SourceCodester vulnerabilities
Published CVEs affecting SourceCodester products: 484 record(s), with severity, exploitation and fixes.
Class and Exam Timetabling System 59Pharmacy Sales and Inventory System 30Pizzafy Ecommerce System 27Sales and Inventory System 21Hotel and Lodge Management System 15Pet Grooming Management Software 14Patients Waiting Area Queue Management System 13Simple Online Food Ordering System 13Drug Recommendation System 11Hospitals Patient Records Management System 8CET Automated Grading System with AI Predictive Analytics 8Inventory Management System 8Student Grades Management System 7Syllabus-Aligned Learning Management & Examination System 7Onlne Examination & Learning Management System 7Simple Doctors Appointment System 6Performance Indicator System 6Simple and Nice Shopping Cart Script 6Best House Rental Management System 6Multi-Vendor Online Grocery Management System 6Photo Share Website 5SUP Online Shopping 5Online Food Ordering System 5Student Result Management System 5Client Database Management System 5Online Book Store System 5Farm Management System 5Web-based Pharmacy Product Management System 4Indian Invoicing System 4Simple Responsive Tourism Website 4Simple POS and Inventory System 4Resort Reservation System 4Best Salon Management System 4School Registration and Fee System 4Online Faculty Clearance System 4Train Station Ticketing System 4Food Ordering System 3Leave Application System 3Simple Traffic Offense System 3Ship Ferry Ticket Reservation System 3
CVE-2026-75080
High · 7.3
CWE-74 Aug 17, 2026
SourceCodester Class and Exam Timetabling System edit_subject1.php sql injection
A security vulnerability has been detected in SourceCodester Class and Exam Timetabling System 1.0. This issue affects some unknown processing of the file /edit_subject1.php. The manipulation of the argument ID leads to sql injection. The attack is possible to be carried out remotely. The exploit has been disclosed publicly and may be used.
CVE-2026-75079
High · 7.3
CWE-74 Aug 17, 2026
SourceCodester Class and Exam Timetabling System edit_subject2.php sql injection
A weakness has been identified in SourceCodester Class and Exam Timetabling System 1.0. This vulnerability affects unknown code of the file /edit_subject2.php. Executing a manipulation of the argument ID can lead to sql injection. The attack can be executed remotely. The exploit has been made available to the public and could be used for attacks.
CVE-2026-75078
Medium · 4.3
CWE-79 Aug 17, 2026
SourceCodester Class and Exam Timetabling System BSHRM1.php cross site scripting
A security flaw has been discovered in SourceCodester Class and Exam Timetabling System 1.0. This affects an unknown part of the file /BSHRM1.php. Performing a manipulation of the argument course results in cross site scripting. Remote exploitation of the attack is possible. The exploit has been released to the public and may be used for attacks.
CVE-2026-75077
Medium · 4.3
CWE-79 Aug 17, 2026
SourceCodester Class and Exam Timetabling System BSCE2.php cross site scripting
A vulnerability was identified in SourceCodester Class and Exam Timetabling System 1.0. Affected by this issue is some unknown functionality of the file /BSCE2.php. Such manipulation of the argument course leads to cross site scripting. The attack may be launched remotely. The exploit is publicly available and might be used.
CVE-2026-75014
High · 7.3
CWE-74 Aug 17, 2026
SourceCodester Pet Grooming Management Software get_barcode_data.php sql injection
A flaw has been found in SourceCodester Pet Grooming Management Software 1.0. This vulnerability affects unknown code of the file /admin/get_barcode_data.php. This manipulation of the argument barcode causes sql injection. The attack may be initiated remotely. The exploit has been published and may be used.
CVE-2026-19987
Medium · 5.3
CWE-548 Aug 17, 2026
SourceCodester Best Employee Management System Profile exposure of information through directory listing
A security vulnerability has been detected in SourceCodester Best Employee Management System 1.0. This affects an unknown function of the file /assets/uploadImage/Profile/. Such manipulation leads to exposure of information through directory listing. It is possible to launch the attack remotely.
CVE-2026-19925
Medium · 4.7
CWE-74 Aug 15, 2026
SourceCodester Stock Management System Master.php delete_supplier sql injection
A vulnerability was detected in SourceCodester Stock Management System 1.0. This issue affects some unknown processing of the file /classes/Master.php?f=delete_supplier. The manipulation of the argument ID results in sql injection. The attack may be launched remotely. The exploit is now public and may be used.
CVE-2026-19904
Low · 2.4
CWE-79 Aug 15, 2026
SourceCodester Online Book Store System System Settings index.php site_settings cross site scripting
A vulnerability was found in SourceCodester Online Book Store System 1.0. This vulnerability affects unknown code of the file /admin/index.php?page=site_settings of the component System Settings Module. The manipulation results in cross site scripting. The attack can be executed remotely. The exploit has been made public and could be used.
CVE-2026-19903
Medium · 5.3
CWE-425 Aug 15, 2026
SourceCodester Online Clothing Store SQL Database Backup shopping.sql file access
A vulnerability has been found in SourceCodester Online Clothing Store 1.0. This affects an unknown part of the file /db/shopping.sql of the component SQL Database Backup. The manipulation leads to files or directories accessible. Remote exploitation of the attack is possible. The exploit has been disclosed to the public and may be used.
CVE-2026-19899
High · 7.3
CWE-74 Aug 15, 2026
SourceCodester Class and Exam Timetabling System edit_teacher.php sql injection
A vulnerability was determined in SourceCodester Class and Exam Timetabling System 1.0. The affected element is an unknown function of the file /edit_teacher.php. Executing a manipulation of the argument ID can lead to sql injection. The attack may be performed from remote. The exploit has been publicly disclosed and may be utilized.
CVE-2026-19839
Medium · 4.7
CWE-284 Aug 14, 2026
SourceCodester Simple Doctors Appointment System save_file.php save_doctor unrestricted upload
A vulnerability was detected in SourceCodester Simple Doctors Appointment System 1.0. This issue affects the function save_doctor of the file /save_file.php. The manipulation results in unrestricted upload. The attack can be executed remotely. The exploit is now public and may be used.
CVE-2026-19825
High · 7.3
CWE-74 Aug 14, 2026
SourceCodester Simple Client Management System Master.php save_service sql injection
A security vulnerability has been detected in SourceCodester Simple Client Management System 1.0. The impacted element is an unknown function of the file /classes/Master.php?f=save_service. The manipulation of the argument ID leads to sql injection. The attack is possible to be carried out remotely. The exploit has been disclosed publicly and may be used.
CVE-2026-19787
Medium · 4.7
CWE-74 Aug 14, 2026
SourceCodester Air Cargo Management System Master.php save_cargo_type sql injection
A vulnerability was determined in SourceCodester Air Cargo Management System 1.0. Impacted is an unknown function of the file /classes/Master.php?f=save_cargo_type. Executing a manipulation of the argument ID can lead to sql injection. The attack can be executed remotely. The exploit has been publicly disclosed and may be utilized.
CVE-2026-19384
High · 7.3
CWE-74 Aug 10, 2026
SourceCodester Simple Doctors Appointment System ajax.php set_appointment sql injection
A weakness has been identified in SourceCodester Simple Doctors Appointment System 1.0. The affected element is an unknown function of the file /admin/ajax.php?action=set_appointment. This manipulation of the argument ID causes sql injection. The attack may be initiated remotely. The exploit has been made available to the public and could be used for attacks.
CVE-2026-19231
High · 7.3
CWE-74 Aug 7, 2026
SourceCodester Simple Doctors Appointment System ajax.php delete_appointment sql injection
A security flaw has been discovered in SourceCodester Simple Doctors Appointment System 1.0. This vulnerability affects unknown code of the file /admin/ajax.php?action=delete_appointment. The manipulation of the argument ID results in sql injection. The attack may be launched remotely. The exploit has been released to the public and may be used for attacks.
CVE-2026-19230
Low · 3.5
CWE-79 Aug 7, 2026
SourceCodester Photo Share Website Comment Input Box ajax.php save_upload cross site scripting
A vulnerability was identified in SourceCodester Photo Share Website 1.0. This affects an unknown part of the file /social/ajax.php?action=save_upload of the component Comment Input Box. The manipulation of the argument content leads to cross site scripting. The attack may be initiated remotely. The exploit is publicly available and might be used.
CVE-2026-19211
High · 7.3
CWE-74 Aug 7, 2026
SourceCodester Photo Share Website ajax.php signup sql injection
A vulnerability was found in SourceCodester Photo Share Website 1.0. This affects an unknown function of the file /social/ajax.php?action=signup. Performing a manipulation of the argument email results in sql injection. Remote exploitation of the attack is possible. The exploit has been made public and could be used.
CVE-2026-19210
Medium · 6.3
CWE-284 Aug 7, 2026
SourceCodester Photo Share Website ajax.php save_upload unrestricted upload
A vulnerability has been found in SourceCodester Photo Share Website 1.0. The impacted element is an unknown function of the file /social/ajax.php?action=save_upload. Such manipulation of the argument img[]/imgName[] leads to unrestricted upload. The attack may be launched remotely. The exploit has been disclosed to the public and may be used.
CVE-2026-19209
Low · 3.5
CWE-79 Aug 7, 2026
SourceCodester Photo Share Website index.php home cross site scripting
A flaw has been found in SourceCodester Photo Share Website 1.0. The affected element is an unknown function of the file /social/index.php?page=home. This manipulation of the argument Comment causes cross site scripting. The attack may be initiated remotely. The exploit has been published and may be used.
CVE-2026-19196
High · 7.3
CWE-74 Aug 7, 2026
SourceCodester Photo Share Website ajax.php login sql injection
A vulnerability was found in SourceCodester Photo Share Website 1.0. The impacted element is an unknown function of the file /social/ajax.php?action=login. The manipulation of the argument email results in sql injection. The attack can be launched remotely. The exploit has been made public and could be used.
CVE-2026-19066
Medium · 4.3
CWE-285 Aug 6, 2026
SourceCodester Online Examination & Learning Management System view_students.php authorization
A vulnerability was identified in SourceCodester Online Examination & Learning Management System 1.0. Impacted is an unknown function of the file view_students.php. Such manipulation of the argument class_group leads to authorization bypass. The attack may be launched remotely.
CVE-2026-19064
Medium · 4.3
CWE-285 Aug 6, 2026
SourceCodester Online Examination & Learning Management System view.php authorization
A vulnerability was found in SourceCodester Online Examination & Learning Management System 1.0. This vulnerability affects unknown code of the file /view.php. The manipulation of the argument ID results in authorization bypass. The attack can be launched remotely.
CVE-2026-19021
High · 7.3
CWE-74 Aug 6, 2026
SourceCodester Computer Repair Shop Management System Master.php delete_product sql injection
A security vulnerability has been detected in SourceCodester Computer Repair Shop Management System 1.0. Affected by this issue is some unknown functionality of the file /classes/Master.php?f=delete_product. Such manipulation of the argument ID leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed publicly and may be used.
CVE-2026-16486
Medium · 4.3
CWE-79 Jul 21, 2026
SourceCodester Class and Exam Timetabling System BSIS.php cross site scripting
A vulnerability was found in SourceCodester Class and Exam Timetabling System 1.0. This affects an unknown part of the file /BSIS.php. Performing a manipulation of the argument day results in cross site scripting. The attack may be initiated remotely. The exploit has been made public and could be used.
CVE-2026-16485
Medium · 4.3
CWE-79 Jul 21, 2026
SourceCodester Class and Exam Timetabling System class.php cross site scripting
A vulnerability has been found in SourceCodester Class and Exam Timetabling System 1.0. Affected by this issue is some unknown functionality of the file /class.php. Such manipulation of the argument day leads to cross site scripting. The attack can be launched remotely. The exploit has been disclosed to the public and may be used.