SourceCodester vulnerabilities
We track 1,410 vulnerabilities in SourceCodester products across 60+ products. 1,410 are rated high or critical, and none are known to be exploited. The most recent was published on November 13, 2026.
Latest SourceCodester vulnerabilities
- 9.8 Critical severity
Todo List in Kanban Board: Improper Neutralization of Special Elements used in an SQL Command
A vulnerability classified as critical was found in SourceCodester Todo List in Kanban Board 1.0. Affected by this vulnerability is an unknown functionality of the file /endpoint/delete-todo.php. The manipulation of the argument list leads to sql injection. Th
- 7.5 High severity
Online Chatting System: Improper Neutralization of Special Elements used in an SQL Command
A vulnerability classified as critical has been found in SourceCodester Online Chatting System 1.0. Affected is an unknown function of the file admin/update_room.php. The manipulation of the argument id leads to sql injection. It is possible to launch the atta
- 9.8 Critical severity
Music Gallery Site: Unrestricted Upload of File with Dangerous Type
A vulnerability was found in SourceCodester Music Gallery Site 1.0. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the file classes/Master.php?f=save_music. The manipulation leads to unrestricted upload. The att
- 9.8 Critical severity
Simple File Manager: Unrestricted Upload of File with Dangerous Type
A vulnerability classified as critical was found in SourceCodester Simple File Manager 1.0. This vulnerability affects unknown code. The manipulation of the argument photo leads to unrestricted upload. The attack can be initiated remotely. The exploit has been
- 8.8 High severity
Complete E-Commerce Site: Unrestricted Upload of File with Dangerous Type
A vulnerability classified as critical has been found in SourceCodester Complete E-Commerce Site 1.0. Affected is an unknown function of the file /admin/users_photo.php. The manipulation of the argument photo leads to unrestricted upload. It is possible to lau
- 9.8 Critical severity
employee_management_system: Improper Neutralization of Special Elements used in an SQL Command
SQL Injection vulnerability in Sourcecodester Employee Management System v1.0 allows attackers to run arbitrary SQL commands via crafted POST request to /emloyee_akpoly/Account/login.php.
- 8.8 High severity
school_fees_management_system: Incorrect Authorization
Broken access control in the component /admin/management/users of School Fees Management System v1.0 allows attackers to escalate privileges and perform Administrative actions, including adding and deleting user accounts.
- 7.5 High severity
school_fees_management_system: Missing Authorization
A directory listing vulnerability in School Fees Management System v1.0 allows attackers to list directories and sensitive files within the application without requiring authorization.
- 7.5 High severity
best_student_result_management_system: Missing Authorization
A directory listing vulnerability in Best Student Result Management System v1.0 allows attackers to list directories and sensitive files within the application without requiring authorization.
- 7.5 High severity
customer_support_system: Missing Authorization
A directory listing vulnerability in Customer Support System v1 allows attackers to list directories and sensitive files within the application without requiring authorization.
- 8.8 High severity
customer_support_system: Improper Access Control
Incorrect access control in Customer Support System v1 allows non-administrator users to access administrative pages and execute actions reserved for administrators.
- 9.8 Critical severity
Online Discussion Forum Site: Unrestricted Upload of File with Dangerous Type
A vulnerability was found in SourceCodester Online Discussion Forum Site 1.0. It has been classified as critical. Affected is an unknown function of the file /uupdate.php. The manipulation of the argument ima leads to unrestricted upload. It is possible to lau
- 9.8 Critical severity
File Manager App: Unrestricted Upload of File with Dangerous Type
A vulnerability was found in SourceCodester File Manager App 1.0. It has been declared as critical. This vulnerability affects unknown code of the file /endpoint/update-file.php. The manipulation of the argument file leads to unrestricted upload. The attack ca
- 9.8 Critical severity
Employee Task Management System: Authorization Bypass Through User-Controlled Key
A vulnerability has been found in SourceCodester Employee Task Management System 1.0 and classified as critical. This vulnerability affects unknown code of the file /update-employee.php. The manipulation of the argument admin_id leads to authorization bypass.
- 9.8 Critical severity
Employee Task Management System: Authorization Bypass Through User-Controlled Key
A vulnerability, which was classified as critical, was found in SourceCodester Employee Task Management System 1.0. This affects an unknown part of the file /update-admin.php. The manipulation of the argument admin_id leads to authorization bypass. It is possi
- 9.8 Critical severity
Employee Task Management System: Authorization Bypass Through User-Controlled Key
A vulnerability, which was classified as critical, has been found in SourceCodester Employee Task Management System 1.0. Affected by this issue is some unknown functionality of the file /task-details.php. The manipulation of the argument task_id leads to autho
- 9.8 Critical severity
Employee Task Management System: Authorization Bypass Through User-Controlled Key
A vulnerability classified as critical was found in SourceCodester Employee Task Management System 1.0. Affected by this vulnerability is an unknown functionality of the file /edit-task.php. The manipulation of the argument task_id leads to authorization bypas
- 9.8 Critical severity
Employee Task Management System: Execution After Redirect (EAR)
A vulnerability classified as critical has been found in SourceCodester Employee Task Management System 1.0. Affected is an unknown function of the file /task-info.php. The manipulation leads to execution after redirect. It is possible to launch the attack rem
- 9.8 Critical severity
Employee Task Management System: Execution After Redirect (EAR)
A vulnerability was found in SourceCodester Employee Task Management System 1.0. It has been rated as critical. This issue affects some unknown processing of the file /task-details.php. The manipulation leads to execution after redirect. The attack may be init
- 9.8 Critical severity
Employee Task Management System: Execution After Redirect (EAR)
A vulnerability was found in SourceCodester Employee Task Management System 1.0. It has been declared as critical. This vulnerability affects unknown code of the file /manage-admin.php. The manipulation leads to execution after redirect. The attack can be init
- 9.8 Critical severity
Employee Task Management System: Execution After Redirect (EAR)
A vulnerability was found in SourceCodester Employee Task Management System 1.0. It has been classified as critical. This affects an unknown part of the file /edit-task.php. The manipulation leads to execution after redirect. It is possible to initiate the att
- 9.8 Critical severity
Employee Task Management System: Execution After Redirect (EAR)
A vulnerability was found in SourceCodester Employee Task Management System 1.0 and classified as critical. Affected by this issue is some unknown functionality of the file /admin-manage-user.php. The manipulation leads to execution after redirect. The attack
- 9.8 Critical severity
Employee Task Management System: Improper Neutralization of Special Elements used in an SQL Command
A vulnerability was found in SourceCodester Employee Task Management System 1.0. It has been classified as critical. This affects an unknown part of the file attendance-info.php. The manipulation of the argument user_id leads to sql injection. It is possible t
- 7.2 High severity
Employee Task Management System: Improper Neutralization of Special Elements used in an SQL Command
A vulnerability was found in SourceCodester Employee Task Management System 1.0 and classified as critical. Affected by this issue is some unknown functionality of the file update-admin.php. The manipulation of the argument admin_id leads to sql injection. The
- 8.8 High severity
Employee Task Management System: Improper Neutralization of Special Elements used in an SQL Command
A vulnerability has been found in SourceCodester Employee Task Management System 1.0 and classified as critical. Affected by this vulnerability is an unknown functionality of the file update-employee.php. The manipulation of the argument admin_id leads to sql
- 9.8 Critical severity
Best POS Management System: Improper Neutralization of Special Elements used in an SQL Command
A vulnerability was found in SourceCodester Best POS Management System 1.0. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the file /view_order.php. The manipulation of the argument id leads to sql injection. Th
- 9.8 Critical severity
Employee Management System: Unrestricted Upload of File with Dangerous Type
A vulnerability was found in SourceCodester Employee Management System 1.0. It has been rated as critical. Affected by this issue is some unknown functionality of the file /Admin/add-admin.php. The manipulation of the argument avatar leads to unrestricted uplo
- 9.8 Critical severity
CRUD without Page Reload: Improper Neutralization of Special Elements used in an SQL Command
A vulnerability was found in SourceCodester CRUD without Page Reload 1.0. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the file add_user.php. The manipulation of the argument city leads to sql injection. The a
- 7.2 High severity
Online Mobile Management Store: Improper Neutralization of Special Elements used in an SQL Command
A vulnerability was found in SourceCodester Online Mobile Management Store 1.0. It has been rated as critical. This issue affects some unknown processing of the file /admin/maintenance/manage_category.php of the component HTTP GET Request Handler. The manipula
- 9.8 Critical severity
Tourist Reservation System: Buffer Copy without Checking Size of Input
A vulnerability was found in SourceCodester Tourist Reservation System 1.0. It has been declared as critical. This vulnerability affects the function ad_writedata of the file System.cpp. The manipulation of the argument ad_code leads to buffer overflow. The at
- 8.4 High severity
lost_and_found_information_system: Improper Neutralization of Special Elements used in an SQL Command
Sourcecodester Lost and Found Information System's Version 1.0 is vulnerable to unauthenticated SQL Injection at "?page=items/view&id=*" which can be escalated to the remote command execution.
- 9.8 Critical severity
customer_support_system: Improper Neutralization of Special Elements used in an SQL Command
Customer Support System v1 was discovered to contain a SQL injection vulnerability via the subject parameter at /customer_support/ajax.php?action=save_ticket.
- 8.8 High severity
customer_support_system: Improper Neutralization of Special Elements used in an SQL Command
Customer Support System v1 was discovered to contain a SQL injection vulnerability via the lastname parameter at /customer_support/ajax.php?action=save_user.
- 9.8 Critical severity
customer_support_system: Improper Neutralization of Special Elements used in an SQL Command
Customer Support System v1 was discovered to contain a SQL injection vulnerability via the username parameter at /customer_support/ajax.php?action=login.
- 7.2 High severity
Online Tours & Travels Management System: Improper Neutralization of Special Elements used in an SQL Command
A vulnerability was found in SourceCodester Online Tours & Travels Management System 1.0. It has been classified as critical. Affected is an unknown function of the file /admin/operations/expense_category.php of the component HTTP POST Request Handler. The man
- 9.8 Critical severity
Best POS Management System: Improper Neutralization of Special Elements used in an SQL Command
A vulnerability was found in SourceCodester Best POS Management System 1.0. It has been classified as critical. Affected is an unknown function of the file admin_class.php. The manipulation of the argument img leads to sql injection. It is possible to launch t
- 9.8 Critical severity
Online Mobile Management Store: Improper Neutralization of Special Elements used in an SQL Command
A vulnerability has been found in SourceCodester Online Mobile Management Store 1.0 and classified as critical. This vulnerability affects unknown code of the file view_product.php. The manipulation of the argument id leads to sql injection. The attack can be
- 9.8 Critical severity
Online Mobile Management Store: Improper Neutralization of Special Elements used in an SQL Command
A vulnerability, which was classified as critical, was found in SourceCodester Online Mobile Management Store 1.0. This affects an unknown part of the file /admin/orders/view_order.php. The manipulation of the argument id leads to sql injection. It is possible
- 9.8 Critical severity
Online Mobile Management Store: Improper Neutralization of Special Elements used in an SQL Command
A vulnerability, which was classified as critical, has been found in SourceCodester Online Mobile Management Store 1.0. Affected by this issue is some unknown functionality of the file /admin/product/manage_product.php. The manipulation of the argument id lead
- 8.8 High severity
Online Mobile Management Store: Unrestricted Upload of File with Dangerous Type
A vulnerability classified as critical has been found in SourceCodester Online Mobile Management Store 1.0. This affects an unknown part of the file /classes/Users.php. The manipulation of the argument img leads to unrestricted upload. It is possible to initia