Vendor
SourceCodester vulnerabilities
Updated . Rebuilt every hour.
Junglewise Threat Intelligence has tracked 283 vulnerabilities in SourceCodester: 9 in the last 7 days and 131 in the last 90 days, 1 of them critical and 0 exploited in the wild. The most recent, CVE-2026-127284, was published on 13 November 2026. 24 vulnerabilities in the last four weeks, down 52% on the four before (50). 27 technologies have a page of their own.
- Last 7 days
- 9
- Last 90 days
- 131
- Critical, all time
- 1
- Exploited in the wild
- 0
About SourceCodester
SourceCodester is a platform that provides free source code and tutorials for various programming languages and web applications.
SourceCodester technologies
- SourceCodester Class and Exam Timetabling System56
- SourceCodester Inventory Management System16
- SourceCodester Online Reviewer Management System15
- SourceCodester Drug Recommendation System13
- SourceCodester Performance Indicator System10
- SourceCodester Simple Online Food Ordering System10
- SourceCodester Pharmacy Sales and Inventory System9
- SourceCodester CET Automated Grading System with AI Predictive Analytics7
- SourceCodester Online Food Ordering System7
- SourceCodester Smart Attendance System with QR Code Scanner7
- SourceCodester Syllabus-Aligned Learning Management & Examination System7
- SourceCodester Multi-Vendor Online Grocery Management System6
- SourceCodester Online-Examination-And-Learning-Management-System6
- SourceCodester Pizzafy Ecommerce System6
- SourceCodester CASAP Automated Enrollment System5
- SourceCodester Hospitals Patient Records Management System5
- SourceCodester Simple and Nice Shopping Cart Script5
- SourceCodester Student Grades Management System5
- SourceCodester Indian Invoicing System4
- SourceCodester Online Book Store System4
- SourceCodester Online Faculty Clearance System4
- SourceCodester School Registration and Fee System4
- SourceCodester Simple POS and Inventory System4
- SourceCodester College Notes Gallery Management System3
- SourceCodester Hospital's Patient Records Management System3
- SourceCodester Ship Ferry Ticket Reservation System3
- SourceCodester Simple Traffic Offense System3
Latest SourceCodester vulnerabilities
- CVE-2026-127284: SourceCodester Food Ordering System SQL injection in admin handlerhighCVSS 7.3
- CVE-2026-127283: SourceCodester Food Ordering System unrestricted file uploadhighCVSS 7.3
- CVE-2026-127282: SourceCodester Smart Attendance System reflected XSS in reset_password.phpmediumCVSS 4.3
- CVE-2026-125078: SourceCodester Smart Attendance System session fixation in login.phpmediumCVSS 6.3
- CVE-2026-125077: SourceCodester Smart Attendance System cross-site request forgery in student deletionmediumCVSS 4.3
- CVE-2026-125076: SourceCodester Smart Attendance System missing authentication in JSON endpointhighCVSS 7.3
- CVE-2026-125075: SourceCodester Smart Attendance System auth bypass in admin account creationhighCVSS 7.3EPSS 0.4%
- CVE-2026-125074: SourceCodester Smart Attendance System missing authentication in password resethighCVSS 7.3EPSS 0.3%
- CVE-2026-124571: SourceCodester Simple CRUD using PHP and FPDF SQL injection in register.phpmediumCVSS 6.3
- CVE-2026-116605: SourceCodester Online Food Ordering System client-side price enforcementmediumCVSS 5.3
- CVE-2026-116604: SourceCodester Online Food Ordering System missing authentication in admin delete endpointsmediumCVSS 6.5
- CVE-2026-116603: SourceCodester Online Food Ordering System unrestricted file upload in add_food.phpmediumCVSS 4.7
- CVE-2026-116602: SourceCodester Online Food Ordering System path traversal in delete.phpmediumCVSS 6.5
- CVE-2026-116062: SourceCodester Performance Indicator System SQL injection in save_profile.phphighCVSS 7.3
- CVE-2026-116061: SourceCodester Performance Indicator System SQL injection in edit_dealer.phphighCVSS 7.3
- CVE-2026-116060: SourceCodester Performance Indicator System SQL injectionhighCVSS 7.3
- CVE-2026-116055: SourceCodester Performance Indicator System SQL injection in deleteproduct.phpmediumCVSS 6.3
- CVE-2026-114267: SourceCodester Food Order Management System missing authorization in admin endpointshighCVSS 7.3
- CVE-2026-109620: SourceCodester Online Reviewer System SQL injection in loginhighCVSS 7.3EPSS 0.4%
- CVE-2026-109607: SourceCodester Online Exam System SQL injection in login endpointhighCVSS 7.3EPSS 0.4%
- CVE-2026-109606: SourceCodester Art Gallery Management System SQL injection in account creationhighCVSS 7.3EPSS 0.4%
- CVE-2026-109605: SourceCodester Simple Cafe Billing System improper authorization in user creationhighCVSS 7.3EPSS 0.5%
- CVE-2026-108975: SourceCodester Library Management System pre-auth RCE via missing exithighCVSS 7.3EPSS 0.3%
- CVE-2026-108974: SourceCodester E-Learning System SQL injection and unrestricted upload in Users.phphighCVSS 7.3EPSS 0.3%
- CVE-2026-108973: SourceCodester Contact Tracing System unauthenticated file upload and SQL injectionhighCVSS 7.3EPSS 0.3%
Most severe SourceCodester vulnerabilities
Exploited in the wild first, then by severity and CVSS score.
- CVE-2026-36236: SourceCodester Engineers Online Portal SQL injection in update_password.phpcriticalCVSS 9.8
- CVE-2026-86292: SourceCodester Simple Traffic Offense System auth bypass in user creationhighCVSS 7.3EPSS 0.7%
- CVE-2026-108972: SourceCodester Human Resource Management System authentication bypass in Employee EndpointhighCVSS 7.3EPSS 0.7%
- CVE-2026-86277: SourceCodester Syllabus-Aligned Learning Management System authorization bypasshighCVSS 7.3EPSS 0.5%
- CVE-2026-90856: SourceCodester College Notes Gallery Management System privilege escalation in signuphighCVSS 7.3EPSS 0.5%
- CVE-2026-86276: SourceCodester Syllabus-Aligned Learning Management & Examination System hardcoded credentials and SQL injectionhighCVSS 7.3EPSS 0.5%
- CVE-2026-85512: SourceCodester Class and Exam Timetabling System authorization bypass in /admin/session.phphighCVSS 7.3EPSS 0.5%
- CVE-2026-109605: SourceCodester Simple Cafe Billing System improper authorization in user creationhighCVSS 7.3EPSS 0.5%
- CVE-2026-93972: SourceCodester Online Reviewer Management System SQL injection in courseID parameterhighCVSS 7.3EPSS 0.4%
- CVE-2026-90849: SourceCodester College Notes Gallery Management System SQL injection in loginhighCVSS 7.3EPSS 0.4%
Vulnerabilities per week
24 vulnerabilities in the last four weeks, down 52% on the four before (50). The last 13 weeks, by the week each vulnerability was published.
| Week of | Bar | Vulns | Critical |
|---|---|---|---|
| 17 Aug 2026 | 15 | 0 | |
| 24 Aug 2026 | 6 | 0 | |
| 31 Aug 2026 | 10 | 0 | |
| 7 Sep 2026 | 15 | 0 | |
| 14 Sep 2026 | 25 | 0 | |
| 21 Sep 2026 | 5 | 0 | |
| 28 Sep 2026 | 7 | 0 | |
| 5 Oct 2026 | 13 | 0 | |
| 12 Oct 2026 | 15 | 0 | |
| 19 Oct 2026 | 5 | 0 | |
| 26 Oct 2026 | 4 | 0 | |
| 2 Nov 2026 | 0 | 0 | |
| 9 Nov 2026 | 9 | 0 |
Embed a badge
A live badge for a README, a status page or an internal wiki: how many SourceCodester vulnerabilities were published in the last 7 days and how many of them are critical, refreshed hourly.
[](https://junglewise.ai/threats/vendors/sourcecodester)<a href="https://junglewise.ai/threats/vendors/sourcecodester"><img src="https://junglewise.ai/threats/vendors/sourcecodester/badge.svg" alt="SourceCodester vulnerabilities" /></a>How this is built
Junglewise Threat Intelligence collects vulnerabilities from NVD, GitHub Security Advisories, OSV, the CISA Known Exploited Vulnerabilities catalog, FIRST EPSS and vendor advisories, and matches each one to the technologies and vendors it affects. Dates are the date a vulnerability was published, in UTC.
The pages are rebuilt from the database every hour. Frozen weekly and monthly reports never change once published, so they can be cited.
Use this data
The same data is at https://junglewise.ai/threats/vendors/sourcecodester.json, and this page as text at https://junglewise.ai/threats/vendors/sourcecodester.md, for scripts and language models. It is free to reuse under CC BY 4.0 with a link back to this page.
Cite as: Junglewise Threat Intelligence, "SourceCodester vulnerabilities", https://junglewise.ai/threats/vendors/sourcecodester, 13 November 2026.