SourceCodester vulnerabilities
We track 1,410 vulnerabilities in SourceCodester products across 60+ products. 1,410 are rated high or critical, and none are known to be exploited. The most recent was published on November 13, 2026.
Latest SourceCodester vulnerabilities
- 9.8 Critical severity
Online Mobile Management Store: Improper Neutralization of Special Elements used in an SQL Command
A vulnerability was found in SourceCodester Online Mobile Management Store 1.0. It has been rated as critical. Affected by this issue is some unknown functionality of the file /admin/login.php. The manipulation of the argument username leads to sql injection.
- 9.8 Critical severity
petrol_pump_management: Unrestricted Upload of File with Dangerous Type
File Upload vulnerability in Petrol Pump Mangement Software v.1.0 allows an attacker to execute arbitrary code via a crafted payload to the email Image parameter in the profile.php component.
- 9.8 Critical severity
petrol_pump_management: Improper Neutralization of Special Elements used in an SQL Command
SQL Injection vulnerability in Petrol Pump Mangement Software v.1.0 allows an attacker to execute arbitrary code via a crafted payload to the email address parameter in the index.php component.
- 7.5 High severity
customer_support_system: Improper Access Control
A directory listing vulnerability in Customer Support System v1 allows attackers to list directories and sensitive files within the application without requiring authorization.
- 9.8 Critical severity
Simple Online Bidding System: Improper Neutralization of Special Elements used in an SQL Command
A vulnerability classified as critical has been found in SourceCodester Simple Online Bidding System 1.0. This affects an unknown part of the file index.php. The manipulation of the argument category_id leads to sql injection. It is possible to initiate the at
- 8.8 High severity
Block Inserter for Dynamic Content: Improper Neutralization of Special Elements used in an SQL Command
A vulnerability has been found in SourceCodester Block Inserter for Dynamic Content 1.0 and classified as critical. This vulnerability affects unknown code of the file view_post.php. The manipulation of the argument id leads to sql injection. The attack can be
- 9.8 Critical severity
Computer Inventory System: Improper Neutralization of Special Elements used in an SQL Command
A vulnerability was found in SourceCodester Computer Inventory System 1.0. It has been declared as critical. This vulnerability affects unknown code of the file /endpoint/delete-computer.php. The manipulation of the argument computer leads to sql injection. Th
- 7.2 High severity
Petrol Pump Management Software: Improper Neutralization of Special Elements used in an SQL Command
A vulnerability, which was classified as critical, has been found in SourceCodester Petrol Pump Management Software 1.0. This issue affects some unknown processing of the file /admin/edit_categories.php. The manipulation of the argument id leads to sql injecti
- 7.2 High severity
Petrol Pump Management Software: Improper Neutralization of Special Elements used in an SQL Command
A vulnerability classified as critical was found in SourceCodester Petrol Pump Management Software 1.0. This vulnerability affects unknown code of the file /admin/edit_supplier.php. The manipulation of the argument id leads to sql injection. The attack can be
- 7.2 High severity
Petrol Pump Management Software: Improper Neutralization of Special Elements used in an SQL Command
A vulnerability classified as critical has been found in SourceCodester Petrol Pump Management Software 1.0. This affects an unknown part of the file /admin/app/login_crud.php. The manipulation of the argument email leads to sql injection. It is possible to in
- 7.2 High severity
Petrol Pump Management Software: Unrestricted Upload of File with Dangerous Type
A vulnerability was found in SourceCodester Petrol Pump Management Software 1.0. It has been rated as critical. Affected by this issue is some unknown functionality of the file /admin/app/service_crud.php. The manipulation of the argument photo leads to unrest
- 7.2 High severity
Petrol Pump Management Software: Unrestricted Upload of File with Dangerous Type
A vulnerability was found in SourceCodester Petrol Pump Management Software 1.0. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the file /admin/app/product.php. The manipulation of the argument photo leads to un
- 7.2 High severity
Web-Based Student Clearance System: Improper Neutralization of Special Elements used in an SQL Command
A vulnerability, which was classified as critical, has been found in SourceCodester Web-Based Student Clearance System 1.0. Affected by this issue is some unknown functionality of the file /admin/edit-admin.php of the component Edit User Profile Page. The mani
- 9.8 Critical severity
Web-Based Student Clearance System: Improper Neutralization of Special Elements used in an SQL Command
A vulnerability classified as critical was found in SourceCodester Web-Based Student Clearance System 1.0. Affected by this vulnerability is an unknown functionality of the file /Admin/login.php. The manipulation of the argument txtpassword leads to sql inject
- 9.8 Critical severity
Free and Open Source Inventory Management System: Improper Neutralization of Special Elements used in an SQL Command
A vulnerability was found in SourceCodester Free and Open Source Inventory Management System 1.0. It has been rated as critical. This issue affects some unknown processing of the file /app/ajax/search_sales_report.php. The manipulation of the argument customer
- 9.8 Critical severity
Simple Student Attendance System: Improper Neutralization of Special Elements used in an SQL Command
A vulnerability was found in SourceCodester Simple Student Attendance System 1.0 and classified as critical. Affected by this issue is the function delete_class/delete_student of the file /ajax-api.php of the component List of Classes Page. The manipulation of
- 8.8 High severity
Employee Management System: Improper Neutralization of Special Elements used in an SQL Command
A vulnerability was found in SourceCodester Employee Management System 1.0. It has been rated as critical. Affected by this issue is some unknown functionality of the file /myprofile.php. The manipulation of the argument id with the input 1%20or%201=1 leads to
- 8.8 High severity
Employee Management System: Improper Neutralization of Special Elements used in an SQL Command
A vulnerability was found in SourceCodester Employee Management System 1.0. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the file /cancel.php. The manipulation of the argument id with the input 1%20or%201=1 le
- 9.8 Critical severity
Employee Management System: Improper Neutralization of Special Elements used in an SQL Command
A vulnerability was found in SourceCodester Employee Management System 1.0. It has been classified as critical. Affected is an unknown function of the file /psubmit.php. The manipulation of the argument pid with the input '+or+1%3d1%23 leads to sql injection.
- 8.8 High severity
Complaint Management System: Unrestricted Upload of File with Dangerous Type
A vulnerability was found in SourceCodester Complaint Management System 1.0 and classified as critical. This issue affects some unknown processing of the file users/register-complaint.php of the component Lodge Complaint Section. The manipulation leads to unre
- 9.8 Critical severity
Employee Management System: Improper Neutralization of Special Elements in Output Used by a Downstream Component
A vulnerability was found in SourceCodester Employee Management System 1.0 and classified as critical. Affected by this issue is some unknown functionality of the file /Account/login.php. The manipulation of the argument txtusername/txtphone leads to sql injec
- 9.8 Critical severity
Complete File Management System: Improper Neutralization of Special Elements used in an SQL Command
A vulnerability has been found in SourceCodester Complete File Management System 1.0 and classified as critical. Affected by this vulnerability is an unknown functionality of the file /admin/ of the component Admin Login Form. The manipulation of the argument
- 9.8 Critical severity
Complete File Management System: Improper Neutralization of Special Elements used in an SQL Command
A vulnerability, which was classified as critical, was found in SourceCodester Complete File Management System 1.0. Affected is an unknown function of the file users/index.php of the component Login Form. The manipulation of the argument username with the inpu
- 9.8 Critical severity
Testimonial Page Manager: Improper Neutralization of Special Elements used in an SQL Command
A vulnerability, which was classified as critical, has been found in SourceCodester Testimonial Page Manager 1.0. This issue affects some unknown processing of the file delete-testimonial.php of the component HTTP GET Request Handler. The manipulation of the a
- 9.8 Critical severity
Facebook News Feed Like: Unrestricted Upload of File with Dangerous Type
A vulnerability, which was classified as critical, was found in SourceCodester Facebook News Feed Like 1.0. Affected is an unknown function of the component Post Handler. The manipulation leads to unrestricted upload. It is possible to launch the attack remote
- 8.8 High severity
Employee Management System: Improper Access Control
A vulnerability classified as problematic was found in SourceCodester Employee Management System 1.0. This vulnerability affects unknown code of the file delete-leave.php of the component Leave Handler. The manipulation of the argument id leads to improper acc
- 9.8 Critical severity
Employee Management System: Improper Neutralization of Special Elements used in an SQL Command
A vulnerability was found in SourceCodester Employee Management System 1.0. It has been rated as critical. Affected by this issue is some unknown functionality of the file /Admin/login.php. The manipulation of the argument txtusername leads to sql injection. T
- 7.2 High severity
Employee Management System: Unrestricted Upload of File with Dangerous Type
A vulnerability was found in SourceCodester Employee Management System 1.0. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the file edit-photo.php of the component Profile Page. The manipulation leads to unrestr
- 7.2 High severity
Employee Management System: Improper Neutralization of Special Elements used in an SQL Command
A vulnerability was found in SourceCodester Employee Management System 1.0. It has been classified as critical. Affected is an unknown function of the file edit_profile.php. The manipulation of the argument txtfullname leads to sql injection. It is possible to
- 9.8 Critical severity
Online Tours & Travels Management System: Improper Neutralization of Special Elements used in an SQL Command
A vulnerability was found in SourceCodester Online Tours & Travels Management System 1.0. It has been rated as critical. This issue affects the function exec of the file payment.php. The manipulation of the argument id leads to sql injection. The attack may be
- 9.8 Critical severity
Online Tours & Travels Management System: Improper Neutralization of Special Elements used in an SQL Command
A vulnerability was found in SourceCodester Online Tours & Travels Management System 1.0. It has been declared as critical. This vulnerability affects the function prepare of the file admin/pay.php. The manipulation of the argument id leads to sql injection. T
- 9.8 Critical severity
Online Tours & Travels Management System: Improper Neutralization of Special Elements used in an SQL Command
A vulnerability was found in SourceCodester Online Tours & Travels Management System 1.0. It has been rated as critical. Affected by this issue is the function exec of the file admin/operations/expense.php. The manipulation leads to sql injection. The attack m
- 7.2 High severity
House Rental Management System: Improper Neutralization of Special Elements used in an SQL Command
A vulnerability was found in SourceCodester House Rental Management System 1.0 and classified as critical. Affected by this issue is some unknown functionality of the file manage_user.php of the component Edit User. The manipulation of the argument id/name/use
- 9.8 Critical severity
Student Attendance System: Improper Neutralization of Special Elements used in an SQL Command
A vulnerability, which was classified as critical, was found in SourceCodester Student Attendance System 1.0. Affected is an unknown function of the file attendance_report.php. The manipulation of the argument class_id leads to sql injection. The exploit has b
- 8.8 High severity
Clinic Queuing System: External Control of File Name or Path
A vulnerability was found in SourceCodester Clinic Queuing System 1.0. It has been rated as critical. This issue affects some unknown processing of the file /index.php of the component GET Parameter Handler. The manipulation of the argument page leads to file
- 9.8 Critical severity
Clinic Queuing System: Authorization Bypass Through User-Controlled Key
A vulnerability was found in SourceCodester Clinic Queuing System 1.0. It has been declared as critical. This vulnerability affects unknown code of the file /LoginRegistration.php. The manipulation of the argument formToken leads to authorization bypass. The a
- 7.5 High severity
A vulnerability, which was classified as problematic, was found in SourceCodester Engineers…
A vulnerability, which was classified as problematic, was found in SourceCodester Engineers Online Portal 1.0. Affected is an unknown function of the file change_password_teacher.php of the component Password Change. The manipulation leads to session expiratio
- 9.8 Critical severity
Engineers Online Portal: Improper Neutralization of Special Elements used in an SQL Command
A vulnerability was found in SourceCodester Engineers Online Portal 1.0 and classified as critical. Affected by this issue is some unknown functionality of the file /admin/ of the component Admin Login. The manipulation of the argument username/password leads
- 9.8 Critical severity
Free and Open Source Inventory Management System: Improper Neutralization of Special Elements used in an SQL Command
A vulnerability was found in SourceCodester Free and Open Source Inventory Management System 1.0 and classified as critical. This issue affects some unknown processing of the file /app/ajax/sell_return_data.php. The manipulation of the argument columns[0][data
- 8.8 High severity
Free and Open Source Inventory Management System: Improper Neutralization of Special Elements used in an SQL Command
A vulnerability, which was classified as critical, was found in SourceCodester Free and Open Source Inventory Management System 1.0. This affects an unknown part of the file /ample/app/action/edit_product.php. The manipulation of the argument id leads to sql i