Fabian vulnerabilities

Published CVEs affecting Fabian products: 211 record(s), with severity, exploitation and fixes.

Online Music Site 18 Simple Food Ordering System 13 Student File Management System 13 Online Product Reservation System 13 Online Reviewer System 12 Refugee Food Management System 12 E-commerce Website 12 Student Information System 8 Client Details System 7 Simple Scheduling System 6 Online Complaint Site 6 Online Hotel Reservation System 6 Nero Social Networking Site 6 Responsive Hotel Site 6 Scholars Tracking System 5 Online Examination System 4 Mobile Shop Management System 4 Online Bidding System 4 Currency Exchange System 4 Simple Cafe Ordering System 4 Simple Online Hotel Reservation System 4 Online Job Search Engine 4 Automated Voting System 3 Simple Shopping Cart 3 Online Ordering System 3 Project Monitoring System 3 Voting System 3 Simple E-banking System 3 Simple Blood Donor Management System 3 Contact Management System 2 Online Student Management System 2 Online Course Registration Site 2 Web-based Inventory And Pos System 2 Class And Exam Timetable Management System 2 Blog Site 2 Chamber Of Commerce Membership Management System 1 Student Transcript Processing System 1 Simple Attendance Record System 1 Hospital Management System 1 E-commerce Site 1

Exploited only (KEV) →

CVE-2026-2132 Critical · 9.8 CWE-89 Feb 8, 2026

SQL Injection in code-projects Online Music Site 1.0 (CVE-2026-2132)

A security flaw has been discovered in code-projects Online Music Site 1.0. This issue affects some unknown processing of the file /Administrator/PHP/AdminUpdateCategory.php. The manipulation of the argument txtcat results in sql injection. The attack can be executed remotely. The exploit has been released to the public and may be used for attacks.

CVE-2026-2060 Critical · 9.8 CWE-89 Feb 6, 2026

Simple Blood Donor Management System 1.0 SQL Injection (CVE-2026-2060)

A vulnerability was found in code-projects Simple Blood Donor Management System 1.0. Affected by this vulnerability is an unknown functionality of the file /simpleblooddonor/editcampaignform.php. Performing a manipulation of the argument ID results in sql injection. It is possible to initiate the attack remotely. The exploit has been made public and could be used.

CVE-2026-1535 Critical · 9.8 CWE-74 Jan 28, 2026

code-projects Online Music Site SQL Injection in AdminReply.php

A security vulnerability has been detected in code-projects Online Music Site 1.0. This impacts an unknown function of the file /Administrator/PHP/AdminReply.php. Such manipulation of the argument ID leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed publicly and may be used.

CVE-2026-1534 Critical · 9.8 CWE-74 Jan 28, 2026

Online Music Site 1.0 SQL Injection in AdminEditUser.php

A weakness has been identified in code-projects Online Music Site 1.0. This affects an unknown function of the file /Administrator/PHP/AdminEditUser.php. This manipulation of the argument ID causes sql injection. It is possible to initiate the attack remotely. The exploit has been made available to the public and could be used for attacks.

CVE-2026-1533 Critical · 9.8 CWE-89 Jan 28, 2026

code-projects Online Music Site 1.0 - SQL Injection in AdminAddCategory.php

A security flaw has been discovered in code-projects Online Music Site 1.0. The impacted element is an unknown function of the file /Administrator/PHP/AdminAddCategory.php. The manipulation results in sql injection. The attack may be performed from remote. The exploit has been released to the public and may be used for attacks.

CVE-2025-69564 Critical · 9.8 CWE-94 Jan 27, 2026

code-projects Mobile Shop Management System SQL Injection in ExAddNewUser.php (CVE-2025-69564)

code-projects Mobile Shop Management System 1.0 is vulnerable to SQL Injection in /ExAddNewUser.php via the Name, Address, email, UserName, Password, confirm_password, Role, Branch, and Activate parameters.

CVE-2025-69563 Critical · 9.8 CWE-89 Jan 27, 2026

code-projects Mobile Shop Management System SQL Injection in ExLogin.php

code-projects Mobile Shop Management System 1.0 is vulnerable to SQL Injection in /ExLogin.php via the Password parameter.

CVE-2025-69562 Critical · 9.8 CWE-89 Jan 27, 2026

code-projects Mobile Shop Management System 1.0 SQL Injection via userid in insertmessage.php

code-projects Mobile Shop Management System 1.0 is vulnerable to SQL Injection in /insertmessage.php via the userid parameter.

CVE-2025-69565 Critical · 9.8 CWE-434 Jan 27, 2026

code-projects Mobile Shop Management System 1.0 Unrestricted File Upload

code-projects Mobile Shop Management System 1.0 is vulnerable to File Upload in /ExAddProduct.php.

CVE-2026-1443 Critical · 9.8 CWE-89 Jan 26, 2026

code-projects Online Music Site AdminDeleteUser.php sql injection

A flaw has been found in code-projects Online Music Site 1.0. Affected by this issue is some unknown functionality of the file /Administrator/PHP/AdminDeleteUser.php. This manipulation of the argument ID causes sql injection. The attack can be initiated remotely. The exploit has been published and may be used.

CVE-2026-1423 Critical · 9.8 CWE-284 Jan 26, 2026

code-projects Online Examination System admin_pic.php unrestricted upload

A vulnerability was determined in code-projects Online Examination System 1.0. Affected by this issue is some unknown functionality of the file /admin_pic.php. Executing a manipulation can lead to unrestricted upload. The attack may be performed from remote. The exploit has been publicly disclosed and may be utilized.

CVE-2026-1422 Critical · 9.8 CWE-89 Jan 26, 2026

code-projects Online Examination System Login Page index.php sql injection

A vulnerability was found in code-projects Online Examination System 1.0. Affected by this vulnerability is an unknown functionality of the file /index.php of the component Login Page. Performing a manipulation of the argument User results in sql injection. The attack is possible to be carried out remotely. The exploit has been made public and could be used.

CVE-2026-1421 Medium · 5.4 CWE-79 Jan 26, 2026

code-projects Online Examination System Add Pages cross site scripting

A vulnerability has been found in code-projects Online Examination System 1.0. Affected is an unknown function of the component Add Pages. Such manipulation leads to cross site scripting. The attack can be executed remotely. The exploit has been disclosed to the public and may be used.

CVE-2026-0852 Critical · 9.8 CWE-74 Jan 11, 2026

code-projects Online Music Site AdminUpdateUser.php sql injection

A security flaw has been discovered in code-projects Online Music Site 1.0. The impacted element is an unknown function of the file /Administrator/PHP/AdminUpdateUser.php. The manipulation of the argument ID results in sql injection. The attack can be executed remotely. The exploit has been released to the public and may be used for attacks.

CVE-2026-0851 Critical · 9.8 CWE-74 Jan 11, 2026

code-projects Online Music Site AdminAddUser.php sql injection

A vulnerability was identified in code-projects Online Music Site 1.0. The affected element is an unknown function of the file /Administrator/PHP/AdminAddUser.php. The manipulation of the argument txtusername leads to sql injection. Remote exploitation of the attack is possible. The exploit is publicly available and might be used.

CVE-2026-0607 Critical · 9.8 CWE-89 Jan 5, 2026

code-projects Online Music Site AdminViewSongs.php sql injection

A flaw has been found in code-projects Online Music Site 1.0. This affects an unknown part of the file /Administrator/PHP/AdminViewSongs.php. Executing a manipulation of the argument ID can lead to sql injection. It is possible to launch the attack remotely. The exploit has been published and may be used.

CVE-2026-0606 Critical · 9.8 CWE-89 Jan 5, 2026

code-projects Online Music Site Albums.php sql injection

A vulnerability was detected in code-projects Online Music Site 1.0. Affected by this issue is some unknown functionality of the file /FrontEnd/Albums.php. Performing a manipulation of the argument ID results in sql injection. It is possible to initiate the attack remotely. The exploit is now public and may be used.

CVE-2026-0605 Critical · 9.8 CWE-89 Jan 5, 2026

code-projects Online Music Site login.php sql injection

A security vulnerability has been detected in code-projects Online Music Site 1.0. Affected by this vulnerability is an unknown functionality of the file /login.php. Such manipulation of the argument username/password leads to sql injection. The attack may be performed from remote. The exploit has been disclosed publicly and may be used.

CVE-2026-0592 Critical · 9.8 CWE-74 Jan 5, 2026

code-projects Online Product Reservation System User Registration register_code.php sql injection

A security flaw has been discovered in code-projects Online Product Reservation System 1.0. This affects an unknown function of the file /handgunner-administrator/register_code.php of the component User Registration Handler. Performing a manipulation of the argument fname/lname/address/city/province/country/zip/tel_no/email/username results in sql injection. The attack can be initiated remotely. The exploit has been released to the public and may be used for attacks.

CVE-2026-0591 Critical · 9.8 CWE-74 Jan 5, 2026

code-projects Online Product Reservation System Cart Update update.php sql injection

A vulnerability was identified in code-projects Online Product Reservation System 1.0. The impacted element is an unknown function of the file /app/checkout/update.php of the component Cart Update Handler. Such manipulation of the argument id/qty leads to sql injection. It is possible to launch the attack remotely. The exploit is publicly available and might be used.

CVE-2026-0590 Critical · 9.8 CWE-74 Jan 5, 2026

code-projects Online Product Reservation System POST Parameter delete.php sql injection

A vulnerability was determined in code-projects Online Product Reservation System 1.0. The affected element is an unknown function of the file /app/checkout/delete.php of the component POST Parameter Handler. This manipulation of the argument ID causes sql injection. It is possible to initiate the attack remotely. The exploit has been publicly disclosed and may be utilized.

CVE-2026-0589 High · 7.3 CWE-287 Jan 5, 2026

code-projects Online Product Reservation System Administration Backend improper authentication

A vulnerability was found in code-projects Online Product Reservation System 1.0. Impacted is an unknown function of the component Administration Backend. The manipulation results in improper authentication. The attack may be performed from remote. The exploit has been made public and could be used.

CVE-2026-0586 Medium · 6.1 CWE-79 Jan 5, 2026

code-projects Online Product Reservation System prod.php cross site scripting

A vulnerability was detected in code-projects Online Product Reservation System 1.0. The affected element is an unknown function of the file handgunner-administrator/prod.php. Performing a manipulation of the argument cat results in cross site scripting. The attack is possible to be carried out remotely. The exploit is now public and may be used.

CVE-2026-0585 Critical · 9.8 CWE-74 Jan 5, 2026

code-projects Online Product Reservation System GET Parameter order_view.php sql injection

A security vulnerability has been detected in code-projects Online Product Reservation System 1.0. Impacted is an unknown function of the file /order_view.php of the component GET Parameter Handler. Such manipulation of the argument transaction_id leads to sql injection. The attack can be executed remotely. The exploit has been disclosed publicly and may be used.

CVE-2026-0584 Critical · 9.8 CWE-74 Jan 5, 2026

code-projects Online Product Reservation System left_cart.php sql injection

A weakness has been identified in code-projects Online Product Reservation System 1.0. This issue affects some unknown processing of the file app/products/left_cart.php. This manipulation of the argument ID causes sql injection. Remote exploitation of the attack is possible. The exploit has been made available to the public and could be used for attacks.