SourceCodester vulnerabilities
We track 1,410 vulnerabilities in SourceCodester products across 60+ products. 1,410 are rated high or critical, and none are known to be exploited. The most recent was published on November 13, 2026.
Latest SourceCodester vulnerabilities
- 9.8 Critical severity
Medicine Tracking System: Improper Limitation of a Pathname to a Restricted Directory
A vulnerability was found in SourceCodester Medicine Tracking System 1.0. It has been rated as critical. This issue affects some unknown processing. The manipulation of the argument page leads to path traversal: '../filedir'. The attack may be initiated remote
- 9.8 Critical severity
Medicine Tracking System: Improper Neutralization of Special Elements used in an SQL Command
A vulnerability, which was classified as critical, has been found in SourceCodester Medicine Tracking System 1.0. This issue affects some unknown processing of the file /classes/Master.php? f=save_medicine. The manipulation of the argument id/name/description
- 9.8 Critical severity
Simple Student Attendance System: Path Traversal: '../filedir'
A vulnerability was found in SourceCodester Simple Student Attendance System 1.0. It has been declared as critical. Affected by this vulnerability is an unknown functionality. The manipulation of the argument page leads to path traversal: '../filedir'. The att
- 9.8 Critical severity
Best Courier Management System: Improper Neutralization of Special Elements used in an SQL Command
A vulnerability classified as critical has been found in SourceCodester Best Courier Management System 1.0. Affected is an unknown function of the file manage_user.php. The manipulation of the argument id leads to sql injection. The exploit has been disclosed
- 9.8 Critical severity
Simple Student Attendance System: Improper Neutralization of Special Elements used in an SQL Command
A vulnerability, which was classified as critical, has been found in SourceCodester Simple Student Attendance System 1.0. This issue affects the function save_attendance of the file actions.class.php. The manipulation of the argument sid leads to sql injection
- 9.8 Critical severity
Online Tours & Travels Management System: Improper Neutralization of Special Elements used in an SQL Command
A vulnerability was found in SourceCodester Online Tours & Travels Management System 1.0. It has been rated as critical. This issue affects the function prepare of the file email_setup.php. The manipulation of the argument name leads to sql injection. The expl
- 9.8 Critical severity
Simple Student Attendance System: Improper Neutralization of Special Elements used in an SQL Command
A vulnerability classified as critical was found in SourceCodester Simple Student Attendance System 1.0. This vulnerability affects unknown code of the file ajax-api.php?action=save_attendance. The manipulation of the argument class_id leads to sql injection.
- 9.8 Critical severity
Simple Student Attendance System: Improper Neutralization of Special Elements used in an SQL Command
A vulnerability classified as critical has been found in SourceCodester Simple Student Attendance System 1.0. This affects an unknown part of the file /modals/student_form.php. The manipulation of the argument id leads to sql injection. The exploit has been di
- 9.8 Critical severity
Simple Student Attendance System: Improper Neutralization of Special Elements used in an SQL Command
A vulnerability was found in SourceCodester Simple Student Attendance System 1.0. It has been rated as critical. Affected by this issue is some unknown functionality of the file /modals/class_form.php. The manipulation of the argument id leads to sql injection
- 8.8 High severity
Simple Student Attendance System: Externally Controlled Reference to a Resource in Another Sphere
A vulnerability was found in SourceCodester Simple Student Attendance System 1.0. It has been declared as problematic. Affected by this vulnerability is an unknown functionality of the file index.php. The manipulation of the argument page leads to file inclusi
- 9.8 Critical severity
Simple Student Attendance System: Improper Neutralization of Special Elements used in an SQL Command
A vulnerability was found in SourceCodester Simple Student Attendance System 1.0. It has been classified as critical. Affected is an unknown function of the file attendance.php. The manipulation of the argument class_id leads to sql injection. The exploit has
- 9.8 Critical severity
User Registration and Login System: Improper Neutralization of Special Elements used in an SQL Command
A vulnerability was found in SourceCodester User Registration and Login System 1.0 and classified as critical. Affected by this issue is some unknown functionality of the file /endpoint/add-user.php. The manipulation of the argument user leads to sql injection
- 7.2 High severity
Loan Management System: Improper Neutralization of Special Elements used in an SQL Command
A vulnerability was found in SourceCodester Loan Management System 1.0. It has been classified as critical. Affected is the function delete_user of the file deleteUser.php of the component Users Page. The manipulation of the argument user_id leads to sql injec
- 7.2 High severity
Loan Management System: Improper Neutralization of Special Elements used in an SQL Command
A vulnerability was found in SourceCodester Loan Management System 1.0 and classified as critical. This issue affects the function delete_ltype of the file delete_ltype.php of the component Loan Type Page. The manipulation of the argument ltype_id leads to sql
- 7.2 High severity
Loan Management System: Improper Neutralization of Special Elements used in an SQL Command
A vulnerability has been found in SourceCodester Loan Management System 1.0 and classified as critical. This vulnerability affects the function delete_borrower of the file deleteBorrower.php. The manipulation of the argument borrower_id leads to sql injection.
- 9.8 Critical severity
Free and Open Source Inventory Management System: Improper Neutralization of Special Elements used in an SQL Command
A vulnerability classified as critical has been found in SourceCodester Free and Open Source Inventory Management System 1.0. Affected is an unknown function of the file /ample/app/ajax/member_data.php. The manipulation of the argument columns leads to sql inj
- 9.8 Critical severity
Free and Open Source Inventory Management System: Improper Neutralization of Special Elements used in an SQL Command
A vulnerability was found in SourceCodester Free and Open Source Inventory Management System 1.0. It has been rated as critical. This issue affects some unknown processing of the file ample/app/ajax/suppliar_data.php. The manipulation of the argument columns l
- 7.2 High severity
Company Website CMS: Unrestricted Upload of File with Dangerous Type
A vulnerability was found in SourceCodester Company Website CMS 1.0 and classified as problematic. Affected by this issue is some unknown functionality of the file /dashboard/createblog of the component Create Blog Page. The manipulation leads to unrestricted
- 9.8 Critical severity
Visitor Management System: Improper Neutralization of Special Elements used in an SQL Command
A vulnerability, which was classified as critical, was found in SourceCodester Visitor Management System 1.0. Affected is an unknown function of the file manage_user.php. The manipulation of the argument id leads to sql injection. It is possible to launch the
- 9.8 Critical severity
Task Reminder System: Improper Neutralization of Special Elements used in an SQL Command
A vulnerability was found in SourceCodester Task Reminder System 1.0. It has been rated as critical. Affected by this issue is some unknown functionality of the file classes/Users.php?f=delete. The manipulation of the argument id leads to sql injection. The at
- 8.8 High severity
Task Reminder System: Improper Neutralization of Special Elements used in an SQL Command
A vulnerability was found in SourceCodester Task Reminder System 1.0. It has been classified as critical. This affects an unknown part of the file /classes/Master.php?f=save_reminder. The manipulation of the argument id leads to sql injection. It is possible t
- 8.8 High severity
Task Reminder System: Improper Neutralization of Special Elements used in an SQL Command
A vulnerability was found in SourceCodester Task Reminder System 1.0 and classified as critical. Affected by this issue is some unknown functionality of the file /classes/Master.php?f=delete_reminder. The manipulation of the argument id leads to sql injection.
- 9.8 Critical severity
Simple Real Estate Portal System: Improper Neutralization of Special Elements used in an SQL Command
A vulnerability was found in SourceCodester Simple Real Estate Portal System 1.0. It has been classified as critical. Affected is an unknown function of the file view_estate.php. The manipulation of the argument id leads to sql injection. It is possible to lau
- 9.8 Critical severity
Sticky Notes App: Improper Neutralization of Special Elements used in an SQL Command
A vulnerability has been found in SourceCodester Sticky Notes App 1.0 and classified as critical. This vulnerability affects unknown code of the file endpoint/delete-note.php. The manipulation of the argument note leads to sql injection. The attack can be init
- 9.8 Critical severity
File Manager App: Unrestricted Upload of File with Dangerous Type
A vulnerability classified as critical was found in SourceCodester File Manager App 1.0. Affected by this vulnerability is an unknown functionality of the file endpoint/add-file.php. The manipulation of the argument uploadedFileName leads to unrestricted uploa
- 9.8 Critical severity
Judging Management System: Improper Neutralization of Special Elements used in an SQL Command
A vulnerability was found in SourceCodester Judging Management System 1.0. It has been declared as critical. This vulnerability affects unknown code of the file login.php. The manipulation of the argument password leads to sql injection. The attack can be init
- 9.8 Critical severity
Free Hospital Management System for Small…: Improper Neutralization of Special Elements used in an SQL Command
A vulnerability was found in SourceCodester Free Hospital Management System for Small Practices 1.0 and classified as critical. Affected by this issue is some unknown functionality of the file /vm/admin/doctors.php of the component Parameter Handler. The manip
- 9.8 Critical severity
Library System: Improper Neutralization of Special Elements used in an SQL Command
A vulnerability classified as critical has been found in SourceCodester Library System 1.0. This affects an unknown part of the file index.php. The manipulation of the argument category leads to sql injection. It is possible to initiate the attack remotely. Th
- 9.8 Critical severity
Online Pizza Ordering System: Improper Neutralization of Special Elements used in an SQL Command
A vulnerability has been found in SourceCodester Online Pizza Ordering System 1.0 and classified as critical. This vulnerability affects unknown code of the file /admin/ajax.php?action=confirm_order. The manipulation of the argument id leads to sql injection.
- 9.8 Critical severity
Online Computer and Laptop Store: Improper Neutralization of Special Elements used in an SQL Command
A vulnerability classified as critical was found in SourceCodester Online Computer and Laptop Store 1.0. Affected by this vulnerability is an unknown functionality of the file products.php. The manipulation of the argument c leads to sql injection. The attack
- 9.8 Critical severity
Online Computer and Laptop Store: Improper Neutralization of Special Elements used in an SQL Command
A vulnerability classified as critical has been found in SourceCodester Online Computer and Laptop Store 1.0. Affected is the function register of the file Master.php. The manipulation of the argument email leads to sql injection. It is possible to launch the
- 8.8 High severity
Engineers Online Portal: Unrestricted Upload of File with Dangerous Type
A vulnerability classified as critical has been found in SourceCodester Engineers Online Portal 1.0. Affected is an unknown function of the file upload_save_student.php. The manipulation of the argument uploaded_file leads to unrestricted upload. It is possibl
- 8.8 High severity
Engineers Online Portal: Improper Neutralization of Special Elements used in an SQL Command
A vulnerability was found in SourceCodester Engineers Online Portal 1.0. It has been rated as critical. This issue affects some unknown processing of the file teacher_signup.php. The manipulation of the argument firstname/lastname leads to sql injection. The a
- 9.8 Critical severity
Engineers Online Portal: Improper Neutralization of Special Elements used in an SQL Command
A vulnerability was found in SourceCodester Engineers Online Portal 1.0. It has been declared as critical. This vulnerability affects unknown code of the file seed_message_student.php. The manipulation of the argument teacher_id leads to sql injection. The att
- 9.8 Critical severity
Engineers Online Portal: Improper Neutralization of Special Elements used in an SQL Command
A vulnerability was found in SourceCodester Engineers Online Portal 1.0. It has been classified as critical. This affects an unknown part of the file remove_inbox_message.php. The manipulation of the argument id leads to sql injection. It is possible to initia
- 9.8 Critical severity
Engineers Online Portal: Improper Neutralization of Special Elements used in an SQL Command
A vulnerability was found in SourceCodester Engineers Online Portal 1.0 and classified as critical. Affected by this issue is some unknown functionality of the file my_students.php. The manipulation of the argument id leads to sql injection. The attack may be
- 9.8 Critical severity
Engineers Online Portal: Improper Neutralization of Special Elements used in an SQL Command
A vulnerability has been found in SourceCodester Engineers Online Portal 1.0 and classified as critical. Affected by this vulnerability is an unknown functionality of the file my_classmates.php. The manipulation of the argument teacher_class_student_id leads t
- 9.8 Critical severity
Engineers Online Portal: Improper Neutralization of Special Elements used in an SQL Command
A vulnerability, which was classified as critical, was found in SourceCodester Engineers Online Portal 1.0. Affected is an unknown function of the file login.php. The manipulation of the argument username/password leads to sql injection. It is possible to laun
- 9.8 Critical severity
Engineers Online Portal: Unrestricted Upload of File with Dangerous Type
A vulnerability, which was classified as critical, has been found in SourceCodester Engineers Online Portal 1.0. This issue affects some unknown processing of the file student_avatar.php. The manipulation of the argument change leads to unrestricted upload. Th
- 9.8 Critical severity
Engineers Online Portal: Improper Neutralization of Special Elements used in an SQL Command
A vulnerability classified as critical was found in SourceCodester Engineers Online Portal 1.0. This vulnerability affects unknown code of the file downloadable_student.php. The manipulation of the argument id leads to sql injection. The attack can be initiate