Vulnerability feed

CVE and vendor PSIRT advisories from 13 sources, last 30 days. Updated hourly, last run Oct 26 01:05 UTC

Critical in the last 24 hours

1603 in 30 days

Newly known exploited

In the last 24 hours, CISA KEV and vendor reports

Sources checked

Every hour, see the list

New in the last 24 hours

136-77% vs 7-day avg of 597

2 critical, 34 high, 59 medium, 21 low

Expand	Severity	Score	Advisory	Title	Source	Published
	Medium	5.5	CVE-2026-116062	A security flaw has been discovered in SourceCodester Performance Indicator System 1.0 SourceCodesterSourceCodester Performance Indicator System	NVD	Oct 25 18:16 UTC
CVE-2026-116062A security flaw has been discovered in SourceCodester Performance Indicator System 1.0 Executive summary A SQL injection flaw has been reported in the Performance Indicator System 1.0 from SourceCodester, a PHP and MySQLi web application. The advisory says an attacker can exploit it without logging in to read, change, or delete database data. The advisory does not state a severity rating, a fixed version, or a vendor patch. Technical summary The flaw is SQL injection in the 'contact' parameter of /opils/staff/save_profile.php, where user input is placed directly into SQL queries without validation. The advisory describes it as time-based blind and says no login or authorization is required. The affected version is listed as V1.0, and no fixed version is stated. No workaround is stated beyond the suggested repair of using prepared statements with parameter binding, strict input validation, least-privilege database accounts, and regular audits. The advisory gives no detection guidance, no CVSS score, and does not say whether exploitation in the wild has been observed. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from https://github.com/hubdk01/cve/issues/13 Impact if exploited ConfidentialityLow IntegrityLow AvailabilityLow How it is exploited Attack vector Network Attack complexity Low Attack requirements None Privileges required None User interaction None CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Affects SourceCodester SourceCodester Performance Indicator System NIST National Vulnerability DatabasePublished Oct 25, 2026 18:16 UTC Read the advisory
	Medium	5.5	CVE-2026-116061	A vulnerability was identified in SourceCodester Performance Indicator System 1.0 SourceCodesterSourceCodester Performance Indicator System	NVD	Oct 25 18:16 UTC
CVE-2026-116061A vulnerability was identified in SourceCodester Performance Indicator System 1.0 Executive summary A SQL injection flaw has been reported in the Performance Indicator System 1.0 from SourceCodester, a PHP and MySQLi application. The advisory says an attacker needs no login to exploit it, which could expose or change database contents. The advisory does not state a vendor fix or official severity score, and it recommends using prepared statements, input validation, least-privilege database accounts, and regular security audits. Technical summary The flaw is SQL injection in the 'contact' parameter of /opils/staff/edit_dealer.php, which the advisory says is passed directly into SQL queries without validation. The advisory describes it as time-based blind injection, reproduced with sqlmap, and says no login or authorization is required. The affected version is listed as V1.0; a fixed version is not stated. No workaround beyond the suggested code fixes (prepared statements, input validation, minimal database permissions) is given, and no CVSS score or detection guidance is stated. Exploitation in the wild is not stated. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from https://github.com/hubdk01/cve/issues/12 Impact if exploited ConfidentialityLow IntegrityLow AvailabilityLow How it is exploited Attack vector Network Attack complexity Low Attack requirements None Privileges required None User interaction None CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Affects SourceCodester SourceCodester Performance Indicator System NIST National Vulnerability DatabasePublished Oct 25, 2026 18:16 UTC Read the advisory
	Medium	5.5	CVE-2026-116060	A vulnerability was determined in SourceCodester Performance Indicator System 1.0 SourceCodesterSourceCodester Performance Indicator System	NVD	Oct 25 17:17 UTC
CVE-2026-116060A vulnerability was determined in SourceCodester Performance Indicator System 1.0 Executive summary A SQL injection flaw has been reported in the Performance Indicator System 1.0 from SourceCodester, a PHP and MySQLi application. The advisory says an attacker who needs no login could read, change, or delete database data and potentially disrupt the service. The advisory does not state a severity score or a vendor fix, and it recommends prepared statements, input validation, and least-privilege database accounts. Technical summary The flaw is a SQL injection in the 'contact' parameter of /opils/staff/adddealer.php, reached through a multipart/form-data POST request. The advisory states no login or authorization is required, and it describes a time-based blind variant that was confirmed with sqlmap. The affected version is listed as V1.0, and no fixed version is stated. No vendor patch, workaround beyond the suggested code fixes, CVSS score, or exploitation in the wild is stated. The suggested repair is to use prepared statements with parameter binding, validate and filter input, restrict database account privileges, and run regular security audits. The advisory gives no specific detection guidance such as log signatures. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from https://github.com/hubdk01/cve/issues/11 Impact if exploited ConfidentialityLow IntegrityLow AvailabilityLow How it is exploited Attack vector Network Attack complexity Low Attack requirements None Privileges required None User interaction None CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Affects SourceCodester SourceCodester Performance Indicator System NIST National Vulnerability DatabasePublished Oct 25, 2026 17:17 UTC Read the advisory
	Low	2.1	CVE-2026-116055	A vulnerability was detected in SourceCodester Performance Indicator System 1.0 SourceCodesterSourceCodester Performance Indicator System	NVD	Oct 25 15:17 UTC
CVE-2026-116055A vulnerability was detected in SourceCodester Performance Indicator System 1.0 Executive summary A SQL injection flaw was reported in the Performance Indicator System 1.0 from SourceCodester, a PHP and MySQLi web application. The advisory says an attacker needs no login to exploit it, which could expose or change database contents and disrupt the service. The advisory does not state a fixed version or a vendor patch, and it recommends code fixes such as prepared statements and input validation. Technical summary The flaw is SQL injection in the 'id' parameter of /opils/admin/deleteproduct.php, where user input is placed directly into SQL queries without validation. The advisory states that no login or authorization is required, and it provides a POST request example. Boolean-based blind and time-based blind techniques were demonstrated with sqlmap. The affected version is listed as V1.0, and no fixed version is stated. No vendor workaround is stated beyond the suggested remediation of parameterized queries, input filtering, least-privilege database accounts, and security audits. No detection guidance or CVSS score is stated. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from https://github.com/hubdk01/cve/issues/5 Impact if exploited ConfidentialityLow IntegrityLow AvailabilityLow How it is exploited Attack vector Network Attack complexity Low Attack requirements None Privileges required Low User interaction None CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Affects SourceCodester SourceCodester Performance Indicator System NIST National Vulnerability DatabasePublished Oct 25, 2026 15:17 UTC Read the advisory
	Medium	5.5	CVE-2026-114267	A vulnerability was detected in SourceCodester Food Order Management System 1.0 SourceCodesterSourceCodester Food Order Management System	NVD	Oct 21 19:17 UTC
CVE-2026-114267A vulnerability was detected in SourceCodester Food Order Management System 1.0 From the advisory A vulnerability was detected in SourceCodester Food Order Management System 1.0. Affected is an unknown function of the component Admin Endpoint. The manipulation results in missing authorization. The attack may be performed from remote. The exploit is now public and may be used. Impact if exploited ConfidentialityLow IntegrityLow AvailabilityLow How it is exploited Attack vector Network Attack complexity Low Attack requirements None Privileges required None User interaction None CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Affects SourceCodester SourceCodester Food Order Management System NIST National Vulnerability DatabasePublished Oct 21, 2026 19:17 UTC Read the advisory
	Medium	5.1	CVE-2026-112097	A vulnerability was found in SourceCodester Inventory System 1.0 SourceCodesterSourceCodester Inventory System	NVD	Oct 19 09:17 UTC
CVE-2026-112097A vulnerability was found in SourceCodester Inventory System 1.0 From the advisory A vulnerability was found in SourceCodester Inventory System 1.0. This issue affects some unknown processing of the file /api/transactions_handler.php?action=save_sale of the component Sales Management Handler. The manipulation of the argument Hsn_Code results in cross site scripting. It is possible to launch the attack remotely. Impact if exploited ConfidentialityNone IntegrityLow AvailabilityNone How it is exploited Attack vector Network Attack complexity Low Attack requirements None Privileges required Low User interaction Passive CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Affects SourceCodester SourceCodester Inventory System NIST National Vulnerability DatabasePublished Oct 19, 2026 09:17 UTC Read the advisory
	Low	2.0	CVE-2026-112096	A vulnerability has been found in SourceCodester Inventory System 1.0 SourceCodesterSourceCodester Inventory System	NVD	Oct 19 09:17 UTC
CVE-2026-112096A vulnerability has been found in SourceCodester Inventory System 1.0 From the advisory A vulnerability has been found in SourceCodester Inventory System 1.0. This vulnerability affects unknown code of the file /api/transactions_handler.php?action=save_purchase of the component Purchase Records Handler. The manipulation of the argument Product_Name/Product_Code/Vendor_Name leads to cross site scripting. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. Impact if exploited ConfidentialityNone IntegrityLow AvailabilityNone How it is exploited Attack vector Network Attack complexity Low Attack requirements None Privileges required Low User interaction Passive CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Affects SourceCodester SourceCodester Inventory System NIST National Vulnerability DatabasePublished Oct 19, 2026 09:17 UTC Read the advisory
	Low	2.0	CVE-2026-112095	A flaw has been found in SourceCodester Inventory System 1.0 SourceCodesterSourceCodester Inventory System	NVD	Oct 19 09:17 UTC
CVE-2026-112095A flaw has been found in SourceCodester Inventory System 1.0 From the advisory A flaw has been found in SourceCodester Inventory System 1.0. This affects an unknown part of the file /api/products_handler.php?action=save of the component Product Management. Executing a manipulation of the argument Product_Id/Product_Name can lead to cross site scripting. The attack may be performed from remote. The exploit has been published and may be used. Impact if exploited ConfidentialityNone IntegrityLow AvailabilityNone How it is exploited Attack vector Network Attack complexity Low Attack requirements None Privileges required Low User interaction Passive CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Affects SourceCodester SourceCodester Inventory System NIST National Vulnerability DatabasePublished Oct 19, 2026 09:17 UTC Read the advisory
	Medium	5.5	CVE-2026-109620	A vulnerability has been found in SourceCodester Online Reviewer System 1.0 SourceCodesterSourceCodester Online Reviewer System	NVD	Oct 13 17:17 UTC
CVE-2026-109620A vulnerability has been found in SourceCodester Online Reviewer System 1.0 From the advisory A vulnerability has been found in SourceCodester Online Reviewer System 1.0. Affected by this vulnerability is the function PDO::prepare of the file login/index.php. Such manipulation of the argument username/password leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. Impact if exploited ConfidentialityLow IntegrityLow AvailabilityLow How it is exploited Attack vector Network Attack complexity Low Attack requirements None Privileges required None User interaction None CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Affects SourceCodester SourceCodester Online Reviewer System NIST National Vulnerability DatabasePublished Oct 13, 2026 17:17 UTC Read the advisory
	Medium	5.5	CVE-2026-109607	A flaw has been found in SourceCodester Online Exam System 1.0 SourceCodesterSourceCodester Online Exam System	NVD	Oct 13 17:17 UTC
CVE-2026-109607A flaw has been found in SourceCodester Online Exam System 1.0 From the advisory A flaw has been found in SourceCodester Online Exam System 1.0. Affected is an unknown function of the file adminpanel/admin/query/loginExe.php of the component Login Endpoint. This manipulation of the argument username/pass causes sql injection. It is possible to initiate the attack remotely. The exploit has been published and may be used. Impact if exploited ConfidentialityLow IntegrityLow AvailabilityLow How it is exploited Attack vector Network Attack complexity Low Attack requirements None Privileges required None User interaction None CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Affects SourceCodester SourceCodester Online Exam System NIST National Vulnerability DatabasePublished Oct 13, 2026 17:17 UTC Read the advisory
	Medium	5.5	CVE-2026-109606	A vulnerability was detected in SourceCodester Art Gallery Management System 1.0 SourceCodesterSourceCodester Art Gallery Management System	NVD	Oct 13 17:17 UTC
CVE-2026-109606A vulnerability was detected in SourceCodester Art Gallery Management System 1.0 From the advisory A vulnerability was detected in SourceCodester Art Gallery Management System 1.0. This impacts the function Action::save_user of the file admin/admin_class.php of the component Account Creation. The manipulation of the argument Name results in sql injection. The attack may be performed from remote. The exploit is now public and may be used. Impact if exploited ConfidentialityLow IntegrityLow AvailabilityLow How it is exploited Attack vector Network Attack complexity Low Attack requirements None Privileges required None User interaction None CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Affects SourceCodester SourceCodester Art Gallery Management System NIST National Vulnerability DatabasePublished Oct 13, 2026 17:17 UTC Read the advisory
	Medium	5.5	CVE-2026-109605	A security vulnerability has been detected in SourceCodester Simple Cafe Billing System 1.0 SourceCodesterSourceCodester Simple Cafe Billing System	NVD	Oct 13 16:17 UTC
CVE-2026-109605A security vulnerability has been detected in SourceCodester Simple Cafe Billing System 1.0 From the advisory A security vulnerability has been detected in SourceCodester Simple Cafe Billing System 1.0. This affects the function Action::save_user of the file admin_class.php of the component User Management. The manipulation of the argument Type leads to improper authorization. The attack is possible to be carried out remotely. The exploit has been disclosed publicly and may be used. Impact if exploited ConfidentialityLow IntegrityLow AvailabilityLow How it is exploited Attack vector Network Attack complexity Low Attack requirements None Privileges required None User interaction None CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Affects SourceCodester SourceCodester Simple Cafe Billing System NIST National Vulnerability DatabasePublished Oct 13, 2026 16:17 UTC Read the advisory
	Medium	5.5	CVE-2026-108975	A security flaw has been discovered in SourceCodester Library Management System 1.0 SourceCodesterSourceCodester Library Management System	NVD	Oct 13 07:16 UTC
CVE-2026-108975A security flaw has been discovered in SourceCodester Library Management System 1.0 From the advisory A security flaw has been discovered in SourceCodester Library Management System 1.0. This vulnerability affects the function move_uploaded_file of the file admin/add_admin.php. Performing a manipulation of the argument image results in unrestricted upload. The attack may be initiated remotely. The exploit has been released to the public and may be used for attacks. Impact if exploited ConfidentialityLow IntegrityLow AvailabilityLow How it is exploited Attack vector Network Attack complexity Low Attack requirements None Privileges required None User interaction None CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Affects SourceCodester SourceCodester Library Management System NIST National Vulnerability DatabasePublished Oct 13, 2026 07:16 UTC Read the advisory
	Medium	5.5	CVE-2026-108974	A vulnerability was identified in SourceCodester E-Learning System 1.0 SourceCodesterSourceCodester E-Learning System	NVD	Oct 13 07:16 UTC
CVE-2026-108974A vulnerability was identified in SourceCodester E-Learning System 1.0 From the advisory A vulnerability was identified in SourceCodester E-Learning System 1.0. This affects the function save_users of the file /classes/Users.php?f=save. Such manipulation of the argument img leads to unrestricted upload. The attack can be launched remotely. The exploit is publicly available and might be used. Impact if exploited ConfidentialityLow IntegrityLow AvailabilityLow How it is exploited Attack vector Network Attack complexity Low Attack requirements None Privileges required None User interaction None CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Affects SourceCodester SourceCodester E-Learning System NIST National Vulnerability DatabasePublished Oct 13, 2026 07:16 UTC Read the advisory
	Medium	5.5	CVE-2026-108973	A vulnerability was determined in SourceCodester Contact Tracing System 1.0 SourceCodesterSourceCodester Contact Tracing System	NVD	Oct 13 07:16 UTC
CVE-2026-108973A vulnerability was determined in SourceCodester Contact Tracing System 1.0 From the advisory A vulnerability was determined in SourceCodester Contact Tracing System 1.0. Affected by this issue is the function move_uploaded_file of the file /classes/Users.php?f=save. This manipulation of the argument img/id causes unrestricted upload. The attack can be initiated remotely. The exploit has been publicly disclosed and may be utilized. Impact if exploited ConfidentialityLow IntegrityLow AvailabilityLow How it is exploited Attack vector Network Attack complexity Low Attack requirements None Privileges required None User interaction None CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Affects SourceCodester SourceCodester Contact Tracing System NIST National Vulnerability DatabasePublished Oct 13, 2026 07:16 UTC Read the advisory
	Medium	5.5	CVE-2026-108972	A vulnerability was found in SourceCodester Human Resource Management System 1.0 SourceCodesterSourceCodester Human Resource Management System	NVD	Oct 13 06:16 UTC
CVE-2026-108972A vulnerability was found in SourceCodester Human Resource Management System 1.0 From the advisory A vulnerability was found in SourceCodester Human Resource Management System 1.0. Affected by this vulnerability is the function session_start of the file controller/employee.php of the component Employee Endpoint. The manipulation of the argument role/pfimg/EmpId results in improper authentication. It is possible to launch the attack remotely. The exploit has been made public and could be used. Impact if exploited ConfidentialityLow IntegrityLow AvailabilityLow How it is exploited Attack vector Network Attack complexity Low Attack requirements None Privileges required None User interaction None CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Affects SourceCodester SourceCodester Human Resource Management System NIST National Vulnerability DatabasePublished Oct 13, 2026 06:16 UTC Read the advisory
	Medium	5.5	CVE-2026-108968	A weakness has been identified in SourceCodester Performance Indicator System 1.0 SourceCodesterSourceCodester Performance Indicator System	NVD	Oct 13 05:16 UTC
CVE-2026-108968A weakness has been identified in SourceCodester Performance Indicator System 1.0 From the advisory A weakness has been identified in SourceCodester Performance Indicator System 1.0. The affected element is an unknown function of the file /opils/staff/sales_history.php. This manipulation of the argument ID causes sql injection. Remote exploitation of the attack is possible. The exploit has been made available to the public and could be used for attacks. Impact if exploited ConfidentialityLow IntegrityLow AvailabilityLow How it is exploited Attack vector Network Attack complexity Low Attack requirements None Privileges required None User interaction None CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Affects SourceCodester SourceCodester Performance Indicator System NIST National Vulnerability DatabasePublished Oct 13, 2026 05:16 UTC Read the advisory
	Medium	5.5	CVE-2026-108967	A security flaw has been discovered in SourceCodester Performance Indicator System 1.0 SourceCodesterSourceCodester Performance Indicator System	NVD	Oct 13 05:16 UTC
CVE-2026-108967A security flaw has been discovered in SourceCodester Performance Indicator System 1.0 From the advisory A security flaw has been discovered in SourceCodester Performance Indicator System 1.0. Impacted is an unknown function of the file /opils/staff/edit_credit.php. The manipulation of the argument credit results in sql injection. The attack may be launched remotely. The exploit has been released to the public and may be used for attacks. Impact if exploited ConfidentialityLow IntegrityLow AvailabilityLow How it is exploited Attack vector Network Attack complexity Low Attack requirements None Privileges required None User interaction None CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Affects SourceCodester SourceCodester Performance Indicator System NIST National Vulnerability DatabasePublished Oct 13, 2026 05:16 UTC Read the advisory
	Medium	5.5	CVE-2026-108966	A vulnerability was identified in SourceCodester Performance Indicator System 1.0 SourceCodesterSourceCodester Performance Indicator System	NVD	Oct 13 05:16 UTC
CVE-2026-108966A vulnerability was identified in SourceCodester Performance Indicator System 1.0 From the advisory A vulnerability was identified in SourceCodester Performance Indicator System 1.0. This issue affects some unknown processing of the file /opils/staff/product.php. The manipulation of the argument Category leads to sql injection. The attack may be initiated remotely. The exploit is publicly available and might be used. Impact if exploited ConfidentialityLow IntegrityLow AvailabilityLow How it is exploited Attack vector Network Attack complexity Low Attack requirements None Privileges required None User interaction None CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Affects SourceCodester SourceCodester Performance Indicator System NIST National Vulnerability DatabasePublished Oct 13, 2026 05:16 UTC Read the advisory
	Medium	5.5	CVE-2026-108965	A vulnerability was determined in SourceCodester Performance Indicator System 1.0 SourceCodesterSourceCodester Performance Indicator System	NVD	Oct 13 04:17 UTC
CVE-2026-108965A vulnerability was determined in SourceCodester Performance Indicator System 1.0 From the advisory A vulnerability was determined in SourceCodester Performance Indicator System 1.0. This vulnerability affects unknown code of the file /opils/staff/edit_quantity.php. Executing a manipulation of the argument pqty can lead to sql injection. The attack can be launched remotely. The exploit has been publicly disclosed and may be utilized. Impact if exploited ConfidentialityLow IntegrityLow AvailabilityLow How it is exploited Attack vector Network Attack complexity Low Attack requirements None Privileges required None User interaction None CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Affects SourceCodester SourceCodester Performance Indicator System NIST National Vulnerability DatabasePublished Oct 13, 2026 04:17 UTC Read the advisory
	Medium	5.5	CVE-2026-108964	A vulnerability was found in SourceCodester Performance Indicator System 1.0 SourceCodesterSourceCodester Performance Indicator System	NVD	Oct 13 04:17 UTC
CVE-2026-108964A vulnerability was found in SourceCodester Performance Indicator System 1.0 From the advisory A vulnerability was found in SourceCodester Performance Indicator System 1.0. This affects an unknown part of the file /opils/admin/addproduct.php. Performing a manipulation of the argument prodcategory results in sql injection. The attack can be initiated remotely. The exploit has been made public and could be used. Impact if exploited ConfidentialityLow IntegrityLow AvailabilityLow How it is exploited Attack vector Network Attack complexity Low Attack requirements None Privileges required None User interaction None CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Affects SourceCodester SourceCodester Performance Indicator System NIST National Vulnerability DatabasePublished Oct 13, 2026 04:17 UTC Read the advisory
	Low	2.1	CVE-2026-108920	A security vulnerability has been detected in SourceCodester Drug Recommendation System 1.0 SourceCodesterSourceCodester Drug Recommendation System	NVD	Oct 12 19:16 UTC
CVE-2026-108920A security vulnerability has been detected in SourceCodester Drug Recommendation System 1.0 From the advisory A security vulnerability has been detected in SourceCodester Drug Recommendation System 1.0. This affects an unknown function of the file Admin/user_record.php of the component Admin Record Tables. Such manipulation of the argument name/email leads to cross site scripting. The attack can be launched remotely. The exploit has been disclosed publicly and may be used. Impact if exploited ConfidentialityNone IntegrityLow AvailabilityNone How it is exploited Attack vector Network Attack complexity Low Attack requirements None Privileges required None User interaction Passive CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Affects SourceCodester SourceCodester Drug Recommendation System NIST National Vulnerability DatabasePublished Oct 12, 2026 19:16 UTC Read the advisory
	Low	2.1	CVE-2026-108919	A weakness has been identified in SourceCodester Drug Recommendation System 1.0 SourceCodesterSourceCodester Drug Recommendation System	NVD	Oct 12 19:16 UTC
CVE-2026-108919A weakness has been identified in SourceCodester Drug Recommendation System 1.0 From the advisory A weakness has been identified in SourceCodester Drug Recommendation System 1.0. The impacted element is an unknown function of the file Auth/add_student.php of the component Student Registration. This manipulation of the argument txtname/txtpassword/txtemail/txtphone/txtprevious_school causes cross site scripting. The attack can be initiated remotely. The exploit has been made available to the public and could be used for attacks. Impact if exploited ConfidentialityNone IntegrityLow AvailabilityNone How it is exploited Attack vector Network Attack complexity Low Attack requirements None Privileges required None User interaction Passive CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Affects SourceCodester SourceCodester Drug Recommendation System NIST National Vulnerability DatabasePublished Oct 12, 2026 19:16 UTC Read the advisory
	Low	2.1	CVE-2026-105957	A vulnerability was detected in SourceCodester Performance Indicator System 1.0 SourceCodesterSourceCodester Performance Indicator System	NVD	Oct 6 17:17 UTC
CVE-2026-105957A vulnerability was detected in SourceCodester Performance Indicator System 1.0 From the advisory A vulnerability was detected in SourceCodester Performance Indicator System 1.0. The affected element is an unknown function of the file /opils/admin/view_product.php. Performing a manipulation of the argument Category results in sql injection. Remote exploitation of the attack is possible. The exploit is now public and may be used. Impact if exploited ConfidentialityLow IntegrityLow AvailabilityLow How it is exploited Attack vector Network Attack complexity Low Attack requirements None Privileges required Low User interaction None CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Affects SourceCodester SourceCodester Performance Indicator System NIST National Vulnerability DatabasePublished Oct 6, 2026 17:17 UTC Read the advisory
	Low	2.1	CVE-2026-105809	A vulnerability was identified in SourceCodester Simple Student Information System 1.0 SourceCodesterSourceCodester Simple Student Information System	NVD	Oct 6 09:17 UTC
CVE-2026-105809A vulnerability was identified in SourceCodester Simple Student Information System 1.0 From the advisory A vulnerability was identified in SourceCodester Simple Student Information System 1.0. This issue affects some unknown processing of the file /register.php of the component Profile Field Handler. The manipulation of the argument firstname/lastname leads to cross site scripting. The attack may be initiated remotely. The exploit is publicly available and might be used. Impact if exploited ConfidentialityNone IntegrityLow AvailabilityNone How it is exploited Attack vector Network Attack complexity Low Attack requirements None Privileges required None User interaction Passive CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Affects SourceCodester SourceCodester Simple Student Information System NIST National Vulnerability DatabasePublished Oct 6, 2026 09:17 UTC Read the advisory

Example	Finds
	Every word appears somewhere: title, summaries, IDs, vendor, or product
	An exact phrase
	One vendor. product: for a product, vp: for either
	Commas mean any of them, in every field
	Severity: critical, high, medium, low, or unknown
	CVSS score, with >, >=, <, or <=
	A score range
	Known exploited. is:kev works too, and kev:no leaves them out
	One source, by name
	Confidentiality impact: high, low, none, or any (low or high)
	Integrity and availability work the same way
	An advisory or CVE ID, or part of one
	A minus sign leaves out whatever the term matches

Vulnerability feed

Executive summary

Technical summary

Impact if exploited

How it is exploited

Affects

Executive summary

Technical summary

Impact if exploited

How it is exploited

Affects

Executive summary

Technical summary

Impact if exploited

How it is exploited

Affects

Executive summary

Technical summary

Impact if exploited

How it is exploited

Affects

From the advisory

Impact if exploited

How it is exploited

Affects

From the advisory

Impact if exploited

How it is exploited

Affects

From the advisory

Impact if exploited

How it is exploited

Affects

From the advisory

Impact if exploited

How it is exploited

Affects

From the advisory

Impact if exploited

How it is exploited

Affects

From the advisory

Impact if exploited

How it is exploited

Affects

From the advisory

Impact if exploited

How it is exploited

Affects

From the advisory

Impact if exploited

How it is exploited

Affects

From the advisory

Impact if exploited

How it is exploited

Affects

From the advisory

Impact if exploited

How it is exploited

Affects

From the advisory

Impact if exploited

How it is exploited

Affects

From the advisory

Impact if exploited

How it is exploited

Affects

From the advisory

Impact if exploited

How it is exploited

Affects

From the advisory

Impact if exploited

How it is exploited

Affects

From the advisory

Impact if exploited

How it is exploited