SourceCodester

Exploited now

None of this vendor's CVEs are on CISA's known-exploited list.

Recent

• 5.3MediumOct 27, 2026SourceCodester Online Food Ordering SystemCVE-2026-116605A vulnerability was found in SourceCodester Online Food Ordering System 1.0. The impacted element is an unknown function of the file order.php. The manipulation of the argument price/title results in client-side enforcement of server-side security. It is possible to launch the attack remotely. The exploit has been made public and could be used.
• 6.5MediumOct 27, 2026SourceCodester Online Food Ordering System Auth bypass / access controlCVE-2026-116604A vulnerability has been found in SourceCodester Online Food Ordering System 1.0. The affected element is an unknown function of the file admin/delete_admin.php. The manipulation of the argument ID leads to missing authentication. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.
• 4.7MediumOct 27, 2026SourceCodester Online Food Ordering System Auth bypass / access controlCVE-2026-116603A flaw has been found in SourceCodester Online Food Ordering System 1.0. Impacted is an unknown function of the file admin/add_food.php. Executing a manipulation of the argument image can lead to unrestricted upload. The attack may be performed from remote. The exploit has been published and may be used.
• 6.5MediumOct 26, 2026SourceCodester Online Food Ordering System Path traversal / file handlingCVE-2026-116602A vulnerability was detected in SourceCodester Online Food Ordering System 1.0. This issue affects the function unlink of the file admin/delete.php. Performing a manipulation of the argument image_name results in path traversal. The attack is possible to be carried out remotely. The exploit is now public and may be used.
• 7.3HighOct 25, 2026SourceCodester Performance Indicator System Code / command injectionCVE-2026-116062A security flaw has been discovered in SourceCodester Performance Indicator System 1.0. This issue affects some unknown processing of the file /opils/staff/save_profile.php. The manipulation of the argument Contact results in sql injection. The attack may be launched remotely. The exploit has been released to the public and may be used for attacks.
• 7.3HighOct 25, 2026SourceCodester Performance Indicator System Code / command injectionCVE-2026-116061A vulnerability was identified in SourceCodester Performance Indicator System 1.0. This vulnerability affects unknown code of the file /opils/staff/edit_dealer.php. The manipulation of the argument Contact leads to sql injection. The attack may be initiated remotely. The exploit is publicly available and might be used.
• 7.3HighOct 25, 2026SourceCodester Performance Indicator System Code / command injectionCVE-2026-116060A vulnerability was determined in SourceCodester Performance Indicator System 1.0. This affects an unknown part of the file /opils/staff/adddealer.php. Executing a manipulation of the argument Contact can lead to sql injection. The attack can be launched remotely. The exploit has been publicly disclosed and may be utilized.
• 6.3MediumOct 25, 2026SourceCodester Performance Indicator System Code / command injectionCVE-2026-116055A vulnerability was detected in SourceCodester Performance Indicator System 1.0. This impacts an unknown function of the file /opils/admin/deleteproduct.php. The manipulation of the argument ID results in sql injection. The attack may be performed from remote. The exploit is now public and may be used.
• 7.3HighOct 21, 2026SourceCodester Food Order Management System Auth bypass / access controlCVE-2026-114267A vulnerability was detected in SourceCodester Food Order Management System 1.0. Affected is an unknown function of the component Admin Endpoint. The manipulation results in missing authorization. The attack may be performed from remote. The exploit is now public and may be used.
• 7.3HighAug 7, 2026SourceCodester Simple Doctors Appointment System Code / command injectionCVE-2026-19231A security flaw has been discovered in SourceCodester Simple Doctors Appointment System 1.0. This vulnerability affects unknown code of the file /admin/ajax.php?action=delete_appointment. The manipulation of the argument ID results in sql injection. The attack may be launched remotely. The exploit has been released to the public and may be used for attacks.
• 3.5LowAug 7, 2026SourceCodester Photo Share Website XSSCVE-2026-19230A vulnerability was identified in SourceCodester Photo Share Website 1.0. This affects an unknown part of the file /social/ajax.php?action=save_upload of the component Comment Input Box. The manipulation of the argument content leads to cross site scripting. The attack may be initiated remotely. The exploit is publicly available and might be used.
• 5.3MediumAug 7, 2026SourceCodester Online Clothing Store Information disclosureCVE-2026-19229A vulnerability was determined in SourceCodester Online Clothing Store. Affected by this issue is some unknown functionality of the file /_notes/ of the component Dreamweaver Metadata Files. Executing a manipulation can lead to file and directory information exposure. The attack can be launched remotely. The exploit has been publicly disclosed and may be utilized.
• 7.3HighAug 7, 2026SourceCodester Photo Share Website Code / command injectionCVE-2026-19211A vulnerability was found in SourceCodester Photo Share Website 1.0. This affects an unknown function of the file /social/ajax.php?action=signup. Performing a manipulation of the argument email results in sql injection. Remote exploitation of the attack is possible. The exploit has been made public and could be used.
• 6.3MediumAug 7, 2026SourceCodester Photo Share Website Auth bypass / access controlCVE-2026-19210A vulnerability has been found in SourceCodester Photo Share Website 1.0. The impacted element is an unknown function of the file /social/ajax.php?action=save_upload. Such manipulation of the argument img[]/imgName[] leads to unrestricted upload. The attack may be launched remotely. The exploit has been disclosed to the public and may be used.
• 3.5LowAug 7, 2026SourceCodester Photo Share Website XSSCVE-2026-19209A flaw has been found in SourceCodester Photo Share Website 1.0. The affected element is an unknown function of the file /social/index.php?page=home. This manipulation of the argument Comment causes cross site scripting. The attack may be initiated remotely. The exploit has been published and may be used.
• 4.3MediumJul 13, 2026SourceCodester Online Book Store System Path traversal / file handlingCVE-2026-15540A vulnerability was detected in SourceCodester Online Book Store System 1.0. The affected element is an unknown function of the file /admin/index.php of the component Administrative Interface. Performing a manipulation of the argument page results in improper control of filename for include/require statement in php program. It is possible to initiate the attack remotely. The exploit is now public and may be used.
• 4.7MediumJul 13, 2026SourceCodester Online Book Store System Auth bypass / access controlCVE-2026-15539A security vulnerability has been detected in SourceCodester Online Book Store System 1.0. Impacted is an unknown function of the file /admin/index.php?page=books of the component Book Image Upload Feature. Such manipulation leads to unrestricted upload. The attack may be performed from remote. The exploit has been disclosed publicly and may be used.
• 7.3HighJul 13, 2026SourceCodester Online Book Store System Code / command injectionCVE-2026-15537A security flaw has been discovered in SourceCodester Online Book Store System 1.0. This vulnerability affects unknown code of the file admin/login.php. The manipulation of the argument Username results in sql injection. The attack can be executed remotely. The exploit has been released to the public and may be used for attacks.
• 2.4LowJul 13, 2026SourceCodester Online Book Store System XSSCVE-2026-15532A vulnerability was identified in SourceCodester Online Book Store System 1.0. This issue affects some unknown processing of the component User Management Module. Such manipulation of the argument Name/Username leads to cross site scripting. The attack can be executed remotely. The exploit is publicly available and might be used.
• 5.6MediumJul 3, 2026SourceCodester CET Automated Grading System with AI Predictive AnalyticsCVE-2026-14609A vulnerability was detected in SourceCodester CET Automated Grading System with AI Predictive Analytics 1.0. This issue affects some unknown processing. The manipulation results in session fixiation. The attack can be executed remotely. The attack requires a high level of complexity. The exploitability is assessed as difficult. The exploit is now public and may be used.
• 4.3MediumJul 3, 2026SourceCodester CET Automated Grading System with AI Predictive Analytics Auth bypass / access controlCVE-2026-14608A security vulnerability has been detected in SourceCodester CET Automated Grading System with AI Predictive Analytics 1.0. This vulnerability affects unknown code of the file /index.php?action=view_student of the component POST Handler. The manipulation of the argument ID leads to authorization bypass. Remote exploitation of the attack is possible. The exploit has been disclosed publicly and may be used.
• 5.3MediumJun 29, 2026SourceCodester Simple Food Ordering SystemCVE-2026-13571A flaw has been found in SourceCodester Simple Food Ordering System 1.0. The affected element is an unknown function of the file /cart.php. Executing a manipulation of the argument item_price can lead to business logic errors. The attack may be performed from remote. The exploit has been published and may be used.
• 3.5LowJun 29, 2026SourceCodester Inventory Management System XSSCVE-2026-13570A vulnerability was detected in SourceCodester Inventory Management System 1.0. Impacted is an unknown function of the file /api/users_handler.php of the component User Registration Endpoint. Performing a manipulation of the argument full_name results in cross site scripting. The attack is possible to be carried out remotely. The exploit is now public and may be used.
• 7.3HighJun 29, 2026SourceCodester Inventory Management System Privilege escalationCVE-2026-13568A weakness has been identified in SourceCodester Inventory Management System 1.0. This vulnerability affects unknown code of the file /api/users_handler.php of the component User Registration Endpoint. This manipulation of the argument role causes improper access controls. Remote exploitation of the attack is possible. The exploit has been made available to the public and could be used for attacks.
• 7.3HighJun 29, 2026SourceCodester Class and Exam Timetabling System Code / command injectionCVE-2026-13566A vulnerability was identified in SourceCodester Class and Exam Timetabling System 1.0. Affected by this issue is some unknown functionality of the file /preview3.php. The manipulation of the argument course_year_section leads to sql injection. The attack may be initiated remotely. The exploit is publicly available and might be used.
• 7.3HighJun 29, 2026SourceCodester Class and Exam Timetabling System Code / command injectionCVE-2026-13565A vulnerability was determined in SourceCodester Class and Exam Timetabling System 1.0/1.php. Affected by this vulnerability is an unknown functionality of the file /edit_class1.php. Executing a manipulation of the argument ID can lead to sql injection. The attack can be launched remotely. The exploit has been publicly disclosed and may be utilized.
• 2.4LowApr 28, 2026SourceCodester Pizzafy Ecommerce System XSSCVE-2026-7294A flaw has been found in SourceCodester Pizzafy Ecommerce System 1.0. Affected by this vulnerability is the function save_settings of the file /admin/index.php?page=save_settings. This manipulation of the argument Name causes cross site scripting. The attack may be initiated remotely. The exploit has been published and may be used.
• 4.7MediumApr 28, 2026SourceCodester Pizzafy Ecommerce System Code / command injectionCVE-2026-7293A vulnerability was detected in SourceCodester Pizzafy Ecommerce System 1.0. Affected is the function delete_category of the file /admin/ajax.php?action=delete_category. The manipulation of the argument ID results in sql injection. The attack can be launched remotely. The exploit is now public and may be used.
• 4.7MediumApr 28, 2026SourceCodester Pharmacy Sales and Inventory System Code / command injectionCVE-2026-7283A security flaw has been discovered in SourceCodester Pharmacy Sales and Inventory System 1.0. This impacts the function save_expired of the file /ajax.php?action=save_expired. The manipulation of the argument ID results in sql injection. It is possible to launch the attack remotely. The exploit has been released to the public and may be used for attacks.
• 4.7MediumApr 28, 2026SourceCodester Pharmacy Sales and Inventory System Code / command injectionCVE-2026-7282A vulnerability was identified in SourceCodester Pharmacy Sales and Inventory System 1.0. This affects the function delete_expired of the file /ajax.php?action=delete_expired. The manipulation of the argument ID leads to sql injection. It is possible to initiate the attack remotely. The exploit is publicly available and might be used.
• 2.4LowApr 28, 2026SourceCodester Pharmacy Sales and Inventory System XSSCVE-2026-7281A vulnerability was determined in SourceCodester Pharmacy Sales and Inventory System 1.0. The impacted element is the function supplier of the file /index.php?page=supplier. Executing a manipulation of the argument Name can lead to cross site scripting. The attack may be performed from remote. The exploit has been publicly disclosed and may be utilized.

See every SourceCodester entry on the dashboard.

Top products

• Photo Share Website4 CVEs in the last year
• Performance Indicator System4 CVEs in the last year
• Online Food Ordering System4 CVEs in the last year
• Online Book Store System4 CVEs in the last year
• Pharmacy Sales and Inventory System3 CVEs in the last year
• Pizzafy Ecommerce System2 CVEs in the last year
• Inventory Management System2 CVEs in the last year
• Class and Exam Timetabling System2 CVEs in the last year
• CET Automated Grading System with AI Predictive Analytics2 CVEs in the last year
• Simple Food Ordering System1 CVE in the last year