SourceCodester vulnerabilities
We track 1,410 vulnerabilities in SourceCodester products across 60+ products. 1,410 are rated high or critical, and none are known to be exploited. The most recent was published on November 13, 2026.
Latest SourceCodester vulnerabilities
- 8.8 High severity
Sales and Inventory System: Improper Neutralization of Special Elements used in an SQL Command
A flaw has been found in SourceCodester Sales and Inventory System 1.0. Affected by this vulnerability is an unknown functionality of the file check_supplier_details.php of the component POST Parameter Handler. Executing a manipulation of the argument stock_na
- 8.8 High severity
Resort Reservation System: Improper Neutralization of Special Elements used in an SQL Command
A vulnerability has been found in SourceCodester/janobe Resort Reservation System 1.0. This vulnerability affects unknown code of the file /accomodation.php. Such manipulation of the argument q leads to sql injection. The attack may be performed from remote. T
- 8.8 High severity
Computer Laboratory Management System: Cross-Site Request Forgery
A flaw has been found in SourceCodester Computer Laboratory Management System 1.0. This affects an unknown part. This manipulation causes cross-site request forgery. The attack is possible to be carried out remotely. The exploit has been published and may be u
- 7.3 High severity
Client Database Management System: Incorrect Privilege Assignment
A vulnerability was determined in SourceCodester Client Database Management System 1.0. The impacted element is an unknown function of the file /superadmin_user_update.php. This manipulation causes improper authorization. The attack can be initiated remotely.
- 9.8 Critical severity
Client Database Management System: Incorrect Privilege Assignment
A vulnerability has been found in SourceCodester Client Database Management System 1.0/3.1. Impacted is an unknown function of the file /superadmin_delete_manager.php of the component Endpoint. The manipulation of the argument manager_id leads to improper auth
- 8.8 High severity
Sales and Inventory System: Improper Neutralization of Special Elements in Output Used by a Downstream Component
A vulnerability was identified in SourceCodester Sales and Inventory System up to 1.0. Affected is an unknown function of the file /check_item_details.php. The manipulation of the argument stock_name1 leads to sql injection. The attack may be initiated remotel
- 8.8 High severity
Sales and Inventory System: Improper Neutralization of Special Elements in Output Used by a Downstream Component
A vulnerability was determined in SourceCodester Sales and Inventory System 1.0. This impacts an unknown function of the file /check_customer_details.php of the component POST Handler. Executing a manipulation of the argument stock_name1 can lead to sql inject
- 8.8 High severity
Sales and Inventory System: Improper Neutralization of Special Elements in Output Used by a Downstream Component
A vulnerability was found in SourceCodester Sales and Inventory System 1.0. This affects an unknown function of the file /add_stock.php. Performing a manipulation of the argument cost results in sql injection. The attack can be initiated remotely. The exploit
- 8.8 High severity
Sales and Inventory System: Improper Neutralization of Special Elements in Output Used by a Downstream Component
A vulnerability has been found in SourceCodester Sales and Inventory System up to 1.0. The impacted element is an unknown function of the file /add_sales_print.php. Such manipulation of the argument sid leads to sql injection. It is possible to launch the atta
- 7.2 High severity
Employee Task Management System: Improper Neutralization of Special Elements in Output Used by a Downstream Component
A flaw has been found in SourceCodester Employee Task Management System up to 1.0. The affected element is an unknown function of the file /daily-task-report.php of the component GET Parameter Handler. This manipulation of the argument Date causes sql injectio
- 7.2 High severity
Employee Task Management System: Improper Neutralization of Special Elements in Output Used by a Downstream Component
A vulnerability was detected in SourceCodester Employee Task Management System 1.0. Impacted is an unknown function of the file /daily-attendance-report.php of the component GET Parameter Handler. The manipulation of the argument Date results in sql injection.
- 9.8 Critical severity
Simple Responsive Tourism Website: Improper Neutralization of Special Elements in Output Used by a Downstream Component
A vulnerability was determined in SourceCodester Simple Responsive Tourism Website 1.0. Affected by this vulnerability is an unknown functionality of the file /tourism/classes/Login.php?f=login of the component Login. This manipulation of the argument Username
- 7.3 High severity
Client Database Management System: Incorrect Privilege Assignment
A flaw has been found in SourceCodester Client Database Management System 1.0. Affected is an unknown function of the file /fetch_manager_details.php of the component Endpoint. This manipulation of the argument manager_id causes improper authorization. The att
- 8.8 High severity
Patients Waiting Area Queue Management System: Incorrect Privilege Assignment
A weakness has been identified in SourceCodester Patients Waiting Area Queue Management System 1.0. This impacts an unknown function of the file /checkin.php. This manipulation of the argument patient_id causes improper authorization. It is possible to initiat
- 7.5 High severity
Website Link Extractor: Server-Side Request Forgery
A vulnerability has been found in SourceCodester Website Link Extractor 1.0. This vulnerability affects the function file_get_contents of the component URL Handler. The manipulation leads to server-side request forgery. It is possible to initiate the attack re
- 9.8 Critical severity
Simple and Nice Shopping Cart Script: Improper Neutralization of Special Elements used in an SQL Command
A vulnerability was determined in SourceCodester Simple and Nice Shopping Cart Script 1.0. This impacts an unknown function of the file /signup.php. This manipulation of the argument Username causes sql injection. The attack may be initiated remotely. The expl
- 9.8 Critical severity
Student Result Management System: Incorrect Privilege Assignment
A vulnerability was determined in SourceCodester Student Result Management System 1.0. The impacted element is an unknown function of the file /admin/core/import_users.php of the component Bulk Import. This manipulation of the argument File causes improper acc
- 7.3 High severity
Student Result Management System: Incorrect Privilege Assignment
A vulnerability has been found in SourceCodester Student Result Management System 1.0. The affected element is an unknown function of the file /srms/script/admin/core/update_smtp.php. The manipulation leads to improper access controls. It is possible to initia
- 9.8 Critical severity
Simple Responsive Tourism Website: Improper Neutralization of Special Elements used in an SQL Command
A flaw has been found in SourceCodester Simple Responsive Tourism Website 1.0. Affected by this vulnerability is an unknown functionality of the file /classes/Master.php?f=register of the component Registration. This manipulation of the argument Username cause
- 7.3 High severity
Prison Management System: Session Fixation
A vulnerability has been found in SourceCodester Prison Management System 1.0. The impacted element is an unknown function of the component Login. The manipulation leads to session fixiation. It is possible to initiate the attack remotely. The exploit has been
- 9.8 Critical severity
Online Class Record System: Improper Neutralization of Special Elements in Output Used by a Downstream Component
A vulnerability was determined in SourceCodester Online Class Record System 1.0. This issue affects some unknown processing of the file /admin/message/search.php. Executing a manipulation of the argument term can lead to sql injection. The attack can be execut
- 9.8 Critical severity
Online Class Record System: Improper Neutralization of Special Elements in Output Used by a Downstream Component
A vulnerability was found in SourceCodester Online Class Record System 1.0. This vulnerability affects unknown code of the file /admin/subject/controller.php. Performing a manipulation of the argument ID results in sql injection. Remote exploitation of the att
- 9.8 Critical severity
Online Class Record System: Improper Neutralization of Special Elements in Output Used by a Downstream Component
A flaw has been found in SourceCodester Online Class Record System 1.0. Affected by this issue is some unknown functionality of the file /admin/login.php. This manipulation of the argument user_email causes sql injection. The attack may be initiated remotely.
- 9.8 Critical severity
Medical Center Portal Management System: Improper Neutralization of Special Elements used in an SQL Command
A vulnerability has been found in SourceCodester Medical Center Portal Management System 1.0. Affected is an unknown function of the file /emp_edit1.php. Such manipulation of the argument ID leads to sql injection. The attack may be performed from remote. The
- 9.8 Critical severity
Medical Center Portal Management System: Improper Neutralization of Special Elements used in an SQL Command
A vulnerability was detected in SourceCodester Medical Center Portal Management System 1.0. This affects an unknown function of the file /login.php. The manipulation of the argument User results in sql injection. The attack can be executed remotely. The exploi
- 8.8 High severity
Pet Grooming Management Software: Incorrect Privilege Assignment
A vulnerability was detected in SourceCodester Pet Grooming Management Software 1.0. Impacted is an unknown function of the file /admin/operation/user.php of the component User Management. Performing a manipulation of the argument group_id results in improper
- 8.8 High severity
Client Database Management System: Improper Access Control
A flaw has been found in SourceCodester Client Database Management System 1.0. This affects an unknown part of the file /user_leads.php of the component Leads Generation Module. Executing manipulation can lead to unrestricted upload. The attack can be launched
- 7.2 High severity
Real Estate Property Listing App: Unrestricted Upload of File with Dangerous Type
A vulnerability has been found in SourceCodester Real Estate Property Listing App 1.0. The impacted element is an unknown function of the file /admin/property.php. Such manipulation of the argument image leads to unrestricted upload. It is possible to launch t
- 8.0 High severity
Inventory Management System: Improper Neutralization of Formula Elements in a CSV File
A security vulnerability has been detected in SourceCodester Inventory Management System 1.0. The affected element is an unknown function of the component SVC Report Export. Such manipulation leads to csv injection. It is possible to launch the attack remotely
- 7.5 High severity
Online Student Clearance System: Incorrect Privilege Assignment
A vulnerability was determined in SourceCodester Online Student Clearance System 1.0. The affected element is an unknown function of the file /Admin/delete-fee.php of the component Fee Table Handler. Executing manipulation of the argument ID can lead to improp
- 7.2 High severity
Online Student Clearance System: Improper Neutralization of Special Elements used in an SQL Command
A flaw has been found in SourceCodester Online Student Clearance System 1.0. Impacted is an unknown function of the file /Admin/changepassword.php. This manipulation of the argument txtconfirm_password causes sql injection. It is possible to initiate the attac
- 9.1 Critical severity
Inventory Management System: Weak Password Recovery Mechanism for Forgotten Password
A weakness has been identified in SourceCodester Inventory Management System 1.0. The affected element is an unknown function of the file /model/user/resetPassword.php. Executing manipulation can lead to weak password recovery. The attack may be performed from
- 7.1 High severity
Pre-School Management System: Improper Resource Shutdown or Release
A security flaw has been discovered in SourceCodester Pre-School Management System 1.0. Impacted is the function removefile of the file app/controllers/FilehelperController.php. Performing manipulation of the argument filepath results in denial of service. The
- 9.8 Critical severity
Company Website CMS: Improper Neutralization of Special Elements used in an SQL Command
A vulnerability was determined in SourceCodester Company Website CMS 1.0. This vulnerability affects unknown code of the file /admin/index.php. This manipulation of the argument Username causes sql injection. Remote exploitation of the attack is possible. The
- 9.8 Critical severity
Company Website CMS: Improper Neutralization of Special Elements used in an SQL Command
A vulnerability was found in SourceCodester Company Website CMS 1.0. This affects an unknown part of the file /admin/reset-password.php. The manipulation of the argument email results in sql injection. The attack may be launched remotely. The exploit has been
- 8.1 High severity
Alumni Management System: Missing Authorization
A weakness has been identified in SourceCodester Alumni Management System 1.0. This issue affects the function delete_forum/delete_career/delete_comment/delete_gallery/delete_event of the file admin/admin_class.php of the component Delete Handler. Executing ma
- 9.8 Critical severity
Online Shop Project: Improper Neutralization of Special Elements used in an SQL Command
A vulnerability was identified in SourceCodester Online Shop Project 1.0. The affected element is an unknown function of the file /action.php. Such manipulation of the argument Search leads to sql injection. It is possible to launch the attack remotely. The ex
- 8.8 High severity
Train Station Ticketing System: Improper Neutralization of Special Elements in Output Used by a Downstream Component
A flaw has been found in SourceCodester Train Station Ticketing System 1.0. This vulnerability affects unknown code of the file /ajax.php?action=save_user. Executing manipulation of the argument Username can lead to sql injection. The attack may be launched re
- 8.8 High severity
Train Station Ticketing System: Improper Neutralization of Special Elements in Output Used by a Downstream Component
A vulnerability was detected in SourceCodester Train Station Ticketing System 1.0. This affects an unknown part of the file /ajax.php?action=save_station. Performing manipulation of the argument id/station results in sql injection. The attack may be initiated
- 8.8 High severity
Train Station Ticketing System: Improper Neutralization of Special Elements used in an SQL Command
A security vulnerability has been detected in SourceCodester Train Station Ticketing System 1.0. Affected by this issue is some unknown functionality of the file /ajax.php?action=save_ticket. Such manipulation leads to sql injection. The attack can be launched