Code-projects vulnerabilities

Published CVEs affecting Code-projects products: 561 record(s), with severity, exploitation and fixes.

Online Music Site 23 Simple Laundry System 21 Employee Management System 17 Simple Food Ordering System 16 Online Reviewer System 15 E-Commerce Website 13 Online Product Reservation System 13 Student File Management System 13 Vehicle Showroom Management System 12 Refugee Food Management System 12 Assessment Management 10 Simple IT Discussion Forum 10 Online Shopping System 10 Simple Flight Ticket Booking System 10 Real State Services 9 Exam Form Submission 8 Intern Membership Management System 8 Student Information System 8 Invoice System in Laravel 7 Client Details System 7 Task Management System 7 Content Management System 6 Online Food Ordering System 6 Online Hospital Management System 6 Accounting System 6 Simple Stock System 6 Nero Social Networking Site 6 Responsive Hotel Site 6 Online Event Judging System 6 Simple Scheduling System 6 Hospital Information System 6 Hotel and Tourism Reservation 6 Employee Profile Management System 5 Online Examination System 5 Courier Management System 5 Online Complaint Site 5 Internship Management System 5 Online Job Portal 5 Patient Record Management System 4 Student Membership System 4

Exploited only (KEV) →

CVE-2026-2176 High · 8.8 CWE-89 Feb 8, 2026

code-projects Contact Management System index.py sql injection

A security vulnerability has been detected in code-projects Contact Management System 1.0. This issue affects some unknown processing of the file index.py. Such manipulation of the argument selecteditem[0] leads to sql injection. The attack can be executed remotely.

CVE-2026-2174 Critical · 9.8 CWE-287 Feb 8, 2026

code-projects Contact Management System 1.0 Improper Authentication in CRUD Endpoint

A security flaw has been discovered in code-projects Contact Management System 1.0. This affects an unknown part of the component CRUD Endpoint. The manipulation of the argument ID results in improper authentication. The attack may be launched remotely.

CVE-2026-2173 Critical · 9.8 CWE-89 Feb 8, 2026

Code-projects Online Examination System 1.0 SQL Injection in login.php

A vulnerability was identified in code-projects Online Examination System 1.0. Affected by this issue is some unknown functionality of the file login.php. The manipulation of the argument username/password leads to sql injection. The attack may be initiated remotely.

CVE-2026-2172 Critical · 9.8 CWE-89 Feb 8, 2026

code-projects Online Application System for Admission SQL Injection (CVE-2026-2172)

A vulnerability was determined in code-projects Online Application System for Admission 1.0. Affected by this vulnerability is an unknown functionality of the file enrollment/index.php of the component Login Endpoint. Executing a manipulation can lead to sql injection. The attack can be launched remotely. The exploit has been publicly disclosed and may be utilized.

CVE-2026-2171 Critical · 9.8 CWE-74 Feb 8, 2026

SQL Injection in Login of code-projects Online Student Management System 1.0

A vulnerability was found in code-projects Online Student Management System 1.0. Affected is an unknown function of the file accounts.php of the component Login. Performing a manipulation of the argument username/password results in sql injection. The attack can be initiated remotely. The exploit has been made public and could be used.

CVE-2026-2166 Critical · 9.8 CWE-89 Feb 8, 2026

code-projects Online Reviewer System 1.0 - SQL Injection in Login

A security vulnerability has been detected in code-projects Online Reviewer System 1.0. The affected element is an unknown function of the file /login/index.php of the component Login. The manipulation of the argument username/password leads to sql injection. The attack is possible to be carried out remotely. The exploit has been disclosed publicly and may be used.

CVE-2026-2158 Critical · 9.8 CWE-89 Feb 8, 2026

SQL Injection in Student Web Portal 1.0 via /check_user.php

A vulnerability was detected in code-projects Student Web Portal 1.0. This impacts an unknown function of the file /check_user.php. Performing a manipulation of the argument Username results in sql injection. It is possible to initiate the attack remotely.

CVE-2026-2156 Medium · 4.8 CWE-79 Feb 8, 2026

code-projects Online Student Management System Announcement Management index.php cross site scripting

A weakness has been identified in code-projects Online Student Management System 1.0. The impacted element is an unknown function of the file /admin/announcement/index.php?view=add of the component Announcement Management Module. This manipulation causes cross site scripting. The attack is possible to be carried out remotely. The exploit has been made available to the public and could be used for attacks.

CVE-2026-2133 Critical · 9.8 CWE-284 Feb 8, 2026

code-projects Online Music Site 1.0 Unrestricted File Upload via AdminUpdateCategory.php

A weakness has been identified in code-projects Online Music Site 1.0. Impacted is an unknown function of the file /Administrator/PHP/AdminUpdateCategory.php. This manipulation of the argument txtimage causes unrestricted upload. The attack is possible to be carried out remotely. The exploit has been made available to the public and could be used for attacks.

CVE-2026-2132 Critical · 9.8 CWE-89 Feb 8, 2026

SQL Injection in code-projects Online Music Site 1.0 (CVE-2026-2132)

A security flaw has been discovered in code-projects Online Music Site 1.0. This issue affects some unknown processing of the file /Administrator/PHP/AdminUpdateCategory.php. The manipulation of the argument txtcat results in sql injection. The attack can be executed remotely. The exploit has been released to the public and may be used for attacks.

CVE-2026-2083 Critical · 9.8 CWE-89 Feb 7, 2026

code-projects Social Networking Site 1.0 SQL Injection in delete_post.php

A security flaw has been discovered in code-projects Social Networking Site 1.0. This affects an unknown function of the file /delete_post.php. Performing a manipulation of the argument ID results in sql injection. It is possible to initiate the attack remotely. The exploit has been released to the public and may be used for attacks.

CVE-2026-2060 Critical · 9.8 CWE-89 Feb 6, 2026

Simple Blood Donor Management System 1.0 SQL Injection (CVE-2026-2060)

A vulnerability was found in code-projects Simple Blood Donor Management System 1.0. Affected by this vulnerability is an unknown functionality of the file /simpleblooddonor/editcampaignform.php. Performing a manipulation of the argument ID results in sql injection. It is possible to initiate the attack remotely. The exploit has been made public and could be used.

CVE-2026-1535 Critical · 9.8 CWE-74 Jan 28, 2026

code-projects Online Music Site SQL Injection in AdminReply.php

A security vulnerability has been detected in code-projects Online Music Site 1.0. This impacts an unknown function of the file /Administrator/PHP/AdminReply.php. Such manipulation of the argument ID leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed publicly and may be used.

CVE-2026-1534 Critical · 9.8 CWE-74 Jan 28, 2026

Online Music Site 1.0 SQL Injection in AdminEditUser.php

A weakness has been identified in code-projects Online Music Site 1.0. This affects an unknown function of the file /Administrator/PHP/AdminEditUser.php. This manipulation of the argument ID causes sql injection. It is possible to initiate the attack remotely. The exploit has been made available to the public and could be used for attacks.

CVE-2026-1533 Critical · 9.8 CWE-89 Jan 28, 2026

code-projects Online Music Site 1.0 - SQL Injection in AdminAddCategory.php

A security flaw has been discovered in code-projects Online Music Site 1.0. The impacted element is an unknown function of the file /Administrator/PHP/AdminAddCategory.php. The manipulation results in sql injection. The attack may be performed from remote. The exploit has been released to the public and may be used for attacks.

CVE-2026-1443 Critical · 9.8 CWE-89 Jan 26, 2026

code-projects Online Music Site AdminDeleteUser.php sql injection

A flaw has been found in code-projects Online Music Site 1.0. Affected by this issue is some unknown functionality of the file /Administrator/PHP/AdminDeleteUser.php. This manipulation of the argument ID causes sql injection. The attack can be initiated remotely. The exploit has been published and may be used.

CVE-2026-1423 Critical · 9.8 CWE-284 Jan 26, 2026

code-projects Online Examination System admin_pic.php unrestricted upload

A vulnerability was determined in code-projects Online Examination System 1.0. Affected by this issue is some unknown functionality of the file /admin_pic.php. Executing a manipulation can lead to unrestricted upload. The attack may be performed from remote. The exploit has been publicly disclosed and may be utilized.

CVE-2026-1422 Critical · 9.8 CWE-89 Jan 26, 2026

code-projects Online Examination System Login Page index.php sql injection

A vulnerability was found in code-projects Online Examination System 1.0. Affected by this vulnerability is an unknown functionality of the file /index.php of the component Login Page. Performing a manipulation of the argument User results in sql injection. The attack is possible to be carried out remotely. The exploit has been made public and could be used.

CVE-2026-1421 Medium · 5.4 CWE-79 Jan 26, 2026

code-projects Online Examination System Add Pages cross site scripting

A vulnerability has been found in code-projects Online Examination System 1.0. Affected is an unknown function of the component Add Pages. Such manipulation leads to cross site scripting. The attack can be executed remotely. The exploit has been disclosed to the public and may be used.

CVE-2026-0852 Critical · 9.8 CWE-74 Jan 11, 2026

code-projects Online Music Site AdminUpdateUser.php sql injection

A security flaw has been discovered in code-projects Online Music Site 1.0. The impacted element is an unknown function of the file /Administrator/PHP/AdminUpdateUser.php. The manipulation of the argument ID results in sql injection. The attack can be executed remotely. The exploit has been released to the public and may be used for attacks.

CVE-2026-0851 Critical · 9.8 CWE-74 Jan 11, 2026

code-projects Online Music Site AdminAddUser.php sql injection

A vulnerability was identified in code-projects Online Music Site 1.0. The affected element is an unknown function of the file /Administrator/PHP/AdminAddUser.php. The manipulation of the argument txtusername leads to sql injection. Remote exploitation of the attack is possible. The exploit is publicly available and might be used.

CVE-2026-0850 High · 7.2 CWE-74 Jan 11, 2026

code-projects Intern Membership Management System delete_activity.php sql injection

A vulnerability was determined in code-projects Intern Membership Management System 1.0. Impacted is an unknown function of the file /admin/delete_activity.php. Executing a manipulation of the argument activity_id can lead to sql injection. The attack may be launched remotely. The exploit has been publicly disclosed and may be utilized.

CVE-2026-0729 High · 7.2 CWE-89 Jan 8, 2026

code-projects Intern Membership Management System add_activity.php sql injection

A vulnerability was detected in code-projects Intern Membership Management System 1.0. Impacted is an unknown function of the file /intern/admin/add_activity.php. Performing a manipulation of the argument Title results in sql injection. Remote exploitation of the attack is possible. The exploit is now public and may be used.

CVE-2026-0728 High · 7.2 CWE-89 Jan 8, 2026

code-projects Intern Membership Management System delete_admin.php sql injection

A security vulnerability has been detected in code-projects Intern Membership Management System 1.0. This issue affects some unknown processing of the file /intern/admin/delete_admin.php. Such manipulation of the argument admin_id leads to sql injection. The attack may be launched remotely. The exploit has been disclosed publicly and may be used.

CVE-2026-0701 High · 7.2 CWE-89 Jan 8, 2026

code-projects Intern Membership Management System add_admin.php sql injection

A vulnerability was identified in code-projects Intern Membership Management System 1.0. Affected by this vulnerability is an unknown functionality of the file /intern/admin/add_admin.php. The manipulation of the argument Username leads to sql injection. The attack is possible to be carried out remotely. The exploit is publicly available and might be used.