SourceCodester vulnerabilities
We track 1,410 vulnerabilities in SourceCodester products across 60+ products. 1,410 are rated high or critical, and none are known to be exploited. The most recent was published on November 13, 2026.
Latest SourceCodester vulnerabilities
- 7.2 High severity
Best Employee Management System: Unrestricted Upload of File with Dangerous Type
A vulnerability has been found in SourceCodester Best Employee Management System 1.0 and classified as critical. This vulnerability affects unknown code of the file /admin/profile.php. The manipulation of the argument website_image leads to unrestricted upload
- 7.2 High severity
Best Employee Management System: Improper Neutralization of Special Elements used in an SQL Command
A vulnerability, which was classified as critical, was found in SourceCodester Best Employee Management System 1.0. This affects an unknown part of the file /admin/edit_role.php. The manipulation of the argument id leads to sql injection. It is possible to ini
- 8.8 High severity
Best Employee Management System: Improper Neutralization of Special Elements used in an SQL Command
A vulnerability, which was classified as critical, has been found in SourceCodester Best Employee Management System 1.0. Affected by this issue is some unknown functionality of the file /admin/fetch_product_details.php. The manipulation of the argument barcode
- 8.1 High severity
Hospital Management System: Authorization Bypass Through User-Controlled Key
A vulnerability classified as problematic has been found in SourceCodester Hospital Management System 1.0. This affects an unknown part of the file /vm/patient/delete-account.php. The manipulation of the argument id leads to improper authorization. It is possi
- 9.8 Critical severity
Simple Music Cloud Community System: Unrestricted Upload of File with Dangerous Type
A vulnerability classified as critical was found in SourceCodester Simple Music Cloud Community System 1.0. This vulnerability affects unknown code of the file /music/ajax.php?action=signup. The manipulation of the argument pp leads to unrestricted upload. The
- 8.8 High severity
Online Veterinary Appointment System: Improper Neutralization of Special Elements used in an SQL Command
A vulnerability classified as critical was found in SourceCodester Online Veterinary Appointment System 1.0. This vulnerability affects unknown code of the file /admin/services/view_service.php. The manipulation of the argument id leads to sql injection. The a
- 7.8 High severity
Airport Booking Management System: Improper Restriction of Operations within the Bounds of a Memory Buffer
A vulnerability was found in SourceCodester Airport Booking Management System 1.0 and classified as critical. Affected by this issue is the function Details. The manipulation of the argument passport/name leads to buffer overflow. The attack needs to be approa
- 9.8 Critical severity
Kortex Lite Advocate Office Management System: Improper Neutralization of Special Elements used in an SQL Command
A vulnerability has been found in SourceCodester Kortex Lite Advocate Office Management System 1.0 and classified as critical. This vulnerability affects unknown code of the file /kortex_lite/control/edit_profile.php of the component POST Parameter Handler. Th
- 9.8 Critical severity
Attendance and Payroll System: Improper Neutralization of Special Elements used in an SQL Command
A vulnerability, which was classified as critical, has been found in SourceCodester Attendance and Payroll System 1.0. This issue affects some unknown processing of the file /admin/overtime_add.php. The manipulation of the argument id leads to sql injection. T
- 9.8 Critical severity
Attendance and Payroll System: Improper Neutralization of Special Elements used in an SQL Command
A vulnerability classified as critical was found in SourceCodester Attendance and Payroll System 1.0. This vulnerability affects unknown code of the file /admin/overtime_row.php. The manipulation of the argument id leads to sql injection. The attack can be ini
- 9.8 Critical severity
Attendance and Payroll System: Unrestricted Upload of File with Dangerous Type
A vulnerability classified as critical has been found in SourceCodester Attendance and Payroll System 1.0. This affects the function upload of the file /marimar/guest/update.php. The manipulation of the argument image leads to unrestricted upload. It is possib
- 9.8 Critical severity
Online Hotel Reservation System: Unrestricted Upload of File with Dangerous Type
A vulnerability, which was classified as critical, has been found in SourceCodester Online Hotel Reservation System 1.0. Affected by this issue is the function upload of the file /guest/update.php. The manipulation of the argument image leads to unrestricted u
- 7.2 High severity
Online Hotel Reservation System: Improper Neutralization of Special Elements used in an SQL Command
A vulnerability was found in SourceCodester Online Hotel Reservation System 1.0. It has been classified as critical. Affected is the function doCancelRoom/doCancel/doConfirm/doCancel/doCheckin/doCheckout of the file /marimar/admin/mod_room/controller.php. The
- 7.2 High severity
Online Hotel Reservation System: Unrestricted Upload of File with Dangerous Type
A vulnerability classified as critical was found in SourceCodester Online Hotel Reservation System 1.0. Affected by this vulnerability is the function upload of the file /admin/mod_room/controller.php?action=add. The manipulation of the argument image leads to
- 7.2 High severity
Petrol Pump Management Software: Improper Neutralization of Special Elements used in an SQL Command
A vulnerability, which was classified as critical, was found in SourceCodester Petrol Pump Management Software 1.0. This affects an unknown part of the file /admin/edit_customer.php. The manipulation of the argument id leads to sql injection. It is possible to
- 7.2 High severity
Petrol Pump Management Software: Improper Neutralization of Special Elements used in an SQL Command
A vulnerability, which was classified as critical, has been found in SourceCodester Petrol Pump Management Software 1.0. Affected by this issue is some unknown functionality of the file /admin/edit_fuel.php. The manipulation of the argument id leads to sql inj
- 7.5 High severity
Petrol Pump Management Software: Improper Neutralization of Special Elements used in an SQL Command
A vulnerability, which was classified as critical, has been found in SourceCodester Petrol Pump Management Software 1.0. Affected by this issue is some unknown functionality of the file /admin/ajax_product.php. The manipulation of the argument drop_services le
- 9.8 Critical severity
Payroll Management System: Buffer Copy without Checking Size of Input
A vulnerability classified as critical has been found in SourceCodester Payroll Management System 1.0. This affects the function login of the file main. The manipulation leads to buffer overflow. The exploit has been disclosed to the public and may be used.
- 7.2 High severity
Online Exam System: Improper Access Control
A vulnerability classified as critical has been found in SourceCodester Online Exam System 1.0. Affected is an unknown function of the file /admin-dashboard. The manipulation leads to improper access controls. It is possible to launch the attack remotely. The
- 9.8 Critical severity
Best House Rental Management System: Improper Neutralization of Special Elements used in an SQL Command
A vulnerability was found in SourceCodester Best House Rental Management System 1.0 and classified as critical. Affected by this issue is the function delete_tenant of the file /ajax.php?action=delete_tenant. The manipulation of the argument id leads to sql in
- 8.8 High severity
packers_and_movers_management_system: Improper Neutralization of Special Elements used in an SQL Command
A SQL injection vulnerability in Sourcecodester Packers and Movers Management System v1.0 allows remote authenticated users to execute arbitrary SQL commands via the id parameter in /mpms/admin/?page=services/manage_service&id
- 9.8 Critical severity
Garbage Collection Management System: Improper Neutralization of Special Elements used in an SQL Command
A vulnerability was found in SourceCodester Garbage Collection Management System 1.0. It has been declared as critical. This vulnerability affects unknown code of the file login.php. The manipulation of the argument username/password leads to sql injection. Th
- 9.8 Critical severity
online_complaint_site: Improper Neutralization of Special Elements used in an SQL Command
SQL Injection vulnerability in Online Complaint Site v.1.0 allows a remote attacker to escalate privileges via the username and password parameters in the /admin.index.php component.
- 9.8 Critical severity
Sentiment Based Movie Rating System: Improper Neutralization of Special Elements used in an SQL Command
A vulnerability was found in SourceCodester Sentiment Based Movie Rating System 1.0. It has been classified as critical. Affected is an unknown function of the file /msrps/movie_details.php. The manipulation of the argument id leads to sql injection. It is pos
- 8.8 High severity
Drag and Drop Image Upload: Unrestricted Upload of File with Dangerous Type
A vulnerability was found in SourceCodester Drag and Drop Image Upload 1.0. It has been rated as critical. Affected by this issue is some unknown functionality of the file /upload.php. The manipulation leads to unrestricted upload. The attack may be launched r
- 9.8 Critical severity
Online Eyewear Shop: Improper Neutralization of Special Elements used in an SQL Command
A vulnerability was found in SourceCodester Online Eyewear Shop 1.0. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the file classes/Master.php?f=add_to_card of the component POST Request Handler. The manipulati
- 9.8 Critical severity
Online Eyewear Shop: Improper Neutralization of Special Elements used in an SQL Command
A vulnerability was found in SourceCodester Online Eyewear Shop 1.0. It has been classified as critical. Affected is an unknown function of the file /admin/?page=reports of the component Report Viewing Page. The manipulation of the argument date leads to sql i
- 8.8 High severity
Online Eyewear Shop: Improper Neutralization of Special Elements used in an SQL Command
A vulnerability, which was classified as critical, has been found in SourceCodester Online Eyewear Shop 1.0. This issue affects some unknown processing of the file /admin/?page=inventory/view_inventory&id=2. The manipulation of the argument id leads to sql inj
- 9.8 Critical severity
Online Veterinary Appointment System: Improper Neutralization of Special Elements used in an SQL Command
A vulnerability classified as critical has been found in SourceCodester Online Veterinary Appointment System 1.0. Affected is an unknown function of the file /admin/categories/manage_category.php. The manipulation of the argument id leads to sql injection. It
- 9.8 Critical severity
Advocate Office Management System: Improper Neutralization of Special Elements used in an SQL Command
A vulnerability was found in SourceCodester Advocate Office Management System 1.0. It has been rated as critical. This issue affects some unknown processing of the file /control/edit_client.php. The manipulation of the argument id leads to sql injection. The a
- 8.8 High severity
Online Timesheet App: Improper Neutralization of Special Elements used in an SQL Command
A vulnerability, which was classified as critical, was found in SourceCodester Online Timesheet App 1.0. This affects an unknown part of the file /endpoint/delete-timesheet.php. The manipulation of the argument timesheet leads to sql injection. It is possible
- 9.8 Critical severity
Advocate Office Management System: Improper Neutralization of Special Elements used in an SQL Command
A vulnerability, which was classified as critical, has been found in SourceCodester Advocate Office Management System 1.0. Affected by this issue is some unknown functionality of the file /control/activate.php. The manipulation of the argument id leads to sql
- 8.8 High severity
Online Eyewear Shop: Improper Neutralization of Special Elements used in an SQL Command
A vulnerability classified as critical was found in SourceCodester Online Eyewear Shop 1.0. Affected by this vulnerability is the function delete_category of the file /classes/Master.php?f=delete_category. The manipulation of the argument id leads to sql injec
- 8.8 High severity
Employee and Visitor Gate Pass Logging System: Improper Neutralization of Special Elements used in an SQL Command
A vulnerability was found in SourceCodester Employee and Visitor Gate Pass Logging System 1.0. It has been rated as critical. This issue affects some unknown processing of the file /admin/maintenance/manage_department.php. The manipulation of the argument id l
- 9.8 Critical severity
Advocate Office Management System: Improper Neutralization of Special Elements used in an SQL Command
A vulnerability was found in SourceCodester Advocate Office Management System 1.0. It has been classified as critical. Affected is an unknown function of the file /control/forgot_pass.php. The manipulation of the argument username leads to sql injection. It is
- 9.8 Critical severity
Advocate Office Management System: Improper Neutralization of Special Elements used in an SQL Command
A vulnerability was found in SourceCodester Advocate Office Management System 1.0 and classified as critical. This issue affects some unknown processing of the file /control/login.php. The manipulation of the argument username leads to sql injection. The attac
- 7.2 High severity
Profile Registration without Reload Refresh: Improper Neutralization of Special Elements used in an SQL Command
A vulnerability classified as critical has been found in SourceCodester Profile Registration without Reload Refresh 1.0. This affects an unknown part of the file del.php of the component GET Parameter Handler. The manipulation of the argument list leads to sql
- 9.8 Critical severity
Modern Loan Management System: Improper Neutralization of Special Elements used in an SQL Command
A vulnerability was found in SourceCodester Modern Loan Management System 1.0. It has been classified as critical. Affected is an unknown function of the file search_member.php. The manipulation of the argument searchMember leads to sql injection. It is possib
- 9.8 Critical severity
Telecom Billing Management System: Buffer Copy without Checking Size of Input
A vulnerability has been found in SourceCodester Telecom Billing Management System 1.0 and classified as critical. This vulnerability affects the function login. The manipulation of the argument uname leads to buffer overflow. The exploit has been disclosed to
- 9.8 Critical severity
Online Eyewear Shop: Incorrect Authorization
A vulnerability was found in SourceCodester Online Eyewear Shop 1.0. It has been rated as critical. Affected by this issue is some unknown functionality of the file /classes/Users.php?f=save of the component User Creation Handler. The manipulation of the argum