Itsourcecode vulnerabilities
Published CVEs affecting Itsourcecode products: 348 record(s), with severity, exploitation and fixes.
Hospital Management System 50Student Management System 24Sales and Inventory System 18School Management System 16Society Management System 15Construction Management System 12University Management System 11College Management System 10Online Medicine Delivery System 9COVID Tracking System 9Online Admission System 9Fees Management System 9Courier Management System 8Online Cake Ordering System 8Electronic Judging System 7Open Source Job Portal 7Payroll Management System 7Inventory Management System 7Free Hotel Reservation System 7Online Frozen Foods Ordering System 7Online Hotel Management System 7Online Enrollment System 6Event Management System 6Online Loan Management System 5Web-based Internet Laboratory Management System 5News Portal Project 5Content Management System 5Online Student Enrollment System 4Document Management System 4Online Voting System 4Baptism Information Management System 4Student Transcript Processing System 4Online House Rental System 3Payroll System 3Online Doctor Appointment System 3Student Information System 3Sanitize Or Validate This Input 3Online Pet Shop Management System 3Leave Management System 2Human Resource Management System 2
CVE-2026-36234
Critical · 9.8
CWE-89 Apr 10, 2026
SQL Injection in Itsourcecode Online Student Enrollment System
itsourcecode Online Student Enrollment System v1.0 is vulnerable to SQL Injection in newCourse.php via the 'coursename' parameter.
CVE-2026-36233
Critical · 9.8
CWE-89 Apr 10, 2026
SQL Injection in Itsourcecode Online Student Enrollment System
A SQL injection vulnerability was found in the assignInstructorSubjects.php file of itsourcecode Online Student Enrollment System v1.0. The reason for this issue is that attackers can inject malicious code via the parameter "subjcode" and use it directly in SQL queries without the need for appropriate cleaning or validation.
CVE-2026-36232
Critical · 9.8
CWE-89 Apr 10, 2026
SQL Injection in Itsourcecode Online Student Enrollment System
A SQL injection vulnerability was found in the instructorClasses.php file of itsourcecode Online Student Enrollment System v1.0. The reason for this issue is that the 'classId' parameter from $_GET['classId'] is directly concatenated into the SQL query without any sanitization or validation.
CVE-2026-6030
Medium · 6.3
CWE-74 Apr 10, 2026
itsourcecode Construction Management System del1.php sql injection
A flaw has been found in itsourcecode Construction Management System 1.0. The impacted element is an unknown function of the file /del1.php. This manipulation of the argument toolname causes sql injection. Remote exploitation of the attack is possible. The exploit has been published and may be used.
CVE-2026-6007
Medium · 6.3
CWE-74 Apr 10, 2026
itsourcecode Construction Management System del.php sql injection
A vulnerability was found in itsourcecode Construction Management System 1.0. This affects an unknown function of the file /del.php. The manipulation of the argument equipname results in sql injection. The attack can be launched remotely. The exploit has been made public and could be used.
CVE-2026-5823
Medium · 6.3
CWE-74 Apr 8, 2026
itsourcecode Construction Management System borrowed_tool_report.php sql injection
A weakness has been identified in itsourcecode Construction Management System 1.0. Affected by this issue is some unknown functionality of the file /borrowed_tool_report.php. This manipulation of the argument Home causes sql injection. It is possible to initiate the attack remotely. The exploit has been made available to the public and could be used for attacks.
CVE-2026-5719
Medium · 6.3
CWE-74 Apr 7, 2026
itsourcecode Construction Management System borrowedtool.php sql injection
A flaw has been found in itsourcecode Construction Management System 1.0. This affects an unknown function of the file /borrowedtool.php. Executing a manipulation of the argument code can lead to sql injection. It is possible to launch the attack remotely. The exploit has been published and may be used.
CVE-2026-5681
Medium · 6.3
CWE-74 Apr 6, 2026
itsourcecode sanitize or validate this input Parameter borrowedequip.php sql injection
A flaw has been found in itsourcecode sanitize or validate this input 1.0. This impacts an unknown function of the file /borrowedequip.php of the component Parameter Handler. This manipulation of the argument emp_id causes sql injection. The attack is possible to be carried out remotely. The exploit has been published and may be used.
CVE-2026-5675
Medium · 6.3
CWE-74 Apr 6, 2026
itsourcecode Construction Management System Parameter borrowed_tool.php sql injection
A vulnerability was found in itsourcecode Construction Management System 1.0. This affects an unknown part of the file /borrowed_tool.php of the component Parameter Handler. The manipulation of the argument emp results in sql injection. It is possible to launch the attack remotely. The exploit has been made public and could be used.
CVE-2026-5660
Medium · 6.3
CWE-74 Apr 6, 2026
itsourcecode Construction Management System Parameter borrowed_equip.php sql injection
A vulnerability was determined in itsourcecode Construction Management System 1.0. The impacted element is an unknown function of the file /borrowed_equip.php of the component Parameter Handler. This manipulation of the argument emp causes sql injection. The attack may be initiated remotely. The exploit has been publicly disclosed and may be utilized.
CVE-2026-5620
Medium · 6.3
CWE-74 Apr 6, 2026
itsourcecode Construction Management System Parameter borrowed_equip_report.php sql injection
A vulnerability has been found in itsourcecode Construction Management System 1.0. Affected is an unknown function of the file /borrowed_equip_report.php of the component Parameter Handler. The manipulation of the argument Home leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.
CVE-2026-5553
Medium · 6.3
CWE-74 Apr 5, 2026
itsourcecode Online Cellphone System Parameter available.php sql injection
A vulnerability was identified in itsourcecode Online Cellphone System 1.0. Affected by this vulnerability is an unknown functionality of the file /cp/available.php of the component Parameter Handler. Such manipulation of the argument Name leads to sql injection. The attack can be launched remotely. The exploit is publicly available and might be used.
CVE-2026-5551
High · 7.3
CWE-74 Apr 5, 2026
itsourcecode Free Hotel Reservation System Parameter login.php sql injection
A security flaw has been discovered in itsourcecode Free Hotel Reservation System 1.0. This vulnerability affects unknown code of the file /hotel/admin/login.php of the component Parameter Handler. The manipulation of the argument email results in sql injection. The attack may be launched remotely. The exploit has been released to the public and may be used for attacks.
CVE-2026-5534
High · 7.3
CWE-74 Apr 5, 2026
itsourcecode Online Enrollment System Parameter index.php sql injection
A vulnerability was identified in itsourcecode Online Enrollment System 1.0. This affects an unknown function of the file /sms/user/index.php?view=edit&id=10 of the component Parameter Handler. Such manipulation of the argument USERID leads to sql injection. The attack can be executed remotely. The exploit is publicly available and might be used.
CVE-2026-5334
Critical · 9.8
CWE-89 Apr 2, 2026
itsourcecode Online Enrollment System Parameter index.php sql injection
A weakness has been identified in itsourcecode Online Enrollment System 1.0. Impacted is an unknown function of the file /enrollment/index.php?view=edit&id=3 of the component Parameter Handler. This manipulation of the argument deptid causes sql injection. The attack is possible to be carried out remotely. The exploit has been made available to the public and could be used for attacks.
CVE-2026-5319
Medium · 4.3
CWE-79 Apr 2, 2026
itsourcecode Payroll Management System navbar.php cross site scripting
A security vulnerability has been detected in itsourcecode Payroll Management System up to 1.0. Affected is an unknown function of the file /navbar.php. Such manipulation of the argument page leads to cross site scripting. It is possible to launch the attack remotely. The exploit has been disclosed publicly and may be used.
CVE-2026-5238
High · 7.3
CWE-74 Mar 31, 2026
itsourcecode Payroll Management System Parameter view_employee.php sql injection
A weakness has been identified in itsourcecode Payroll Management System 1.0. Affected by this issue is some unknown functionality of the file /view_employee.php of the component Parameter Handler. Executing a manipulation of the argument ID can lead to sql injection. The attack may be performed from remote. The exploit has been made available to the public and could be used for attacks.
CVE-2026-5237
High · 7.3
CWE-74 Mar 31, 2026
itsourcecode Payroll Management System Parameter manage_user.php sql injection
A security flaw has been discovered in itsourcecode Payroll Management System 1.0. Affected by this vulnerability is an unknown functionality of the file /manage_user.php of the component Parameter Handler. Performing a manipulation of the argument ID results in sql injection. The attack is possible to be carried out remotely. The exploit has been released to the public and may be used for attacks.
CVE-2026-4966
Medium · 6.3
CWE-74 Mar 27, 2026
itsourcecode Free Hotel Reservation System index.php sql injection
A flaw has been found in itsourcecode Free Hotel Reservation System 1.0. Impacted is an unknown function of the file /admin/mod_room/index.php?view=edit. Executing a manipulation of the argument ID can lead to sql injection. The attack can be launched remotely. The exploit has been published and may be used.
CVE-2026-4877
Medium · 4.3
CWE-79 Mar 26, 2026
itsourcecode Payroll Management System index.php cross site scripting
A security flaw has been discovered in itsourcecode Payroll Management System up to 1.0. This affects an unknown function of the file /index.php. Performing a manipulation of the argument page results in cross site scripting. It is possible to initiate the attack remotely. The exploit has been released to the public and may be used for attacks.
CVE-2026-4876
Medium · 6.3
CWE-74 Mar 26, 2026
itsourcecode Free Hotel Reservation System index.php sql injection
A vulnerability was identified in itsourcecode Free Hotel Reservation System 1.0. The impacted element is an unknown function of the file /admin/mod_amenities/index.php?view=editpic. Such manipulation of the argument ID leads to sql injection. The attack may be performed from remote. The exploit is publicly available and might be used.
CVE-2026-4875
Medium · 4.7
CWE-284 Mar 26, 2026
itsourcecode Free Hotel Reservation System index.php unrestricted upload
A vulnerability was determined in itsourcecode Free Hotel Reservation System 1.0. The affected element is an unknown function of the file /admin/mod_amenities/index.php?view=add. This manipulation of the argument image causes unrestricted upload. The attack is possible to be carried out remotely. The exploit has been publicly disclosed and may be utilized.
CVE-2026-4842
High · 7.3
CWE-74 Mar 26, 2026
itsourcecode Online Enrollment System Parameter index.php sql injection
A security vulnerability has been detected in itsourcecode Online Enrollment System 1.0. This vulnerability affects unknown code of the file /sms/grades/index.php?view=edit&id=1 of the component Parameter Handler. The manipulation of the argument deptid leads to sql injection. The attack is possible to be carried out remotely. The exploit has been disclosed publicly and may be used.
CVE-2026-4783
Medium · 6.3
CWE-74 Mar 24, 2026
itsourcecode College Management System Parameter add-single-student-results.php sql injection
A vulnerability has been found in itsourcecode College Management System 1.0. The impacted element is an unknown function of the file /admin/add-single-student-results.php of the component Parameter Handler. The manipulation of the argument course_code leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.
CVE-2026-4632
High · 7.3
CWE-74 Mar 24, 2026
itsourcecode Online Enrollment System Parameter index.php sql injection
A weakness has been identified in itsourcecode Online Enrollment System 1.0. This vulnerability affects unknown code of the file /sms/user/index.php?view=add of the component Parameter Handler. Executing a manipulation of the argument Name can lead to sql injection. The attack may be performed from remote. The exploit has been made available to the public and could be used for attacks.