Vulnerabilidades de Itsourcecode
CVEs publicadas que afetam produtos de Itsourcecode: 381 registro(s), com severidade, exploração e correções.
Hospital Management System 50Sales and Inventory System 34Student Management System 24School Management System 17Society Management System 15Construction Management System 12Online Medicine Delivery System 11University Management System 11Leave Management System 11College Management System 10COVID Tracking System 9Online Admission System 9Fees Management System 9Courier Management System 8Online Cake Ordering System 8Electronic Judging System 7Inventory Management System 7Payroll Management System 7Open Source Job Portal 7Free Hotel Reservation System 7Online Frozen Foods Ordering System 7Online Hotel Management System 7Online Enrollment System 6Event Management System 6Online Loan Management System 5News Portal Project 5Content Management System 5Web-based Internet Laboratory Management System 5Document Management System 4Student Transcript Processing System 4Baptism Information Management System 4Online Student Enrollment System 4Online Voting System 4Payroll System 3Sanitize Or Validate This Input 3Online Pet Shop Management System 3Online Doctor Appointment System 3Student Information System 3Online House Rental System 3Pet Shop Management System 2
CVE-2026-3135
Crítica · 9.8
CWE-89 24/02/2026
itsourcecode News Portal Project add-category.php sql injection
A weakness has been identified in itsourcecode News Portal Project 1.0. The impacted element is an unknown function of the file /admin/add-category.php. This manipulation of the argument Category causes sql injection. It is possible to initiate the attack remotely. The exploit has been made available to the public and could be used for attacks.
CVE-2026-3134
Crítica · 9.8
CWE-89 24/02/2026
itsourcecode News Portal Project edit-category.php sql injection
A security flaw has been discovered in itsourcecode News Portal Project 1.0. The affected element is an unknown function of the file /newsportal/admin/edit-category.php. The manipulation of the argument Category results in sql injection. The attack may be performed from remote. The exploit has been released to the public and may be used for attacks.
CVE-2026-3133
Crítica · 9.8
CWE-89 24/02/2026
itsourcecode Document Management System Login loging.php sql injection
A vulnerability has been found in itsourcecode Document Management System 1.0. This issue affects some unknown processing of the file /loging.php of the component Login. The manipulation of the argument Username leads to sql injection. Remote exploitation of the attack is possible. The exploit has been disclosed to the public and may be used.
CVE-2026-3069
Crítica · 9.8
CWE-89 24/02/2026
itsourcecode Document Management System edtlbls.php sql injection
A security vulnerability has been detected in itsourcecode Document Management System 1.0. Affected is an unknown function of the file /edtlbls.php. The manipulation of the argument field1 leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed publicly and may be used.
CVE-2026-3068
Crítica · 9.8
CWE-89 24/02/2026
itsourcecode Document Management System deluser.php sql injection
A weakness has been identified in itsourcecode Document Management System 1.0. This impacts an unknown function of the file /deluser.php. Executing a manipulation of the argument user2del can lead to sql injection. The attack can be launched remotely. The exploit has been made available to the public and could be used for attacks.
CVE-2026-3046
Crítica · 9.8
CWE-89 23/02/2026
itsourcecode E-Logbook with Health Monitoring System for COVID-19 check_profile_old.php sql injection
A security vulnerability has been detected in itsourcecode E-Logbook with Health Monitoring System for COVID-19 1.0. This vulnerability affects unknown code of the file /check_profile_old.php. The manipulation of the argument profile_id leads to sql injection. Remote exploitation of the attack is possible. The exploit has been disclosed publicly and may be used.
CVE-2026-3043
Média · 6.1
CWE-79 23/02/2026
itsourcecode Event Management System navbar.php cross site scripting
A flaw has been found in itsourcecode Event Management System 1.0. The impacted element is an unknown function of the file /admin/navbar.php. Executing a manipulation of the argument page can lead to cross site scripting. The attack may be performed from remote. The exploit has been published and may be used.
CVE-2026-3042
Crítica · 9.8
CWE-74 23/02/2026
itsourcecode Event Management System index.php sql injection
A vulnerability was detected in itsourcecode Event Management System 1.0. The affected element is an unknown function of the file /admin/index.php. Performing a manipulation of the argument ID results in sql injection. The attack is possible to be carried out remotely. The exploit is now public and may be used.
CVE-2026-2939
Média · 4.8
CWE-79 22/02/2026
itsourcecode Student Management System Add Student add_student cross site scripting
A vulnerability was found in itsourcecode Student Management System 1.0. The impacted element is an unknown function of the file /add_student/ of the component Add Student Module. The manipulation results in cross site scripting. It is possible to launch the attack remotely. The exploit has been made public and could be used.
CVE-2026-2867
Crítica · 9.8
CWE-74 21/02/2026
itsourcecode Vehicle Management System billaction.php sql injection
A vulnerability was determined in itsourcecode Vehicle Management System 1.0. Affected is an unknown function of the file /billaction.php. Executing a manipulation of the argument ID can lead to sql injection. The attack may be launched remotely. The exploit has been publicly disclosed and may be utilized.
CVE-2026-2865
Crítica · 9.8
CWE-89 21/02/2026
itsourcecode Agri-Trading Online Shopping System HTTP POST Request productcontroller.php sql injection
A vulnerability was found in itsourcecode Agri-Trading Online Shopping System 1.0. This impacts an unknown function of the file admin/productcontroller.php of the component HTTP POST Request Handler. Performing a manipulation of the argument Product results in sql injection. The attack may be initiated remotely. The exploit has been made public and could be used.
CVE-2026-2691
Crítica · 9.8
CWE-89 19/02/2026
itsourcecode Event Management System manage_register.php sql injection
A vulnerability has been found in itsourcecode Event Management System 1.0. Affected by this issue is some unknown functionality of the file /admin/manage_register.php. Such manipulation of the argument ID leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.
CVE-2026-2690
Crítica · 9.8
CWE-89 19/02/2026
itsourcecode Event Management System Admin Login ajax.php sql injection
A flaw has been found in itsourcecode Event Management System 1.0. Affected by this vulnerability is an unknown functionality of the file /admin/ajax.php?action=login of the component Admin Login. This manipulation of the argument Username causes sql injection. It is possible to initiate the attack remotely. The exploit has been published and may be used.
CVE-2026-2689
Crítica · 9.8
CWE-89 19/02/2026
itsourcecode Event Management System manage_booking.php sql injection
A vulnerability was detected in itsourcecode Event Management System 1.0. Affected is an unknown function of the file /admin/manage_booking.php. The manipulation of the argument ID results in sql injection. The attack may be performed from remote. The exploit is now public and may be used.
CVE-2026-2225
Crítica · 9.8
CWE-89 09/02/2026
Injeção de SQL no login administrativo do News Portal Project 1.0
Foi encontrada uma falha no itsourcecode News Portal Project 1.0. Essa vulnerabilidade afeta trecho de código desconhecido do arquivo /admin/index.php do componente Administrator Login. A manipulação do argumento email causa injeção de SQL. O ataque pode ser iniciado remotamente. O exploit foi publicado e pode ser utilizado.
CVE-2026-2217
Crítica · 9.8
CWE-89 09/02/2026
Injeção de SQL no Event Management System 1.0 da itsourcecode
Foi encontrada uma vulnerabilidade no itsourcecode Event Management System 1.0. O elemento afetado é uma função desconhecida do arquivo /admin/manage_user.php. A manipulação do argumento ID resulta em injeção de SQL. O ataque pode ser realizado remotamente. O exploit foi tornado público e pode ser utilizado.
CVE-2026-2190
Crítica · 9.8
CWE-89 08/02/2026
Injeção de SQL no itsourcecode School Management System 1.0
Foi identificada uma falha de segurança no itsourcecode School Management System 1.0. Ela afeta uma função não identificada do arquivo /ramonsys/user/controller.php. A manipulação do argumento ID resulta em injeção de SQL. O ataque pode ser lançado remotamente. O exploit foi divulgado publicamente e pode ser usado em ataques.
CVE-2026-2189
Crítica · 9.8
CWE-74 08/02/2026
Injeção de SQL no itsourcecode School Management System
Foi identificada uma vulnerabilidade no itsourcecode School Management System 1.0. Ela afeta uma função desconhecida do arquivo /ramonsys/report/index.php. A manipulação do argumento ay leva a injeção de SQL. O ataque pode ser iniciado remotamente. O exploit está publicamente disponível e pode ser utilizado.
CVE-2026-2162
Alta · 7.2
CWE-74 08/02/2026
itsourcecode News Portal Project aboutus.php sql injection
A vulnerability was determined in itsourcecode News Portal Project 1.0. This affects an unknown part of the file /admin/aboutus.php. This manipulation of the argument pagetitle causes sql injection. The attack may be initiated remotely. The exploit has been publicly disclosed and may be utilized.
CVE-2026-2161
Crítica · 9.8
CWE-74 08/02/2026
Injeção de SQL no forget-password.php do itsourcecode Directory Management System 1.0
Foi identificada uma vulnerabilidade no itsourcecode Directory Management System 1.0. Afeta uma funcionalidade não especificada do arquivo /admin/forget-password.php. A manipulação do argumento email resulta em injeção de SQL. O ataque pode ser realizado remotamente. O exploit foi tornado público e pode ser utilizado.
CVE-2026-2117
Crítica · 9.8
CWE-74 07/02/2026
Injeção de SQL no Society Management System 1.0 da itsourcecode
Foi identificada uma vulnerabilidade no itsourcecode Society Management System 1.0. O elemento afetado é uma função desconhecida do arquivo /admin/edit_activity.php. Ao manipular o argumento activity_id, ocorre injeção de SQL. O ataque pode ser iniciado remotamente. O exploit foi tornado público e pode ser utilizado.
CVE-2026-2116
Crítica · 9.8
CWE-74 07/02/2026
itsourcecode Society Management System: injeção de SQL em edit_expenses.php
Foi encontrada uma vulnerabilidade no itsourcecode Society Management System 1.0. Afetada está uma função desconhecida do arquivo /admin/edit_expenses.php. Tal manipulação do argumento expenses_id leva a injeção de SQL. É possível lançar o ataque remotamente. O exploit foi divulgado publicamente e pode ser usado.
CVE-2026-2115
Crítica · 9.8
CWE-74 07/02/2026
Injeção de SQL no Society Management System 1.0 da itsourcecode em delete_expenses.php
Foi identificada uma falha no itsourcecode Society Management System 1.0. Ela afeta algum processamento desconhecido do arquivo /admin/delete_expenses.php. Essa manipulação do argumento expenses_id causa injeção de SQL. É possível iniciar o ataque remotamente. O exploit foi publicado e pode ser utilizado.
CVE-2026-2114
Crítica · 9.8
CWE-74 07/02/2026
itsourcecode Society Management System - Injeção de SQL via admin_id (CVE-2026-2114)
Foi detectada uma vulnerabilidade no itsourcecode Society Management System 1.0. Ela afeta código não especificado do arquivo /admin/edit_admin.php. A manipulação do argumento admin_id resulta em injeção de SQL. O ataque pode ser realizado remotamente. O exploit está agora público e pode ser utilizado.
CVE-2026-2073
Crítica · 9.8
CWE-89 07/02/2026
Injeção de SQL no School Management System da itsourcecode (CVE-2026-2073)
Foi identificada uma vulnerabilidade no itsourcecode School Management System 1.0. Ela afeta uma função desconhecida do arquivo /ramonsys/user/index.php. A manipulação do argumento ID pode levar a injeção de SQL. O ataque pode ser realizado remotamente. O exploit foi divulgado publicamente e pode ser utilizado.