sourcecodester vulnerabilities

By year

Bars are flaws published each year; the red part is the share attackers have used.

Latest high and critical flaws

• CVE-2025-3096 Clinic’s Patient Management System versions 2.0 suffers from a SQL injection vulnerability in the login page.Critical 9.3 · Apr 1, 2025
• CVE-2024-48594 File Upload vulnerability in Prison Management System v.1.0 allows a remote attacker to execute arbitrary code via the file upload component.High 8.8 · Oct 28, 2024
• CVE-2024-44812 SQL Injection vulnerability in Online Complaint Site v.1.0 allows a remote attacker to escalate privileges via the username and password parameters in the /admiCritical 9.8 · Oct 22, 2024
• CVE-2024-46377 Best House Rental Management System 1.0 contains an arbitrary file upload vulnerability in the save_settings() function of the file rental/admin_class.php.Critical 9.8 · Sep 18, 2024
• CVE-2024-37857 SQL Injection vulnerability in Lost and Found Information System 1.0 allows a remote attacker to escalate privileges via id parameter to php-lfis/admin/categoriHigh 8.8 · Jul 29, 2024
• CVE-2024-40394 Simple Library Management System Project Using PHP/MySQL v1.0 was discovered to contain an arbitrary file upload vulnerability via the component ajax.php.Critical 9.8 · Jul 16, 2024
• CVE-2024-34224 Cross Site Scripting vulnerability in /php-lms/classes/Users.php?f=save in Computer Laboratory Management System using PHP and MySQL 1.0 allow remote attackers High 7.3 · May 14, 2024
• CVE-2024-33294 An issue in Library System using PHP/MySQli with Source Code V1.0 allows a remote attacker to execute arbitrary code via the _FAILE variable in the student_editCritical 9.1 · May 6, 2024
• CVE-2024-31545 Computer Laboratory Management System v1.0 is vulnerable to SQL Injection via the "id" parameter of /admin/?page=user/manage_user&id=6.Critical 9.4 · Apr 22, 2024
• CVE-2024-31546 Computer Laboratory Management System v1.0 is vulnerable to SQL Injection via the "id" parameter of /admin/damage/view_damage.php.Critical 9.8 · Apr 19, 2024
• CVE-2023-49982 Broken access control in the component /admin/management/users of School Fees Management System v1.0 allows attackers to escalate privileges and perform AdminisHigh 8.8 · Mar 20, 2024
• CVE-2023-49981 A directory listing vulnerability in School Fees Management System v1.0 allows attackers to list directories and sensitive files within the application without High 7.5 · Mar 20, 2024
• CVE-2023-49980 A directory listing vulnerability in Best Student Result Management System v1.0 allows attackers to list directories and sensitive files within the application High 7.5 · Mar 20, 2024
• CVE-2023-49979 A directory listing vulnerability in Customer Support System v1 allows attackers to list directories and sensitive files within the application without requirinHigh 7.5 · Mar 20, 2024
• CVE-2023-49978 Incorrect access control in Customer Support System v1 allows non-administrator users to access administrative pages and execute actions reserved for administraHigh 8.8 · Mar 20, 2024
• CVE-2024-28303 Open Source Medicine Ordering System v1.0 was discovered to contain a SQL injection vulnerability via the date parameter at /admin/reports/index.php.Critical 9.8 · Mar 19, 2024
• CVE-2023-49970 Customer Support System v1 was discovered to contain a SQL injection vulnerability via the subject parameter at /customer_support/ajax.php?action=save_ticket.Critical 9.8 · Mar 4, 2024
• CVE-2023-49968 Customer Support System v1 was discovered to contain a SQL injection vulnerability via the id parameter at /customer_support/manage_department.php.High 7.3 · Mar 4, 2024
• CVE-2023-49548 Customer Support System v1 was discovered to contain a SQL injection vulnerability via the lastname parameter at /customer_support/ajax.php?action=save_user.High 8.8 · Mar 4, 2024
• CVE-2023-49547 Customer Support System v1 was discovered to contain a SQL injection vulnerability via the username parameter at /customer_support/ajax.php?action=login.Critical 9.8 · Mar 4, 2024
• CVE-2023-49546 Customer Support System v1 was discovered to contain a SQL injection vulnerability via the email parameter at /customer_support/ajax.php.High 8.8 · Mar 4, 2024
• CVE-2024-27747 File Upload vulnerability in Petrol Pump Mangement Software v.1.0 allows an attacker to execute arbitrary code via a crafted payload to the email Image parameteCritical 9.8 · Mar 1, 2024
• CVE-2024-27746 SQL Injection vulnerability in Petrol Pump Mangement Software v.1.0 allows an attacker to execute arbitrary code via a crafted payload to the email address paraCritical 9.8 · Mar 1, 2024
• CVE-2023-49545 A directory listing vulnerability in Customer Support System v1 allows attackers to list directories and sensitive files within the application without requirinHigh 7.5 · Mar 1, 2024