CVE-2026-104637

A weakness has been identified in onetwothreeneth HospitalManagementSystem up to 9ef91ed6007314b6473110ed699dff76d158f61d. The affected element is the function addpatient/addphysician/addaccount/updateaccount/updatesubaccount/editphysician/editpatient of the file php/controller.php. Executing a...

CVE-2026-78202 itsourcecode Payroll System admin_class.php save_settings unrestricted upload

A vulnerability was found in itsourcecode Payroll System 1.0. This affects the function savesettings of the file adminclass.php. The manipulation of the argument img results in unrestricted upload. The attack may be performed from remote. The exploit has been made public and could be used...

PT-2026-79831

Name of the Vulnerable Software and Affected Versions itsourcecode Payroll System version 1.0 Description An unrestricted file upload issue exists in the save settings function within the admin class.php file. A remote attacker can exploit this by manipulating the img argument to upload arbitrary...

CVE-2026-76995 SourceCodester Simple Online Food Ordering System ajax.php save_menu unrestricted upload

A vulnerability was identified in SourceCodester Simple Online Food Ordering System 1.0. This issue affects some unknown processing of the file /admin/ajax.php?action=savemenu. The manipulation of the argument img leads to unrestricted upload. The attack is possible to be carried out remotely. Th...

CVE-2026-76995

The description states the exploit is publicly available but no exploit code or proof-of-concept is included in the provided documents, so actual exploitation status cannot be confirmed here.

CVE-2026-3286 itwanger paicoding Image Save Endpoint ImageRestController.java save server-side request forgery

A vulnerability was identified in itwanger paicoding 1.0.0/1.0.1/1.0.2/1.0.3. The impacted element is the function Save of the file paicoding-web/src/main/java/com/github/paicoding/forum/web/common/image/rest/ImageRestController.java of the component Image Save Endpoint. Such manipulation of the...

CVE-2025-6873: Unrestricted Upload of File with Dangerous Type

A vulnerability, which was classified as critical, has been found in SourceCodester Simple Company Website 1.0. This issue affects some unknown processing of the file /classes/Users.php?f=save. The manipulation of the argument img leads to unrestricted upload. The attack may be initiated remotely...

CVE-2025-6870: Unrestricted Upload of File with Dangerous Type

A vulnerability was found in SourceCodester Simple Company Website 1.0. It has been rated as critical. Affected by this issue is some unknown functionality of the file /classes/Content.php?f=service. The manipulation of the argument img leads to unrestricted upload. The attack may be launched...

CVE-2025-6872: Unrestricted Upload of File with Dangerous Type

A vulnerability classified as critical was found in SourceCodester Simple Company Website 1.0. This vulnerability affects unknown code of the file /classes/SystemSettings.php?f=updatesettings. The manipulation of the argument img leads to unrestricted upload. The attack can be initiated remotely...

CVE-2025-4720: Improper Limitation of a Pathname to a Restricted Directory

A vulnerability was found in SourceCodester Student Result Management System 1.0. It has been declared as critical. This vulnerability affects unknown code of the file academic/core/dropstudent.php. The manipulation of the argument img leads to path traversal. The attack can be initiated remotely...

PT-2024-38390 · Itsourcecode · Itsourcecode Airline Reservation System

Name of the Vulnerable Software and Affected Versions: itsourcecode Airline Reservation System version 1.0 Description: A critical issue has been found in the itsourcecode Airline Reservation System, where the save settings function in the admin/admin class.php file is affected. The manipulation ...

CVE-2024-2156

CVE-2024-2156 affects SourceCodester Best POS Management System 1.0. The vulnerability is a SQL injection in an unknown function within admin_class.php, triggered by manipulating the img argument. The issue can be exploited remotely and a public exploit exists. Multiple connected sources corrobor...

CVE-2023-3970: Improper Neutralization of Input During Web Page Generation

A vulnerability, which was classified as problematic, was found in GZ Scripts Availability Booking Calendar PHP 1.0. This affects an unknown part of the file /index.php?controller=GzUser&action=edit&id=1 of the component Image Handler. The manipulation of the argument img leads to cross site...

PT-2023-17265 · Unknown · Sourcecodester Online Computer/Laptop Store

Name of the Vulnerable Software and Affected Versions: SourceCodester Online Computer and Laptop Store version 1.0 Description: A critical vulnerability was found in the software, affecting an unknown part of the file php-oclsadminsystem infoindex.php. The manipulation of the img argument leads t...

CVE-2023-1391: Unrestricted Upload of File with Dangerous Type

A vulnerability, which was classified as problematic, was found in SourceCodester Online Tours & Travels Management System 1.0. Affected is an unknown function of the file admin/ab.php. The manipulation of the argument img leads to unrestricted upload. It is possible to launch the attack remotely...