Code-projects vulnerabilities
Published CVEs affecting Code-projects products: 551 record(s), with severity, exploitation and fixes.
Online Music Site 23Simple Laundry System 21Employee Management System 17Simple Food Ordering System 16Online Reviewer System 15E-Commerce Website 13Online Product Reservation System 13Student File Management System 13Vehicle Showroom Management System 12Refugee Food Management System 12Simple IT Discussion Forum 10Online Shopping System 10Simple Flight Ticket Booking System 10Real State Services 9Exam Form Submission 8Intern Membership Management System 8Student Information System 8Assessment Management 7Invoice System in Laravel 7Client Details System 7Content Management System 6Online Food Ordering System 6Online Hospital Management System 6Accounting System 6Simple Stock System 6Nero Social Networking Site 6Responsive Hotel Site 6Online Event Judging System 6Simple Scheduling System 6Hospital Information System 6Task Management System 6Hotel and Tourism Reservation 6Employee Profile Management System 5Online Examination System 5Courier Management System 5Online Complaint Site 5Online Job Portal 5Patient Record Management System 4Student Membership System 4Easy Blog Site 4
CVE-2026-5672
High · 7.3
CWE-74 Apr 6, 2026
code-projects Simple IT Discussion Forum Parameter edit-category.php sql injection
A vulnerability has been found in code-projects Simple IT Discussion Forum 1.0. Affected by this issue is some unknown functionality of the file /edit-category.php of the component Parameter Handler. The manipulation of the argument cat_id leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.
CVE-2026-5666
Medium · 5.3
CWE-200 Apr 6, 2026
code-projects Online FIR System SQL Database Backup File complaints.sql sensitive information
A vulnerability was detected in code-projects Online FIR System 1.0. Affected by this issue is some unknown functionality of the file /complaints.sql of the component SQL Database Backup File Handler. The manipulation results in insecure storage of sensitive information. The attack may be performed from remote. The exploit is now public and may be used.
CVE-2026-5665
High · 7.3
CWE-74 Apr 6, 2026
code-projects Online FIR System Login checklogin.php sql injection
A security vulnerability has been detected in code-projects Online FIR System 1.0. Affected by this vulnerability is an unknown functionality of the file /Login/checklogin.php of the component Login. The manipulation of the argument email/password leads to sql injection. The attack is possible to be carried out remotely. The exploit has been disclosed publicly and may be used.
CVE-2026-5650
Medium · 5.3
CWE-200 Apr 6, 2026
code-projects Online Application System for Admission oas.sql sensitive information
A vulnerability was found in code-projects Online Application System for Admission 1.0. Impacted is an unknown function of the file /enrollment/database/oas.sql. Performing a manipulation results in insecure storage of sensitive information. The attack is possible to be carried out remotely. The exploit has been made public and could be used.
CVE-2026-5649
Medium · 6.3
CWE-74 Apr 6, 2026
code-projects Online Application System for Admission Endpoint admsnform.php sql injection
A vulnerability has been found in code-projects Online Application System for Admission 1.0. This issue affects some unknown processing of the file /enrollment/admsnform.php of the component Endpoint. Such manipulation leads to sql injection. The attack can be executed remotely. The exploit has been disclosed to the public and may be used.
CVE-2026-5648
High · 7.3
CWE-74 Apr 6, 2026
code-projects Simple Laundry System Parameter userfinishregister.php sql injection
A flaw has been found in code-projects Simple Laundry System 1.0. This vulnerability affects unknown code of the file /userfinishregister.php of the component Parameter Handler. This manipulation of the argument firstName causes sql injection. Remote exploitation of the attack is possible. The exploit has been published and may be used.
CVE-2026-5647
Low · 2.4
CWE-79 Apr 6, 2026
code-projects Online Shoe Store Add Product admin_feature.php cross site scripting
A vulnerability was detected in code-projects Online Shoe Store 1.0. This affects an unknown part of the file /admin/admin_feature.php of the component Add Product Page. The manipulation of the argument product_name results in cross site scripting. The attack may be launched remotely. The exploit is now public and may be used.
CVE-2026-5646
High · 7.3
CWE-74 Apr 6, 2026
code-projects Easy Blog Site login.php sql injection
A security vulnerability has been detected in code-projects Easy Blog Site 1.0. Affected by this issue is some unknown functionality of the file login.php. The manipulation of the argument username/password leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed publicly and may be used.
CVE-2026-5565
High · 7.3
CWE-74 Apr 5, 2026
code-projects Simple Laundry System Parameter delmemberinfo.php sql injection
A security vulnerability has been detected in code-projects Simple Laundry System 1.0. Affected by this issue is some unknown functionality of the file /delmemberinfo.php of the component Parameter Handler. Such manipulation of the argument userid leads to sql injection. The attack may be launched remotely. The exploit has been disclosed publicly and may be used.
CVE-2026-5564
High · 7.3
CWE-74 Apr 5, 2026
code-projects Simple Laundry System Parameter searchguest.php sql injection
A weakness has been identified in code-projects Simple Laundry System 1.0. Affected by this vulnerability is an unknown functionality of the file /searchguest.php of the component Parameter Handler. This manipulation of the argument searchServiceId causes sql injection. The attack may be initiated remotely. The exploit has been made available to the public and could be used for attacks.
CVE-2026-5555
High · 7.3
CWE-74 Apr 5, 2026
code-projects Concert Ticket Reservation System Parameter login.php sql injection
A weakness has been identified in code-projects Concert Ticket Reservation System 1.0. This affects an unknown part of the file /ConcertTicketReservationSystem-master/login.php of the component Parameter Handler. Executing a manipulation of the argument Email can lead to sql injection. The attack may be launched remotely. The exploit has been made available to the public and could be used for attacks.
CVE-2026-5554
High · 7.3
CWE-74 Apr 5, 2026
code-projects Concert Ticket Reservation System Parameter process_search.php sql injection
A security flaw has been discovered in code-projects Concert Ticket Reservation System 1.0. Affected by this issue is some unknown functionality of the file /ConcertTicketReservationSystem-master/process_search.php of the component Parameter Handler. Performing a manipulation of the argument searching results in sql injection. The attack may be initiated remotely. The exploit has been released to the public and may be used for attacks.
CVE-2026-5542
Medium · 4.3
CWE-79 Apr 5, 2026
code-projects Simple Laundry System Parameter modstaffinfo.php cross site scripting
A vulnerability was determined in code-projects Simple Laundry System 1.0. Impacted is an unknown function of the file /modstaffinfo.php of the component Parameter Handler. Executing a manipulation of the argument userid can lead to cross site scripting. The attack may be launched remotely. The exploit has been publicly disclosed and may be utilized.
CVE-2026-5541
Medium · 4.3
CWE-79 Apr 5, 2026
code-projects Simple Laundry System Parameter modmemberinfo.php cross site scripting
A vulnerability was found in code-projects Simple Laundry System 1.0. This issue affects some unknown processing of the file /modmemberinfo.php of the component Parameter Handler. Performing a manipulation of the argument userid results in cross site scripting. The attack may be initiated remotely. The exploit has been made public and could be used.
CVE-2026-5540
High · 7.3
CWE-74 Apr 5, 2026
code-projects Simple Laundry System Parameter modifymember.php sql injection
A vulnerability has been found in code-projects Simple Laundry System 1.0. This vulnerability affects unknown code of the file /modifymember.php of the component Parameter Handler. Such manipulation of the argument firstName leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used.
CVE-2026-5539
Medium · 4.3
CWE-79 Apr 5, 2026
code-projects Simple Laundry System Parameter modifymember.php cross site scripting
A flaw has been found in code-projects Simple Laundry System 1.0. This affects an unknown part of the file /modifymember.php of the component Parameter Handler. This manipulation of the argument firstName causes cross site scripting. The attack can be initiated remotely. The exploit has been published and may be used.
CVE-2026-5257
Critical · 9.8
CWE-74 Apr 1, 2026
code-projects Simple Laundry System Parameter delstaffinfo.php sql injection
A vulnerability has been found in code-projects Simple Laundry System 1.0. This issue affects some unknown processing of the file /delstaffinfo.php of the component Parameter Handler. Such manipulation of the argument userid leads to sql injection. The attack can be executed remotely. The exploit has been disclosed to the public and may be used.
CVE-2026-5256
Critical · 9.8
CWE-74 Apr 1, 2026
code-projects Simple Laundry System Parameter modify.php sql injection
A flaw has been found in code-projects Simple Laundry System 1.0. This vulnerability affects unknown code of the file /modify.php of the component Parameter Handler. This manipulation of the argument firstName causes sql injection. Remote exploitation of the attack is possible. The exploit has been published and may be used.
CVE-2026-5255
Medium · 6.1
CWE-79 Apr 1, 2026
code-projects Simple Laundry System Parameter delstaffinfo.php cross site scripting
A vulnerability was detected in code-projects Simple Laundry System 1.0. This affects an unknown part of the file /delstaffinfo.php of the component Parameter Handler. The manipulation of the argument userid results in cross site scripting. The attack may be launched remotely. The exploit is now public and may be used.
CVE-2026-5240
Medium · 4.3
CWE-79 Mar 31, 2026
code-projects BloodBank Managing System admin_state.php cross site scripting
A security vulnerability has been detected in code-projects BloodBank Managing System 1.0. This affects an unknown part of the file /admin_state.php. The manipulation of the argument statename leads to cross site scripting. It is possible to initiate the attack remotely. The exploit has been disclosed publicly and may be used.
CVE-2026-5206
Medium · 6.3
CWE-74 Mar 31, 2026
code-projects Simple Gym Management System Payment sql injection
A security vulnerability has been detected in code-projects Simple Gym Management System 1.0. This vulnerability affects unknown code of the component Payment Handler. The manipulation of the argument Payment_id/Amount/customer_id/payment_type/customer_name leads to sql injection. Remote exploitation of the attack is possible. The exploit has been disclosed publicly and may be used.
CVE-2026-5198
High · 7.3
CWE-74 Mar 31, 2026
code-projects Student Membership System Admin Login index.php sql injection
A vulnerability was determined in code-projects Student Membership System 1.0. The impacted element is an unknown function of the file /admin/index.php of the component Admin Login. This manipulation of the argument username/password causes sql injection. Remote exploitation of the attack is possible. The exploit has been publicly disclosed and may be utilized.
CVE-2026-5197
Medium · 6.3
CWE-74 Mar 31, 2026
code-projects Student Membership System delete_user.php sql injection
A vulnerability was found in code-projects Student Membership System 1.0. The affected element is an unknown function of the file /delete_user.php. The manipulation of the argument ID results in sql injection. The attack may be launched remotely. The exploit has been made public and could be used.
CVE-2026-5196
Medium · 6.3
CWE-74 Mar 31, 2026
code-projects Student Membership System delete_member.php sql injection
A vulnerability has been found in code-projects Student Membership System 1.0. Impacted is an unknown function of the file /delete_member.php. The manipulation of the argument ID leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used.
CVE-2026-5195
High · 7.3
CWE-74 Mar 31, 2026
code-projects Student Membership System User Registration sql injection
A flaw has been found in code-projects Student Membership System 1.0. This issue affects some unknown processing of the component User Registration Handler. Executing a manipulation can lead to sql injection. The attack can be launched remotely.