Code-projects vulnerabilities

Published CVEs affecting Code-projects products: 561 record(s), with severity, exploitation and fixes.

Online Music Site 23 Simple Laundry System 21 Employee Management System 17 Simple Food Ordering System 16 Online Reviewer System 15 E-Commerce Website 13 Online Product Reservation System 13 Student File Management System 13 Vehicle Showroom Management System 12 Refugee Food Management System 12 Assessment Management 10 Simple IT Discussion Forum 10 Online Shopping System 10 Simple Flight Ticket Booking System 10 Real State Services 9 Exam Form Submission 8 Intern Membership Management System 8 Student Information System 8 Invoice System in Laravel 7 Client Details System 7 Task Management System 7 Content Management System 6 Online Food Ordering System 6 Online Hospital Management System 6 Accounting System 6 Simple Stock System 6 Nero Social Networking Site 6 Responsive Hotel Site 6 Online Event Judging System 6 Simple Scheduling System 6 Hospital Information System 6 Hotel and Tourism Reservation 6 Employee Profile Management System 5 Online Examination System 5 Courier Management System 5 Online Complaint Site 5 Internship Management System 5 Online Job Portal 5 Patient Record Management System 4 Student Membership System 4

Exploited only (KEV) →

CVE-2025-14205 Medium · 5.4 CWE-79 Dec 7, 2025

code-projects Chamber of Commerce Membership Management System Your Info membership_profile.php cross site scripting

A vulnerability was found in code-projects Chamber of Commerce Membership Management System 1.0. Impacted is an unknown function of the file /membership_profile.php of the component Your Info Handler. Performing manipulation of the argument Full Name/Address/City/State results in cross site scripting. The attack is possible to be carried out remotely. The exploit has been made public and could be used.

CVE-2025-14203 High · 8.8 CWE-89 Dec 7, 2025

code-projects Question Paper Generator selectquestionuser.php sql injection

A flaw has been found in code-projects Question Paper Generator up to 1.0. This vulnerability affects unknown code of the file /selectquestionuser.php. This manipulation of the argument subid causes sql injection. Remote exploitation of the attack is possible. The exploit has been published and may be used.

CVE-2025-14195 High · 8.8 CWE-284 Dec 7, 2025

code-projects Employee Profile Management System add_file_query.php unrestricted upload

A security flaw has been discovered in code-projects Employee Profile Management System 1.0. Impacted is an unknown function of the file /profiling/add_file_query.php. The manipulation of the argument per_file results in unrestricted upload. The attack may be launched remotely. The exploit has been released to the public and may be used for attacks.

CVE-2025-14194 Medium · 5.4 CWE-79 Dec 7, 2025

code-projects Employee Profile Management System view_personnel.php cross site scripting

A vulnerability was identified in code-projects Employee Profile Management System 1.0. This issue affects some unknown processing of the file /view_personnel.php. The manipulation of the argument per_address/dr_school/other_school leads to cross site scripting. The attack may be initiated remotely. The exploit is publicly available and might be used.

CVE-2025-14193 High · 8.8 CWE-89 Dec 7, 2025

code-projects Employee Profile Management System view_personnel.php sql injection

A vulnerability was determined in code-projects Employee Profile Management System 1.0. This vulnerability affects unknown code of the file /view_personnel.php. Executing a manipulation of the argument per_id can lead to sql injection. The attack can be launched remotely. The exploit has been publicly disclosed and may be utilized.

CVE-2025-13583 Critical · 9.8 CWE-89 Nov 24, 2025

code-projects Question Paper Generator POST Parameter signupscript.php sql injection

A weakness has been identified in code-projects Question Paper Generator 1.0. This affects an unknown part of the file /signupscript.php of the component POST Parameter Handler. Executing manipulation of the argument Fname can lead to sql injection. The attack can be executed remotely. The exploit has been made available to the public and could be exploited.

CVE-2025-13582 Critical · 9.8 CWE-89 Nov 24, 2025

code-projects Jonnys Liquor GET Parameter detail.php sql injection

A security flaw has been discovered in code-projects Jonnys Liquor 1.0. Affected by this issue is some unknown functionality of the file /detail.php of the component GET Parameter Handler. Performing manipulation of the argument Product results in sql injection. Remote exploitation of the attack is possible. The exploit has been released to the public and may be exploited.

CVE-2025-13580 High · 8.8 CWE-89 Nov 24, 2025

code-projects Library System mail.php sql injection

A vulnerability was determined in code-projects Library System 1.0. Affected is an unknown function of the file /mail.php. This manipulation of the argument ID causes sql injection. The attack may be initiated remotely. The exploit has been publicly disclosed and may be utilized.

CVE-2025-13579 High · 8.8 CWE-89 Nov 24, 2025

code-projects Library System return.php sql injection

A vulnerability was found in code-projects Library System 1.0. This impacts an unknown function of the file /return.php. The manipulation of the argument ID results in sql injection. The attack can be launched remotely. The exploit has been made public and could be used.

CVE-2025-13578 Critical · 9.8 CWE-89 Nov 24, 2025

code-projects Library System Login index.php sql injection

A vulnerability has been found in code-projects Library System 1.0. This affects an unknown function of the file /index.php of the component Login. The manipulation of the argument Username leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.

CVE-2025-13576 High · 8.8 CWE-266 Nov 23, 2025

code-projects Blog Site admin.php improper authorization

A vulnerability was detected in code-projects Blog Site 1.0. The affected element is an unknown function of the file /admin.php. Performing manipulation results in improper authorization. It is possible to initiate the attack remotely. The exploit is now public and may be used. Multiple endpoints are affected.

CVE-2025-13575 High · 8.8 CWE-89 Nov 23, 2025

code-projects Blog Site Category blog.php category_exists sql injection

A security vulnerability has been detected in code-projects Blog Site 1.0. Impacted is the function category_exists of the file /resources/functions/blog.php of the component Category Handler. Such manipulation of the argument name/field leads to sql injection. The attack may be performed from remote. The exploit has been disclosed publicly and may be used. Multiple endpoints are affected.

CVE-2025-13574 High · 7.2 CWE-434 Nov 23, 2025

code-projects Online Bidding System addcategory.php categoryadd unrestricted upload

A weakness has been identified in code-projects Online Bidding System 1.0. This issue affects the function categoryadd of the file /administrator/addcategory.php. This manipulation of the argument catimage causes unrestricted upload. The attack is possible to be carried out remotely. The exploit has been made available to the public and could be exploited.

CVE-2025-13571 High · 8.8 CWE-89 Nov 23, 2025

code-projects Simple Food Ordering System listorder.php sql injection

A vulnerability was determined in code-projects Simple Food Ordering System 1.0. Affected by this issue is some unknown functionality of the file /listorder.php. Executing manipulation of the argument ID can lead to sql injection. The attack may be launched remotely. The exploit has been publicly disclosed and may be utilized.

CVE-2025-13449 Critical · 9.8 CWE-89 Nov 20, 2025

code-projects Online Shop Project login.php sql injection

A vulnerability was found in code-projects Online Shop Project 1.0. This issue affects some unknown processing of the file /login.php. The manipulation of the argument Password results in sql injection. The attack may be performed from remote. The exploit has been made public and could be used.

CVE-2025-13396 Critical · 9.8 CWE-74 Nov 19, 2025

code-projects Courier Management System add-office.php sql injection

A weakness has been identified in code-projects Courier Management System 1.0. This affects an unknown function of the file /add-office.php. This manipulation of the argument OfficeName causes sql injection. The attack may be initiated remotely. The exploit has been made available to the public and could be exploited.

CVE-2025-13323 Critical · 9.8 CWE-89 Nov 17, 2025

code-projects Simple Pizza Ordering System listorder.php sql injection

A security flaw has been discovered in code-projects Simple Pizza Ordering System 1.0. Affected is an unknown function of the file /listorder.php. Performing manipulation of the argument ID results in sql injection. The attack can be initiated remotely. The exploit has been released to the public and may be exploited.

CVE-2025-13303 Critical · 9.8 CWE-89 Nov 17, 2025

code-projects Courier Management System search-edit.php sql injection

A vulnerability was determined in code-projects Courier Management System 1.0. Affected by this issue is some unknown functionality of the file /search-edit.php. This manipulation of the argument Consignment causes sql injection. The attack can be initiated remotely. The exploit has been publicly disclosed and may be utilized.

CVE-2025-13302 Critical · 9.8 CWE-89 Nov 17, 2025

code-projects Courier Management System add-new-officer.php sql injection

A vulnerability was identified in code-projects Courier Management System 1.0. This affects an unknown part of the file /add-new-officer.php. Such manipulation of the argument ManagerName leads to sql injection. The attack can be launched remotely. The exploit is publicly available and might be used.

CVE-2025-13290 High · 8.8 CWE-89 Nov 17, 2025

code-projects Simple Food Ordering System saveorder.php sql injection

A vulnerability has been found in code-projects Simple Food Ordering System 1.0. Affected by this issue is some unknown functionality of the file /saveorder.php. Such manipulation of the argument ID leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.

CVE-2025-13279 High · 8.8 CWE-89 Nov 17, 2025

code-projects Nero Social Networking Site profilefriends.php sql injection

A vulnerability was found in code-projects Nero Social Networking Site 1.0. The affected element is an unknown function of the file /profilefriends.php. Performing manipulation of the argument ID results in sql injection. The attack may be initiated remotely. The exploit has been made public and could be used.

CVE-2025-13277 Critical · 9.8 CWE-89 Nov 17, 2025

code-projects Nero Social Networking Site friendsphoto.php sql injection

A flaw has been found in code-projects Nero Social Networking Site 1.0. This issue affects some unknown processing of the file /friendsphoto.php. This manipulation of the argument ID causes sql injection. The attack can be initiated remotely. The exploit has been published and may be used.

CVE-2025-13245 Medium · 5.4 CWE-79 Nov 16, 2025

code-projects Student Information System editprofile.php cross site scripting

A vulnerability was identified in code-projects Student Information System 2.0. The impacted element is an unknown function of the file /editprofile.php. Such manipulation leads to cross site scripting. It is possible to launch the attack remotely. The exploit is publicly available and might be used.

CVE-2025-13244 Medium · 6.1 CWE-79 Nov 16, 2025

code-projects Student Information System register.php cross site scripting

A vulnerability was determined in code-projects Student Information System 2.0. The affected element is an unknown function of the file /register.php. This manipulation causes cross site scripting. It is possible to initiate the attack remotely. The exploit has been publicly disclosed and may be utilized.

CVE-2025-13243 High · 8.8 CWE-89 Nov 16, 2025

code-projects Student Information System editprofile.php sql injection

A vulnerability was found in code-projects Student Information System 2.0. Impacted is an unknown function of the file /editprofile.php. The manipulation results in sql injection. The attack may be performed from remote. The exploit has been made public and could be used.