Vulnerabilidades de Code-projects
CVEs publicadas que afetam produtos de Code-projects: 561 registro(s), com severidade, exploração e correções.
Online Music Site 23Simple Laundry System 21Employee Management System 17Simple Food Ordering System 16Online Reviewer System 15E-Commerce Website 13Online Product Reservation System 13Student File Management System 13Vehicle Showroom Management System 12Refugee Food Management System 12Assessment Management 10Simple IT Discussion Forum 10Online Shopping System 10Simple Flight Ticket Booking System 10Real State Services 9Exam Form Submission 8Intern Membership Management System 8Student Information System 8Invoice System in Laravel 7Client Details System 7Task Management System 7Content Management System 6Online Food Ordering System 6Online Hospital Management System 6Accounting System 6Simple Stock System 6Nero Social Networking Site 6Responsive Hotel Site 6Online Event Judging System 6Simple Scheduling System 6Hospital Information System 6Hotel and Tourism Reservation 6Employee Profile Management System 5Online Examination System 5Courier Management System 5Online Complaint Site 5Internship Management System 5Online Job Portal 5Patient Record Management System 4Student Membership System 4
CVE-2025-14205
Média · 5.4
CWE-79 07/12/2025
code-projects Chamber of Commerce Membership Management System Your Info membership_profile.php cross site scripting
A vulnerability was found in code-projects Chamber of Commerce Membership Management System 1.0. Impacted is an unknown function of the file /membership_profile.php of the component Your Info Handler. Performing manipulation of the argument Full Name/Address/City/State results in cross site scripting. The attack is possible to be carried out remotely. The exploit has been made public and could be used.
CVE-2025-14203
Alta · 8.8
CWE-89 07/12/2025
code-projects Question Paper Generator selectquestionuser.php sql injection
A flaw has been found in code-projects Question Paper Generator up to 1.0. This vulnerability affects unknown code of the file /selectquestionuser.php. This manipulation of the argument subid causes sql injection. Remote exploitation of the attack is possible. The exploit has been published and may be used.
CVE-2025-14195
Alta · 8.8
CWE-284 07/12/2025
code-projects Employee Profile Management System add_file_query.php unrestricted upload
A security flaw has been discovered in code-projects Employee Profile Management System 1.0. Impacted is an unknown function of the file /profiling/add_file_query.php. The manipulation of the argument per_file results in unrestricted upload. The attack may be launched remotely. The exploit has been released to the public and may be used for attacks.
CVE-2025-14194
Média · 5.4
CWE-79 07/12/2025
code-projects Employee Profile Management System view_personnel.php cross site scripting
A vulnerability was identified in code-projects Employee Profile Management System 1.0. This issue affects some unknown processing of the file /view_personnel.php. The manipulation of the argument per_address/dr_school/other_school leads to cross site scripting. The attack may be initiated remotely. The exploit is publicly available and might be used.
CVE-2025-14193
Alta · 8.8
CWE-89 07/12/2025
code-projects Employee Profile Management System view_personnel.php sql injection
A vulnerability was determined in code-projects Employee Profile Management System 1.0. This vulnerability affects unknown code of the file /view_personnel.php. Executing a manipulation of the argument per_id can lead to sql injection. The attack can be launched remotely. The exploit has been publicly disclosed and may be utilized.
CVE-2025-13583
Crítica · 9.8
CWE-89 24/11/2025
code-projects Question Paper Generator POST Parameter signupscript.php sql injection
A weakness has been identified in code-projects Question Paper Generator 1.0. This affects an unknown part of the file /signupscript.php of the component POST Parameter Handler. Executing manipulation of the argument Fname can lead to sql injection. The attack can be executed remotely. The exploit has been made available to the public and could be exploited.
CVE-2025-13582
Crítica · 9.8
CWE-89 24/11/2025
code-projects Jonnys Liquor GET Parameter detail.php sql injection
A security flaw has been discovered in code-projects Jonnys Liquor 1.0. Affected by this issue is some unknown functionality of the file /detail.php of the component GET Parameter Handler. Performing manipulation of the argument Product results in sql injection. Remote exploitation of the attack is possible. The exploit has been released to the public and may be exploited.
CVE-2025-13580
Alta · 8.8
CWE-89 24/11/2025
code-projects Library System mail.php sql injection
A vulnerability was determined in code-projects Library System 1.0. Affected is an unknown function of the file /mail.php. This manipulation of the argument ID causes sql injection. The attack may be initiated remotely. The exploit has been publicly disclosed and may be utilized.
CVE-2025-13579
Alta · 8.8
CWE-89 24/11/2025
code-projects Library System return.php sql injection
A vulnerability was found in code-projects Library System 1.0. This impacts an unknown function of the file /return.php. The manipulation of the argument ID results in sql injection. The attack can be launched remotely. The exploit has been made public and could be used.
CVE-2025-13578
Crítica · 9.8
CWE-89 24/11/2025
code-projects Library System Login index.php sql injection
A vulnerability has been found in code-projects Library System 1.0. This affects an unknown function of the file /index.php of the component Login. The manipulation of the argument Username leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.
CVE-2025-13576
Alta · 8.8
CWE-266 23/11/2025
code-projects Blog Site admin.php improper authorization
A vulnerability was detected in code-projects Blog Site 1.0. The affected element is an unknown function of the file /admin.php. Performing manipulation results in improper authorization. It is possible to initiate the attack remotely. The exploit is now public and may be used. Multiple endpoints are affected.
CVE-2025-13575
Alta · 8.8
CWE-89 23/11/2025
code-projects Blog Site Category blog.php category_exists sql injection
A security vulnerability has been detected in code-projects Blog Site 1.0. Impacted is the function category_exists of the file /resources/functions/blog.php of the component Category Handler. Such manipulation of the argument name/field leads to sql injection. The attack may be performed from remote. The exploit has been disclosed publicly and may be used. Multiple endpoints are affected.
CVE-2025-13574
Alta · 7.2
CWE-434 23/11/2025
code-projects Online Bidding System addcategory.php categoryadd unrestricted upload
A weakness has been identified in code-projects Online Bidding System 1.0. This issue affects the function categoryadd of the file /administrator/addcategory.php. This manipulation of the argument catimage causes unrestricted upload. The attack is possible to be carried out remotely. The exploit has been made available to the public and could be exploited.
CVE-2025-13571
Alta · 8.8
CWE-89 23/11/2025
code-projects Simple Food Ordering System listorder.php sql injection
A vulnerability was determined in code-projects Simple Food Ordering System 1.0. Affected by this issue is some unknown functionality of the file /listorder.php. Executing manipulation of the argument ID can lead to sql injection. The attack may be launched remotely. The exploit has been publicly disclosed and may be utilized.
CVE-2025-13449
Crítica · 9.8
CWE-89 20/11/2025
code-projects Online Shop Project login.php sql injection
A vulnerability was found in code-projects Online Shop Project 1.0. This issue affects some unknown processing of the file /login.php. The manipulation of the argument Password results in sql injection. The attack may be performed from remote. The exploit has been made public and could be used.
CVE-2025-13396
Crítica · 9.8
CWE-74 19/11/2025
code-projects Courier Management System add-office.php sql injection
A weakness has been identified in code-projects Courier Management System 1.0. This affects an unknown function of the file /add-office.php. This manipulation of the argument OfficeName causes sql injection. The attack may be initiated remotely. The exploit has been made available to the public and could be exploited.
CVE-2025-13323
Crítica · 9.8
CWE-89 17/11/2025
code-projects Simple Pizza Ordering System listorder.php sql injection
A security flaw has been discovered in code-projects Simple Pizza Ordering System 1.0. Affected is an unknown function of the file /listorder.php. Performing manipulation of the argument ID results in sql injection. The attack can be initiated remotely. The exploit has been released to the public and may be exploited.
CVE-2025-13303
Crítica · 9.8
CWE-89 17/11/2025
code-projects Courier Management System search-edit.php sql injection
A vulnerability was determined in code-projects Courier Management System 1.0. Affected by this issue is some unknown functionality of the file /search-edit.php. This manipulation of the argument Consignment causes sql injection. The attack can be initiated remotely. The exploit has been publicly disclosed and may be utilized.
CVE-2025-13302
Crítica · 9.8
CWE-89 17/11/2025
code-projects Courier Management System add-new-officer.php sql injection
A vulnerability was identified in code-projects Courier Management System 1.0. This affects an unknown part of the file /add-new-officer.php. Such manipulation of the argument ManagerName leads to sql injection. The attack can be launched remotely. The exploit is publicly available and might be used.
CVE-2025-13290
Alta · 8.8
CWE-89 17/11/2025
code-projects Simple Food Ordering System saveorder.php sql injection
A vulnerability has been found in code-projects Simple Food Ordering System 1.0. Affected by this issue is some unknown functionality of the file /saveorder.php. Such manipulation of the argument ID leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.
CVE-2025-13279
Alta · 8.8
CWE-89 17/11/2025
code-projects Nero Social Networking Site profilefriends.php sql injection
A vulnerability was found in code-projects Nero Social Networking Site 1.0. The affected element is an unknown function of the file /profilefriends.php. Performing manipulation of the argument ID results in sql injection. The attack may be initiated remotely. The exploit has been made public and could be used.
CVE-2025-13277
Crítica · 9.8
CWE-89 17/11/2025
code-projects Nero Social Networking Site friendsphoto.php sql injection
A flaw has been found in code-projects Nero Social Networking Site 1.0. This issue affects some unknown processing of the file /friendsphoto.php. This manipulation of the argument ID causes sql injection. The attack can be initiated remotely. The exploit has been published and may be used.
CVE-2025-13245
Média · 5.4
CWE-79 16/11/2025
code-projects Student Information System editprofile.php cross site scripting
A vulnerability was identified in code-projects Student Information System 2.0. The impacted element is an unknown function of the file /editprofile.php. Such manipulation leads to cross site scripting. It is possible to launch the attack remotely. The exploit is publicly available and might be used.
CVE-2025-13244
Média · 6.1
CWE-79 16/11/2025
code-projects Student Information System register.php cross site scripting
A vulnerability was determined in code-projects Student Information System 2.0. The affected element is an unknown function of the file /register.php. This manipulation causes cross site scripting. It is possible to initiate the attack remotely. The exploit has been publicly disclosed and may be utilized.
CVE-2025-13243
Alta · 8.8
CWE-89 16/11/2025
code-projects Student Information System editprofile.php sql injection
A vulnerability was found in code-projects Student Information System 2.0. Impacted is an unknown function of the file /editprofile.php. The manipulation results in sql injection. The attack may be performed from remote. The exploit has been made public and could be used.