Code-projects vulnerabilities

Published CVEs affecting Code-projects products: 506 record(s), with severity, exploitation and fixes.

Online Music Site 23 Simple Laundry System 21 Employee Management System 16 Simple Food Ordering System 16 Online Reviewer System 15 E-Commerce Website 13 Online Product Reservation System 13 Student File Management System 13 Vehicle Showroom Management System 12 Refugee Food Management System 12 Simple IT Discussion Forum 10 Simple Flight Ticket Booking System 10 Real State Services 9 Exam Form Submission 8 Intern Membership Management System 8 Student Information System 8 Invoice System in Laravel 7 Client Details System 7 Assessment Management 6 Online Food Ordering System 6 Online Hospital Management System 6 Accounting System 6 Simple Stock System 6 Nero Social Networking Site 6 Responsive Hotel Site 6 Online Event Judging System 6 Simple Scheduling System 6 Hotel and Tourism Reservation 6 Employee Profile Management System 5 Content Management System 5 Online Examination System 5 Courier Management System 5 Online Complaint Site 5 Online Job Portal 5 Patient Record Management System 4 Student Membership System 4 Easy Blog Site 4 Online Shoe Store 4 Hotel and Tourism Reservation System 4 Simple Food Order System 4

Exploited only (KEV) →

CVE-2026-7103 Low · 3.7 CWE-327 Apr 27, 2026

code-projects Chat System MD5 Hash update_user.php weak hash

A vulnerability was determined in code-projects Chat System 1.0. Affected is an unknown function of the file update_user.php of the component MD5 Hash Handler. This manipulation of the argument Password causes use of weak hash. The attack is possible to be carried out remotely. The attack's complexity is rated as high. The exploitability is told to be difficult. The exploit has been publicly disclosed and may be utilized.

CVE-2026-7095 Medium · 4.3 CWE-79 Apr 27, 2026

code-projects Employee Management System edit.php cross site scripting

A vulnerability was identified in code-projects Employee Management System 1.0. This affects an unknown part of the file 370project/edit.php. The manipulation of the argument ID leads to cross site scripting. It is possible to initiate the attack remotely. The exploit is publicly available and might be used.

CVE-2026-7093 Medium · 6.3 CWE-266 Apr 27, 2026

code-projects Invoice System in Laravel Invoice Endpoint invoice improper authorization

A vulnerability was found in code-projects Invoice System in Laravel 1.0. Affected by this vulnerability is an unknown functionality of the file /invoice/ of the component Invoice Endpoint. Performing a manipulation of the argument ID results in improper authorization. The attack is possible to be carried out remotely. The exploit has been made public and could be used.

CVE-2026-7092 Medium · 6.3 CWE-266 Apr 27, 2026

code-projects Invoice System in Laravel Profile profile improper authorization

A vulnerability has been found in code-projects Invoice System in Laravel 1.0. Affected is an unknown function of the file /profile/ of the component Profile Handler. Such manipulation of the argument ID leads to improper authorization. The attack can be executed remotely. The exploit has been disclosed to the public and may be used.

CVE-2026-7091 Medium · 6.3 CWE-266 Apr 27, 2026

code-projects Invoice System in Laravel User Management user improper authorization

A flaw has been found in code-projects Invoice System in Laravel 1.0. This impacts an unknown function of the file /user of the component User Management Handler. This manipulation causes improper authorization. Remote exploitation of the attack is possible. The exploit has been published and may be used.

CVE-2026-7090 Low · 2.4 CWE-79 Apr 27, 2026

code-projects Chat System send_message.php cross site scripting

A vulnerability was detected in code-projects Chat System 1.0. This affects an unknown function of the file /admin/send_message.php of the component Chat Interface. The manipulation of the argument msg results in cross site scripting. The attack may be launched remotely. The exploit is now public and may be used.

CVE-2026-7089 Medium · 4.3 CWE-79 Apr 27, 2026

code-projects Home Service System Appointment Booking booking.php cross site scripting

A security vulnerability has been detected in code-projects Home Service System 1.0. The impacted element is an unknown function of the file /booking.php of the component Appointment Booking. The manipulation of the argument fname/lname leads to cross site scripting. The attack may be initiated remotely. The exploit has been disclosed publicly and may be used.

CVE-2026-7070 High · 7.3 CWE-74 Apr 26, 2026

code-projects Inventory Management System Login sql injection

A weakness has been identified in code-projects Inventory Management System 1.0. Affected is an unknown function of the component Login. Executing a manipulation of the argument Username can lead to sql injection. The attack may be launched remotely. The exploit has been made available to the public and could be used for attacks.

CVE-2026-7063 High · 7.3 CWE-74 Apr 26, 2026

code-projects Employee Management System Endpoint eprocess.php sql injection

A vulnerability was detected in code-projects Employee Management System 1.0. This vulnerability affects unknown code of the file /370project/process/eprocess.php of the component Endpoint. Performing a manipulation of the argument pwd results in sql injection. The attack is possible to be carried out remotely. The exploit is now public and may be used.

CVE-2026-6202 Medium · 6.3 CWE-74 Apr 13, 2026

code-projects Easy Blog Site post.php sql injection

A security flaw has been discovered in code-projects Easy Blog Site 1.0. This affects an unknown function of the file post.php. Performing a manipulation of the argument tags results in sql injection. The attack may be initiated remotely. The exploit has been released to the public and may be used for attacks.

CVE-2026-6184 Low · 2.4 CWE-79 Apr 13, 2026

code-projects Simple Content Management System welcome.php cross site scripting

A weakness has been identified in code-projects Simple Content Management System 1.0. This affects an unknown part of the file /web/admin/welcome.php. Executing a manipulation of the argument News Title can lead to cross site scripting. The attack can be executed remotely. The exploit has been made available to the public and could be used for attacks.

CVE-2026-6183 High · 7.3 CWE-74 Apr 13, 2026

code-projects Simple Content Management System index.php sql injection

A security flaw has been discovered in code-projects Simple Content Management System 1.0. Affected by this issue is some unknown functionality of the file /web/index.php. Performing a manipulation of the argument ID results in sql injection. Remote exploitation of the attack is possible. The exploit has been released to the public and may be used for attacks.

CVE-2026-6182 High · 7.3 CWE-74 Apr 13, 2026

code-projects Simple Content Management System login.php sql injection

A vulnerability was identified in code-projects Simple Content Management System 1.0. Affected by this vulnerability is an unknown functionality of the file /web/admin/login.php. Such manipulation of the argument User leads to sql injection. The attack may be launched remotely. The exploit is publicly available and might be used.

CVE-2026-6167 High · 7.3 CWE-74 Apr 13, 2026

code-projects Faculty Management System subject-print.php sql injection

A vulnerability was detected in code-projects Faculty Management System 1.0. Impacted is an unknown function of the file /subject-print.php. The manipulation of the argument ID results in sql injection. The attack may be launched remotely. The exploit is now public and may be used.

CVE-2026-6166 High · 7.3 CWE-74 Apr 13, 2026

code-projects Vehicle Showroom Management System UpdateVehicleFunction.php sql injection

A security vulnerability has been detected in code-projects Vehicle Showroom Management System 1.0. This issue affects some unknown processing of the file /util/UpdateVehicleFunction.php. The manipulation of the argument VEHICLE_ID leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed publicly and may be used.

CVE-2026-6165 High · 7.3 CWE-74 Apr 13, 2026

code-projects Vehicle Showroom Management System Login_check.php sql injection

A weakness has been identified in code-projects Vehicle Showroom Management System 1.0. This vulnerability affects unknown code of the file /util/Login_check.php. Executing a manipulation of the argument ID can lead to sql injection. The attack can be launched remotely. The exploit has been made available to the public and could be used for attacks.

CVE-2026-6164 High · 7.3 CWE-74 Apr 13, 2026

code-projects Lost and Found Thing Management addcat.php sql injection

A security flaw has been discovered in code-projects Lost and Found Thing Management 1.0. This affects an unknown part of the file /addcat.php. Performing a manipulation of the argument cata results in sql injection. The attack can be initiated remotely. The exploit has been released to the public and may be used for attacks.

CVE-2026-6163 High · 7.3 CWE-74 Apr 13, 2026

code-projects Lost and Found Thing Management catageory.php sql injection

A vulnerability was identified in code-projects Lost and Found Thing Management 1.0. Affected by this issue is some unknown functionality of the file /catageory.php. Such manipulation of the argument cat leads to sql injection. It is possible to launch the attack remotely. The exploit is publicly available and might be used.

CVE-2026-6161 High · 7.3 CWE-74 Apr 13, 2026

code-projects Simple ChatBox Endpoint insert.php sql injection

A vulnerability was determined in code-projects Simple ChatBox up to 1.0. This affects an unknown part of the file /chatbox/insert.php of the component Endpoint. Executing a manipulation of the argument msg can lead to sql injection. It is possible to launch the attack remotely. The exploit has been publicly disclosed and may be utilized.

CVE-2026-6160 Medium · 5.3 CWE-200 Apr 13, 2026

code-projects Simple ChatBox Endpoint chatbox.sql SimpleChatbox_PHP file information disclosure

A vulnerability was found in code-projects Simple ChatBox 1.0. Affected by this issue is the function SimpleChatbox_PHP of the file chatbox.sql of the component Endpoint. Performing a manipulation results in file and directory information exposure. It is possible to initiate the attack remotely. The exploit has been made public and could be used.

CVE-2026-6159 Medium · 4.3 CWE-79 Apr 13, 2026

code-projects Simple ChatBox Endpoint insert.php cross site scripting

A vulnerability has been found in code-projects Simple ChatBox up to 1.0. Affected by this vulnerability is an unknown functionality of the file /chatbox/insert.php of the component Endpoint. Such manipulation of the argument msg leads to cross site scripting. The attack may be performed from remote. The exploit has been disclosed to the public and may be used.

CVE-2026-6153 High · 7.3 CWE-74 Apr 13, 2026

code-projects Vehicle Showroom Management System StaffDetailsFunction.php sql injection

A vulnerability was identified in code-projects Vehicle Showroom Management System 1.0. Impacted is an unknown function of the file /util/StaffDetailsFunction.php. Such manipulation of the argument STAFF_ID leads to sql injection. The attack can be launched remotely. The exploit is publicly available and might be used.

CVE-2026-6152 High · 7.3 CWE-74 Apr 13, 2026

code-projects Vehicle Showroom Management System StaffAddingFunction.php sql injection

A vulnerability was determined in code-projects Vehicle Showroom Management System 1.0. This issue affects some unknown processing of the file /util/StaffAddingFunction.php. This manipulation of the argument STAFF_ID causes sql injection. The attack can be initiated remotely. The exploit has been publicly disclosed and may be utilized.

CVE-2026-6151 High · 7.3 CWE-74 Apr 13, 2026

code-projects Vehicle Showroom Management System PaymentStatusFunction.php sql injection

A vulnerability was found in code-projects Vehicle Showroom Management System 1.0. This vulnerability affects unknown code of the file /util/PaymentStatusFunction.php. The manipulation of the argument CUSTOMER_ID results in sql injection. It is possible to launch the attack remotely. The exploit has been made public and could be used.

CVE-2026-6150 Medium · 4.3 CWE-79 Apr 13, 2026

code-projects Simple Laundry System checkupdatestatus.php cross site scripting

A vulnerability has been found in code-projects Simple Laundry System 1.0. This affects an unknown part of the file /checkupdatestatus.php. The manipulation of the argument serviceId leads to cross site scripting. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.