oretnom23 has 31 CVEs on record between 2022 and 2026. Disclosure cadence is accelerating: 17 in the last 90 days against 0 in the 90 before. The busiest recent month was October 2026 with 17. The median CVSS is 7.3 (high), with 3 rated critical. None have a confirmed exploitation report. The dominant weakness classes are CWE-89 (20) and CWE-74 (18). Most affected products: php-travel-agency-system (9), file-management-system-php (8), banking_system (4).
CVEs per month
Last 12 months, by publish date
- Exploited share
- 0% vs 1% corpus
- Median CVSS
- 7.3
- Publish → KEV
- —
- Last 90 days
- 17 prev 0
Products
- php-travel-agency-system 9
- file-management-system-php 8
- banking_system 4
- online_magazine_management_system 2
- online_student_result_system 2
- customer_support_system 1
Worst active — by depth score
CVE-2025-70141Critical· 9.4SourceCodester Customer Support System 1.0 contains an incorrect access control vulnerability in ajax.php64CVE-2022-26646Critical· 9.8Online Banking System Protect v1.0 was discovered to contain a local file inclusion (LFI) vulnerability via the pages parameter.54CVE-2022-26645Critical· 9.8A remote code execution (RCE) vulnerability in Online Banking System Protect v1.0 allows attackers to execute arbitrary code via a crafted PHP file uploaded through the Upload Image function.54CVE-2026-114577High· 7.3oretnom23 php-travel-agency-system Insertion insert.php sql injection52CVE-2026-114441High· 7.3oretnom23 php-travel-agency-system update.php sql injection52
oretnom23 vulnerabilities
CVEs affecting oretnom23, newest first. Open any entry for full detail, references, and exploit status.
31 CVEsRSS
CVE-2026-117516High· 7.3oretnom23 php-travel-agency-system Contact Form contact_insert.php sql injection
A weakness has been identified in oretnom23 php-travel-agency-system. The affected element is an unknown function of the file contact_insert.php of the component Contact Form Handler. This manipulation of the argument name/company/email/…
CVE-2026-117512High· 7.3oretnom23 php-travel-agency-system employee_insert.php unrestricted upload
A vulnerability was found in oretnom23 php-travel-agency-system. This affects an unknown part of the file admin/employee_insert.php. Performing a manipulation of the argument employee photo results in unrestricted upload. The attack is p…
CVE-2026-117513High· 7.3oretnom23 php-travel-agency-system Admin Search Pages customer_search.php sql injection
A vulnerability was determined in oretnom23 php-travel-agency-system. This vulnerability affects unknown code of the file admin/customer_search.php of the component Admin Search Pages. Executing a manipulation of the argument customer_na…
CVE-2026-117514High· 7.3oretnom23 php-travel-agency-system Admin Record Pages customer_detail.php sql injection
A vulnerability was identified in oretnom23 php-travel-agency-system. This issue affects some unknown processing of the file admin/customer_detail.php of the component Admin Record Pages. The manipulation of the argument costomer_id/tick…
CVE-2026-117515High· 7.3oretnom23 php-travel-agency-system traceapplication.php sql injection
A security flaw has been discovered in oretnom23 php-travel-agency-system 4e28b8f84d72420373dd15c3ae32900beb7e0635. Impacted is an unknown function of the file traceapplication.php. The manipulation of the argument Search results in sql …
CVE-2026-114577High· 7.3PoCoretnom23 php-travel-agency-system Insertion insert.php sql injection
A vulnerability was found in oretnom23 php-travel-agency-system. This vulnerability affects unknown code of the file admin/insert.php of the component Insertion Handler. The manipulation of the argument costomer_id/payment_type/amount/de…
CVE-2026-114439High· 7.3PoCoretnom23 php-travel-agency-system Session session.php missing authentication
A vulnerability was determined in oretnom23 php-travel-agency-system. Affected by this issue is some unknown functionality of the file admin/session.php of the component Session Handler. Executing a manipulation of the argument user_id c…
CVE-2026-114441High· 7.3PoCoretnom23 php-travel-agency-system update.php sql injection
A weakness has been identified in oretnom23 php-travel-agency-system. This issue affects some unknown processing of the file admin/update.php. This manipulation of the argument action/full_name/visa_no/hiden/title/description/page_id/use…
CVE-2026-114440High· 7.3oretnom23 php-travel-agency-system delete.php sql injection
A vulnerability was identified in oretnom23 php-travel-agency-system. This affects an unknown part of the file admin/delete.php. The manipulation of the argument costomer_id/ticket_id/payment_id/id/document_id/salary_id/emp_id/user_id le…
CVE-2026-114258High· 7.3PoCoretnom23 file-management-system-php File Management files.php sql injection
A vulnerability was detected in oretnom23 file-management-system-php up to 2e3c1ebe60f121e8df4fb3f544f0e9591d9a01e4. Affected by this issue is some unknown functionality of the file files.php of the component File Management. Performing …
CVE-2026-114259High· 7.3oretnom23 file-management-system-php admin_class.php save_files unrestricted upload
A flaw has been found in oretnom23 file-management-system-php up to 2e3c1ebe60f121e8df4fb3f544f0e9591d9a01e4. This affects the function save_files of the file admin_class.php. Executing a manipulation of the argument Upload can lead to u…
CVE-2026-114260Medium· 6.5PoCoretnom23 file-management-system-php AJAX ajax.php delete_folder missing authentication
A vulnerability has been found in oretnom23 file-management-system-php up to 2e3c1ebe60f121e8df4fb3f544f0e9591d9a01e4. This vulnerability affects the function delete_folder of the file ajax.php of the component AJAX Handler. The manipula…
CVE-2026-114253Medium· 6.3oretnom23 file-management-system-php index.php include file inclusion
A vulnerability was determined in oretnom23 file-management-system-php up to 2e3c1ebe60f121e8df4fb3f544f0e9591d9a01e4. The impacted element is the function include of the file index.php. Executing a manipulation of the argument page can …
CVE-2026-114254High· 7.3PoCoretnom23 file-management-system-php admin_class.php login sql injection
A vulnerability was identified in oretnom23 file-management-system-php up to 2e3c1ebe60f121e8df4fb3f544f0e9591d9a01e4. This affects the function Login of the file admin_class.php. The manipulation of the argument username/password leads …
CVE-2026-114255High· 7.3PoCoretnom23 file-management-system-php User Account Management admin_class.php save_user sql injection
A security flaw has been discovered in oretnom23 file-management-system-php up to 2e3c1ebe60f121e8df4fb3f544f0e9591d9a01e4. This impacts the function save_user of the file admin_class.php of the component User Account Management. The man…
CVE-2026-114256High· 7.3oretnom23 file-management-system-php Folder Management admin_class.php save_files sql injection
A weakness has been identified in oretnom23 file-management-system-php up to 2e3c1ebe60f121e8df4fb3f544f0e9591d9a01e4. Affected is the function save_folder/delete_folder/delete_file/file_rename/save_files of the file admin_class.php of t…
CVE-2026-114257High· 7.3PoCoretnom23 file-management-system-php File Download download.php readfile sql injection
A security vulnerability has been detected in oretnom23 file-management-system-php up to 2e3c1ebe60f121e8df4fb3f544f0e9591d9a01e4. Affected by this vulnerability is the function readfile of the file download.php of the component File Dow…
CVE-2026-30520Medium· 5.4A Blind SQL Injection vulnerability exists in SourceCodester Loan Management System v1.0
A Blind SQL Injection vulnerability exists in SourceCodester Loan Management System v1.0. The vulnerability is located in the ajax.php file (specifically the save_loan action). The application fails to properly sanitize user input suppli…
CVE-2025-70141Critical· 9.4PoCSourceCodester Customer Support System 1.0 contains an incorrect access control vulnerability in ajax.php
SourceCodester Customer Support System 1.0 contains an incorrect access control vulnerability in ajax.php. The AJAX dispatcher does not enforce authentication or authorization before invoking administrative methods in admin_class.php bas…
CVE-2025-14221Low· 3.5PoCA vulnerability was detected in SourceCodester Online Banking System 1.0
A vulnerability was detected in SourceCodester Online Banking System 1.0. This impacts an unknown function of the file /?page=user. The manipulation of the argument First Name/Last Name results in cross site scripting. The attack can be …
CVE-2025-13264Medium· 6.3A security flaw has been discovered in SourceCodester Online Magazine Management System 1.0
A security flaw has been discovered in SourceCodester Online Magazine Management System 1.0. This affects an unknown part of the file /view_magazine.php. The manipulation of the argument ID results in sql injection. The attack may be per…
CVE-2025-13263Medium· 6.3A vulnerability was identified in SourceCodester Online Magazine Management System 1.0
A vulnerability was identified in SourceCodester Online Magazine Management System 1.0. Affected by this issue is some unknown functionality of the file /categories.php. The manipulation of the argument c leads to sql injection. The atta…
CVE-2025-63891High· 7.5Information Disclosure in web-accessible backup file in SourceCodester Simple Online Book Store System allows a remote unauthenticated attacker to disclose full database contents (including schema and credential hashes) via an unauthenti…
Information Disclosure in web-accessible backup file in SourceCodester Simple Online Book Store System allows a remote unauthenticated attacker to disclose full database contents (including schema and credential hashes) via an unauthenti…
CVE-2025-12929High· 7.3A flaw has been found in SourceCodester Survey Application System 1.0
A flaw has been found in SourceCodester Survey Application System 1.0. This impacts the function save_user/update_user of the file /LoginRegistration.php. Executing manipulation of the argument fullname can lead to sql injection. The att…
CVE-2025-12257High· 7.3A security vulnerability has been detected in SourceCodester Online Student Result System 1.0
A security vulnerability has been detected in SourceCodester Online Student Result System 1.0. This issue affects some unknown processing of the file /view_result.php. The manipulation of the argument ID leads to sql injection. The attac…
CVE-2025-11601High· 7.3A vulnerability was detected in SourceCodester Online Student Result System 1.0
A vulnerability was detected in SourceCodester Online Student Result System 1.0. Affected by this vulnerability is an unknown functionality of the file /login.php. Performing manipulation of the argument Username results in sql injection…
CVE-2025-10420Medium· 6.3A vulnerability was detected in SourceCodester Student Grading System 1.0
A vulnerability was detected in SourceCodester Student Grading System 1.0. This affects an unknown part of the file /form137.php. Performing manipulation of the argument ID results in sql injection. The attack may be initiated remotely. …
CVE-2023-33677High· 7.5Sourcecodester Lost and Found Information System's Version 1.0 is vulnerable to unauthenticated SQL Injection at "?page=items/view&id=*".
Sourcecodester Lost and Found Information System's Version 1.0 is vulnerable to unauthenticated SQL Injection at "?page=items/view&id=*".
CVE-2022-26646Critical· 9.8Online Banking System Protect v1.0 was discovered to contain a local file inclusion (LFI) vulnerability via the pages parameter.
Online Banking System Protect v1.0 was discovered to contain a local file inclusion (LFI) vulnerability via the pages parameter.
CVE-2022-26645Critical· 9.8A remote code execution (RCE) vulnerability in Online Banking System Protect v1.0 allows attackers to execute arbitrary code via a crafted PHP file uploaded through the Upload Image function.
A remote code execution (RCE) vulnerability in Online Banking System Protect v1.0 allows attackers to execute arbitrary code via a crafted PHP file uploaded through the Upload Image function.