These pages are published after PatchSiren validates generated defensive summaries against stored public CVE and source evidence.
A vulnerability was identified in Online Book Store System 1.0, affecting the User Management Module. The issue allows for cross-site scripting due to improper handling of user input, such as Name/Username. The attack can be executed remotely. Users should review system configurations and apply necessary patches. This vulnerability has a CVSS score of 1.9, indicating low severity. The exploit is publicly [truncated]
A SQL injection vulnerability was found in the Simple and Nice Shopping Cart Script 1.0. The vulnerability affects an unknown function of the file /admin/login.php in the Admin Login component. The manipulation of the Username argument results in SQL injection. The attack can be launched remotely. The exploit has been made public and could be used. The CVSS score for this vulnerability is 5.5, with a seve [truncated]
A SQL injection vulnerability was identified in the Class and Exam Timetabling System 1.0. The vulnerability affects an unknown functionality of the /edit_class2.php file. The manipulation of the ID argument leads to SQL injection. The attack can be carried out remotely. The exploit is publicly available and might be used. The CVSS score for this vulnerability is 5.5, indicating a medium severity level.
A SQL injection vulnerability was discovered in the SourceCodester Class and Exam Timetabling System 1.0. The issue affects an unknown functionality within the /edit_course.php file. By manipulating the ID argument, an attacker can inject malicious SQL code, enabling remote attacks. The vulnerability has been publicly disclosed and may be exploited. Evidence from Vuldb and NVD confirms the vulnerability's [truncated]
A SQL injection vulnerability has been discovered in the Class and Exam Timetabling System 1.0. The affected component is an unknown function within the /preview4.php file. This vulnerability allows for SQL injection through manipulation of the course_year_section argument. The attack can be initiated remotely. The exploit has been publicly disclosed and may be utilized. The CVSS score for this vulnerabil [truncated]
CVE-2026-13486 is a SQL injection vulnerability in the SourceCodester Class and Exam Timetabling System 1.0. The vulnerability is located in the /preview6.php file, where an attacker can manipulate the course_year_section argument to inject malicious SQL code. This can be done remotely, and the exploit has been publicly disclosed. The vulnerability has a CVSS score of 5.5 and a severity of MEDIUM. The ven [truncated]
CVE-2026-13485 is a SQL injection vulnerability in the Class and Exam Timetabling System 1.0. The vulnerability affects an unknown function of the file /preview.php and can be exploited remotely by manipulating the course_year_section argument. The vulnerability has a CVSS score of 5.5 and a severity of MEDIUM. The exploit has been made public and could be used. The vendor is Unknown Vendor, and the produ [truncated]
CVE-2026-12529 is a MEDIUM severity vulnerability in the SourceCodester CET Automated Grading System with AI Predictive Analytics 1.0. The vulnerability affects an unknown function of the file /index.php of the component Student Self-Registration Endpoint, allowing for improper access controls. Remote exploitation of the attack is possible. Administrators and users of the system should be aware of this vu [truncated]
A vulnerability has been found in SourceCodester CET Automated Grading System with AI Predictive Analytics 1.0. The impacted element is an unknown function of the file /index.php. The manipulation of the argument action leads to cross site scripting. The attack is possible to be carried out remotely. The exploit has been disclosed to the public and may be used.
A vulnerability has been found in SourceCodester Online Examination & Learning Management System and Syllabus-aligned Learning Management and Examination System 1.0. Affected by this issue is some unknown functionality of the file import_users.php. The manipulation of the argument raw_password with the input CICT_2026 leads to use of hard-coded password. The attack can be initiated remotely.
A weakness has been identified in SourceCodester Inventory System 1.0. The issue affects an unknown functionality of the file `header.php`, enabling cross-site scripting through manipulation. The attack can be initiated remotely, and a public exploit is available.
A security flaw has been discovered in SourceCodester Inventory System 1.0. Affected by this vulnerability is an unknown functionality of the file /Product_Inventory/api/users_handler.php of the component Account Creation Handler. The manipulation of the argument ROLE results in improper authorization. The attack may be performed from remote. The exploit has been released to the public and may be used for attacks.
A vulnerability was found in SourceCodester Barangay Resident Profiling and Information Management System 1.0. The affected component is the password reset handler in the file `password_reset.php`. Manipulating the `new_password` argument with the input `password123` leads to the use of a hard-coded password. This attack can be launched remotely. The exploit has been publicly disclosed and may be used.
A SQL injection vulnerability was detected in SourceCodester Class and Exam Timetabling System 1.0. The vulnerability affects an unknown functionality of the file /archive1.php and can be exploited remotely. The exploit is publicly available.
CVE-2026-11485 is a SQL injection vulnerability in SourceCodester Class and Exam Timetabling System 1.0. The vulnerability has a CVSS score of 5.5 and was first published on [cvePublishedAt](https://www.cve.org/CVERecord?id=CVE-2026-11485). The vulnerability affects an unknown function of the file /archive2.php and can be exploited remotely. The vulnerability is caused by manipulation of the argument sy, [truncated]
A weakness has been identified in SourceCodester Class and Exam Timetabling System 1.0. This impacts an unknown function of the file /archive3.php. This manipulation of the argument sy causes sql injection. The attack may be initiated remotely. The exploit has been made available to the public and could be used for attacks.
A security flaw has been discovered in SourceCodester Class and Exam Timetabling System 1.0. This affects an unknown function of the file /archive4.php. The manipulation of the argument sy results in SQL injection. The attack can be launched remotely. The exploit has been released to the public and may be used for attacks.
A SQL injection vulnerability was identified in SourceCodester Class and Exam Timetabling System 1.0. The vulnerability is located in an unknown function of the file /archive5.php and can be exploited remotely by manipulating the 'sy' argument. The vulnerability has a CVSS score of 5.5 and is rated as MEDIUM. The exploit is publicly available and might be used.
A SQL injection vulnerability was discovered in SourceCodester Class and Exam Timetabling System 1.0. The vulnerability affects an unknown function of the file /index1.php, specifically through manipulation of the Password argument. This vulnerability can be exploited remotely. The exploit has been publicly disclosed and may be utilized.
A SQL injection vulnerability was found in SourceCodester Class and Exam Timetabling System 1.0. The vulnerability is located in an unknown function of the file /index2.php and can be exploited remotely by manipulating the Password argument. The vulnerability has a CVSS score of 5.5 and is rated as MEDIUM.
A cross-site scripting vulnerability was detected in the SourceCodester Hospitals Patient Records Management System 1.0. The issue affects unknown processing of the file /admin/?page=room_types, where manipulation of the 'room' argument results in cross-site scripting. The attack can be carried out remotely.
A SQL injection vulnerability has been detected in the SourceCodester Ship Ferry Ticket Reservation System up to version 1.0. The vulnerability affects an unknown function in the `/admin/login.php` file of the Admin Login component. Manipulation of the `Username` argument leads to SQL injection, allowing remote attackers to execute the attack. The exploit has been publicly disclosed and may be used. The C [truncated]
A weakness has been identified in SourceCodester Ship Ferry Ticket Reservation System 1.0. This affects an unknown function of the file /admin/. This manipulation of the argument page causes improper authorization. Remote exploitation of the attack is possible. The exploit has been made available to the public and could be used for attacks.
A SQL injection vulnerability exists in SourceCodester Computer Repair Shop Management System up to version 1.0. The vulnerability is located in the /admin/products/manage_product.php file, where manipulation of the ID parameter allows an attacker to inject arbitrary SQL commands. The attack vector is network-based and does not require authentication, making it remotely exploitable. The vulnerability has [truncated]
A CSV injection vulnerability exists in SourceCodester Pharmacy Sales and Inventory System up to version 1.0, specifically within the Supplier Creation Interface. The flaw resides in the create_supplier function of the /Export_csv/export file, where the Address and Company Name parameters are not properly sanitized before being written to CSV output. An attacker with sufficient privileges can inject malic [truncated]
A stored cross-site scripting (XSS) vulnerability exists in SourceCodester Pharmacy Sales and Inventory System 1.0, specifically within the `create_generic_name` function accessible via the `/ShowForm/create_generic_name/main` endpoint. The `generic_name` parameter lacks sufficient input sanitization, allowing remote attackers to inject malicious scripts. The vulnerability requires low privileges (PR:L) a [truncated]
A stored cross-site scripting (XSS) vulnerability exists in SourceCodester Pharmacy Sales and Inventory System 1.0, specifically within the create_medicine_presentation function accessible via the /ShowForm/create_medicine_presentation/main endpoint. The medicine_presentation parameter accepts unsanitized input, allowing remote attackers to inject malicious scripts. The vulnerability has been publicly dis [truncated]
A stored cross-site scripting (XSS) vulnerability exists in SourceCodester Pharmacy Sales and Inventory System 1.0, specifically within the create_supplier function accessible via the /ShowForm/create_supplier/main endpoint. The company_name parameter lacks sufficient input sanitization, allowing remote attackers to inject malicious scripts. The vulnerability has been assigned a LOW severity CVSS score of [truncated]
A stored cross-site scripting (XSS) vulnerability exists in the SourceCodester Pharmacy Sales and Inventory System 1.0, specifically within the create_medicine_name function accessible via the /ShowForm/create_medicine_name/main file path. The vulnerability allows remote attackers to inject malicious scripts through the medicine_name parameter. The CVSS 4.0 vector indicates network attack vector, low atta [truncated]
A SQL injection vulnerability exists in SourceCodester Hospitals Patient Records Management System 1.0, specifically in the /classes/Users.php?f=save endpoint. The vulnerability is triggered by manipulation of the ID argument, allowing remote attackers to inject arbitrary SQL commands. The CVSS 4.0 vector indicates network attack vector with low complexity, no required privileges, and no user interaction, [truncated]
