projects Online Food Ordering System Order order.php cross site scripting
A vulnerability was identified in code-projects Online Food Ordering System 1.0. Affected is an unknown function of the file /form/order.php of the component Order Module. Such manipulation of the argument cust_id leads to cross site scripting. The attack may be performed from remote. The exploit is publicly available and might be used.
CVE-2026-5150
High · 7.3
CWE-74 Mar 30, 2026
code-projects Accounting System Parameter viewin_costumer.php sql injection
A security vulnerability has been detected in code-projects Accounting System 1.0. This issue affects some unknown processing of the file /viewin_costumer.php of the component Parameter Handler. Such manipulation of the argument cos_id leads to sql injection. The attack can be launched remotely. The exploit has been disclosed publicly and may be used.
CVE-2026-5106
Medium · 4.8
CWE-79 Mar 30, 2026
code-projects Exam Form Submission update_fst.php cross site scripting
A flaw has been found in code-projects Exam Form Submission 1.0. The impacted element is an unknown function of the file /admin/update_fst.php. Executing a manipulation of the argument sname can lead to cross site scripting. It is possible to launch the attack remotely. The exploit has been published and may be used.
CVE-2026-5041
Medium · 4.7
CWE-74 Mar 29, 2026
code-projects Chamber of Commerce Membership Management System pageMail.php fwrite command injection
A vulnerability was identified in code-projects Chamber of Commerce Membership Management System 1.0. Impacted is the function fwrite of the file admin/pageMail.php. The manipulation of the argument mailSubject/mailMessage leads to command injection. The attack may be initiated remotely. The exploit is publicly available and might be used.
CVE-2026-5035
Critical · 9.8
CWE-89 Mar 29, 2026
code-projects Accounting System Parameter view_work.php sql injection
A vulnerability has been found in code-projects Accounting System 1.0. This affects an unknown part of the file /view_work.php of the component Parameter Handler. Such manipulation of the argument en_id leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.
CVE-2026-5034
Critical · 9.8
CWE-89 Mar 29, 2026
code-projects Accounting System Parameter edit_costumer.php sql injection
A flaw has been found in code-projects Accounting System 1.0. Affected by this issue is some unknown functionality of the file /edit_costumer.php of the component Parameter Handler. This manipulation of the argument cos_id causes sql injection. It is possible to initiate the attack remotely. The exploit has been published and may be used.
CVE-2026-5033
Critical · 9.8
CWE-89 Mar 29, 2026
code-projects Accounting System Parameter view_costumer.php sql injection
A vulnerability was detected in code-projects Accounting System 1.0. Affected by this vulnerability is an unknown functionality of the file /view_costumer.php of the component Parameter Handler. The manipulation of the argument cos_id results in sql injection. The attack may be performed from remote. The exploit is now public and may be used.
CVE-2026-5019
Critical · 9.8
CWE-74 Mar 28, 2026
code-projects Simple Food Order System Parameter all-orders.php sql injection
A security vulnerability has been detected in code-projects Simple Food Order System 1.0. Affected by this vulnerability is an unknown functionality of the file all-orders.php of the component Parameter Handler. The manipulation of the argument Status leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed publicly and may be used.
CVE-2026-5018
Critical · 9.8
CWE-74 Mar 28, 2026
code-projects Simple Food Order System Parameter register-router.php sql injection
A weakness has been identified in code-projects Simple Food Order System 1.0. Affected is an unknown function of the file register-router.php of the component Parameter Handler. Executing a manipulation of the argument Name can lead to sql injection. The attack can be launched remotely. The exploit has been made available to the public and could be used for attacks.
CVE-2026-5017
Critical · 9.8
CWE-74 Mar 28, 2026
code-projects Simple Food Order System Parameter all-tickets.php sql injection
A security flaw has been discovered in code-projects Simple Food Order System 1.0. This impacts an unknown function of the file /all-tickets.php of the component Parameter Handler. Performing a manipulation of the argument Status results in sql injection. The attack can be initiated remotely. The exploit has been released to the public and may be used for attacks.
CVE-2026-4972
Low · 2.4
CWE-79 Mar 27, 2026
code-projects Online Reviewer System btn_functions.php cross site scripting
A security vulnerability has been detected in code-projects Online Reviewer System up to 1.0. Affected is an unknown function of the file /system/system/students/assessments/databank/btn_functions.php. Such manipulation of the argument Description leads to cross site scripting. The attack may be performed from remote. The exploit has been disclosed publicly and may be used.
CVE-2026-4970
Medium · 6.3
CWE-74 Mar 27, 2026
code-projects Social Networking Site Endpoint delete_photos.php sql injection
A security flaw has been discovered in code-projects Social Networking Site 1.0. This affects an unknown function of the file delete_photos.php of the component Endpoint. The manipulation of the argument ID results in sql injection. The attack can be executed remotely. The exploit has been released to the public and may be used for attacks.
CVE-2026-4969
Low · 3.5
CWE-79 Mar 27, 2026
code-projects Social Networking Site Alert home.php cross site scripting
A vulnerability was identified in code-projects Social Networking Site 1.0. The impacted element is an unknown function of the file /home.php of the component Alert Handler. The manipulation of the argument content leads to cross site scripting. Remote exploitation of the attack is possible. The exploit is publicly available and might be used.
CVE-2026-4909
Low · 2.4
CWE-79 Mar 27, 2026
code-projects Exam Form Submission update_s7.php cross site scripting
A weakness has been identified in code-projects Exam Form Submission 1.0. This impacts an unknown function of the file /admin/update_s7.php. This manipulation of the argument sname causes cross site scripting. It is possible to initiate the attack remotely. The exploit has been made available to the public and could be used for attacks.
CVE-2026-4908
Critical · 9.8
CWE-74 Mar 27, 2026
code-projects Simple Laundry System Parameter modstaffinfo.php sql injection
A security flaw has been discovered in code-projects Simple Laundry System 1.0. This affects an unknown function of the file /modstaffinfo.php of the component Parameter Handler. The manipulation of the argument userid results in sql injection. The attack may be performed from remote. The exploit has been released to the public and may be used for attacks.
CVE-2026-4900
Medium · 5.3
CWE-425 Mar 26, 2026
code-projects Online Food Ordering System localhost.sql privilege escalation
A weakness has been identified in code-projects Online Food Ordering System 1.0. This affects an unknown part of the file /dbfood/localhost.sql. This manipulation causes files or directories accessible. The attack can be initiated remotely. The exploit has been made available to the public and could be used for attacks. It is advisable to modify the configuration settings.
CVE-2026-4899
Low · 2.4
CWE-79 Mar 26, 2026
code-projects Online Food Ordering System food.php cross site scripting
A security flaw has been discovered in code-projects Online Food Ordering System 1.0. Affected by this issue is some unknown functionality of the file /dbfood/food.php. The manipulation of the argument cuisines results in cross site scripting. It is possible to launch the attack remotely. The exploit has been released to the public and may be used for attacks.
CVE-2026-4898
Medium · 4.3
CWE-79 Mar 26, 2026
code-projects Online Food Ordering System contact.php cross site scripting
A vulnerability was identified in code-projects Online Food Ordering System 1.0. Affected by this vulnerability is an unknown functionality of the file /dbfood/contact.php. The manipulation of the argument Name leads to cross site scripting. It is possible to initiate the attack remotely. The exploit is publicly available and might be used.