https://patchthecve.com/CVEs with upgrade or downgrade fix stepshttps://patchthecve.com/cve/CVE-2026-3695.htmlhttps://patchthecve.com/cve/CVE-2026-3695.htmlWed, 17 Jun 2026 10:44:01 +0000MEDIUM 6.5: A vulnerability has been found in SourceCodester Modern Image Gallery App 1.0. Impacted is an unknown function of the file /delete.php. Such manipulation of the argument filename leads to path traversal. It is possible to launch the attack remotely. The exploit has been disclosed to the public and mhttps://patchthecve.com/cve/CVE-2026-3302.htmlhttps://patchthecve.com/cve/CVE-2026-3302.htmlWed, 17 Jun 2026 10:43:22 +0000MEDIUM 4.3: A weakness has been identified in SourceCodester Doctor Appointment System 1.0. Affected by this issue is some unknown functionality of the file /register.php of the component Sign Up Page. Executing a manipulation of the argument Email can lead to cross site scripting. The attack can be launched rehttps://patchthecve.com/cve/CVE-2026-3163.htmlhttps://patchthecve.com/cve/CVE-2026-3163.htmlWed, 17 Jun 2026 10:43:08 +0000MEDIUM 6.3: A vulnerability has been found in SourceCodester Website Link Extractor 1.0. This vulnerability affects the function file_get_contents of the component URL Handler. The manipulation leads to server-side request forgery. It is possible to initiate the attack remotely. The exploit has been disclosed thttps://patchthecve.com/cve/CVE-2026-3070.htmlhttps://patchthecve.com/cve/CVE-2026-3070.htmlWed, 17 Jun 2026 10:43:00 +0000MEDIUM 4.3: A vulnerability was detected in SourceCodester Modern Image Gallery App 1.0. Affected by this vulnerability is an unknown functionality of the file upload.php. The manipulation of the argument filename results in cross site scripting. The attack may be launched remotely. The exploit is now public anhttps://patchthecve.com/cve/CVE-2025-70458.htmlhttps://patchthecve.com/cve/CVE-2025-70458.htmlWed, 17 Jun 2026 10:03:20 +0000MEDIUM 5.4: A DOM-based Cross-Site Scripting (XSS) vulnerability exists in the DomainCheckerApp class within domain/script.js of Sourcecodester Domain Availability Checker v1.0. The vulnerability occurs because the application improperly handles user-supplied data in the createResultElement method by using the https://patchthecve.com/cve/CVE-2025-70457.htmlhttps://patchthecve.com/cve/CVE-2025-70457.htmlWed, 17 Jun 2026 10:03:20 +0000CRITICAL 9.8: A Remote Code Execution (RCE) vulnerability exists in Sourcecodester Modern Image Gallery App v1.0 within the gallery/upload.php component. The application fails to properly validate uploaded file contents. Additionally, the application preserves the user-supplied file extension during the save prochttps://patchthecve.com/cve/CVE-2026-0580.htmlhttps://patchthecve.com/cve/CVE-2026-0580.htmlWed, 17 Jun 2026 10:10:59 +0000LOW 3.5: A vulnerability was found in SourceCodester API Key Manager App 1.0. Affected by this vulnerability is an unknown functionality of the component Import Key Handler. Performing a manipulation results in cross site scripting. The attack can be initiated remotely.https://patchthecve.com/cve/CVE-2025-64070.htmlhttps://patchthecve.com/cve/CVE-2025-64070.htmlWed, 17 Jun 2026 09:53:46 +0000MEDIUM 5.4: Sourcecodester Student Grades Management System v1.0 is vulnerable to Cross Site Scripting (XSS) in the Add New Subject Description field.https://patchthecve.com/cve/CVE-2025-63892.htmlhttps://patchthecve.com/cve/CVE-2025-63892.htmlSun, 05 Jul 2026 17:17:22 +0000MEDIUM 6.8: A vulnerability was determined in SourceCodester Student Grades Management System 1.0. Affected is the function create_classroom of the file /classroom.php of the component My Classrooms Management Page. This manipulation of the argument name/description causes stored cross site scripting.https://patchthecve.com/cve/CVE-2025-13349.htmlhttps://patchthecve.com/cve/CVE-2025-13349.htmlSun, 18 Oct 2026 20:10:00 +0000LOW 3.5: A vulnerability has been found in SourceCodester Student Grades Management System 1.0. This issue affects some unknown processing of the file /grades.php of the component Add New Grade Page. The manipulation of the argument Remarks leads to cross site scripting. Remote exploitation of the attack is https://patchthecve.com/cve/CVE-2025-63708.htmlhttps://patchthecve.com/cve/CVE-2025-63708.htmlWed, 17 Jun 2026 09:53:24 +0000MEDIUM 6.1: Cross-Site Scripting (XSS) vulnerability exists in SourceCodester AI Font Matcher (nid=18425, 2025-10-10) that allows remote attackers to execute arbitrary JavaScript in victims' browsers. The vulnerability occurs in the webfonts API handling mechanism where font family names are not properly sanitihttps://patchthecve.com/cve/CVE-2025-63639.htmlhttps://patchthecve.com/cve/CVE-2025-63639.htmlWed, 17 Jun 2026 09:53:18 +0000MEDIUM 6.1: The chat feature in the application Sourcecodester FAQ Bot with AI Assistant v1.0 is vulnerable to Cross-Site Scripting (XSS) due to improper handling of user-supplied input. An attacker can inject malicious HTML or JavaScript into chat messages, which executes in the browser of any user viewing thehttps://patchthecve.com/cve/CVE-2025-63638.htmlhttps://patchthecve.com/cve/CVE-2025-63638.htmlWed, 17 Jun 2026 09:53:18 +0000MEDIUM 6.1: Sourcecodester AI-Powered To-Do List App v1.0 is vulnerable to Cross-Site Scripting (XSS) in the "Task Title" and "Description (Optional)" fields when creating a Task, allowing an attacker to inject arbitrary potentially malicious HTML/JavaScript code that executes in the victim's browser upon clickhttps://patchthecve.com/cve/CVE-2025-63714.htmlhttps://patchthecve.com/cve/CVE-2025-63714.htmlWed, 17 Jun 2026 09:53:25 +0000MEDIUM 6.1: Cross-Site Scripting (XSS) vulnerability in SourceCodester User Account Generator 1.0 allows remote attackers to execute arbitrary JavaScript code in the context of the user's browser session via crafted input in the Username Prefix field. The vulnerability exists due to improper sanitization of usehttps://patchthecve.com/cve/CVE-2025-63713.htmlhttps://patchthecve.com/cve/CVE-2025-63713.htmlWed, 17 Jun 2026 09:53:25 +0000MEDIUM 6.1: Cross-Site Scripting (XSS) vulnerability in SourceCodester "MatchMaster" 1.0 allows remote attackers to inject arbitrary web script or HTML via crafted input in the custom test creation feature. The vulnerability exists because the application fails to properly sanitize user-supplied input in test thttps://patchthecve.com/cve/CVE-2025-12332.htmlhttps://patchthecve.com/cve/CVE-2025-12332.htmlThu, 08 Oct 2026 11:10:00 +0000LOW 2.4: A flaw has been found in SourceCodester Student Grades Management System 1.0. This affects the function delete_user of the file /admin.php. Executing manipulation can lead to cross site scripting. The attack may be performed from remote. The exploit has been published and may be used.https://patchthecve.com/cve/CVE-2025-11485.htmlhttps://patchthecve.com/cve/CVE-2025-11485.htmlThu, 08 Oct 2026 13:10:00 +0000LOW 2.4: A vulnerability was determined in SourceCodester Student Grades Management System 1.0. Affected is the function add_user of the file /admin.php of the component Manage Users Page. This manipulation of the argument first_name/last_name causes cross site scripting. The attack can be initiated remotelyhttps://patchthecve.com/cve/CVE-2025-26258.htmlhttps://patchthecve.com/cve/CVE-2025-26258.htmlWed, 17 Jun 2026 09:01:32 +0000MEDIUM 6.1: Sourcecodester Employee Management System v1.0 is vulnerable to Cross Site Scripting (XSS) via 'Add Designation.'https://patchthecve.com/cve/CVE-2025-57117.htmlhttps://patchthecve.com/cve/CVE-2025-57117.htmlSun, 05 Jul 2026 02:17:03 +0000MEDIUM 5.4: A Clickjacking vulnerability exists in Rems' Employee Management System 1.0. This flaw allows remote attackers to execute arbitrary JavaScript on the department.php page by injecting a malicious payload into the Department Name field under Add Department.https://patchthecve.com/cve/CVE-2025-57425.htmlhttps://patchthecve.com/cve/CVE-2025-57425.htmlWed, 17 Jun 2026 09:43:06 +0000MEDIUM 6.1: A Stored Cross-Site Scripting (XSS) vulnerability in SourceCodester FAQ Management System 1.0 allows an authenticated attacker to inject malicious JavaScript into the 'question' and 'answer' fields via the update-faq.php endpoint.https://patchthecve.com/cve/CVE-2025-5628.htmlhttps://patchthecve.com/cve/CVE-2025-5628.htmlWed, 17 Jun 2026 09:48:21 +0000LOW 3.5: A vulnerability, which was classified as problematic, has been found in SourceCodester Food Menu Manager 1.0. Affected by this issue is some unknown functionality of the file /index.php of the component Add Menu Handler. The manipulation of the argument name/description leads to cross site scriptinghttps://patchthecve.com/cve/CVE-2025-29719.htmlhttps://patchthecve.com/cve/CVE-2025-29719.htmlWed, 17 Jun 2026 09:05:36 +0000MEDIUM 6.1: SourceCodester (rems) Employee Management System 1.0 is vulnerable to Cross Site Scripting (XSS) in add_employee.php via the First Name and Address text fields.https://patchthecve.com/cve/CVE-2025-1905.htmlhttps://patchthecve.com/cve/CVE-2025-1905.htmlWed, 17 Jun 2026 08:40:18 +0000LOW 3.5: A vulnerability, which was classified as problematic, was found in SourceCodester Employee Management System 1.0. This affects an unknown part of the file employee.php. The manipulation of the argument Full Name leads to cross site scripting. It is possible to initiate the attack remotely. The explohttps://patchthecve.com/cve/CVE-2025-1166.htmlhttps://patchthecve.com/cve/CVE-2025-1166.htmlWed, 17 Jun 2026 08:38:30 +0000MEDIUM 6.3: A vulnerability has been found in SourceCodester Food Menu Manager 1.0 and classified as critical. Affected by this vulnerability is an unknown functionality of the file endpoint/update.php. The manipulation leads to unrestricted upload. The attack can be launched remotely. The exploit has been dischttps://patchthecve.com/cve/CVE-2025-1160.htmlhttps://patchthecve.com/cve/CVE-2025-1160.htmlWed, 17 Jun 2026 08:38:29 +0000HIGH 7.3: A vulnerability was found in SourceCodester Employee Management System 1.0. It has been rated as critical. Affected by this issue is some unknown functionality of the file index.php. The manipulation of the argument username/password leads to use of default credentials. The attack may be launched rehttps://patchthecve.com/cve/CVE-2024-8559.htmlhttps://patchthecve.com/cve/CVE-2024-8559.htmlWed, 17 Jun 2026 08:22:51 +0000MEDIUM 4.7: A vulnerability, which was classified as critical, has been found in SourceCodester Online Food Menu 1.0. This issue affects some unknown processing of the file /endpoint/delete-menu.php. The manipulation of the argument menu leads to sql injection. The attack may be initiated remotely. The exploit https://patchthecve.com/cve/CVE-2024-8380.htmlhttps://patchthecve.com/cve/CVE-2024-8380.htmlWed, 17 Jun 2026 08:22:28 +0000MEDIUM 6.3: A vulnerability was found in SourceCodester Contact Manager with Export to VCF 1.0. It has been rated as critical. This issue affects some unknown processing of the file /endpoint/delete-account.php of the component Delete Contact Handler. The manipulation of the argument contact leads to sql injecthttps://patchthecve.com/cve/CVE-2024-8337.htmlhttps://patchthecve.com/cve/CVE-2024-8337.htmlWed, 17 Jun 2026 08:22:23 +0000LOW 3.5: A vulnerability, which was classified as problematic, has been found in SourceCodester Contact Manager with Export to VCF 1.0. Affected by this issue is some unknown functionality of the file index.html. The manipulation of the argument contact_name leads to cross site scripting. The attack may be lhttps://patchthecve.com/cve/CVE-2024-7948.htmlhttps://patchthecve.com/cve/CVE-2024-7948.htmlWed, 17 Jun 2026 08:21:15 +0000LOW 3.5: A vulnerability classified as problematic was found in SourceCodester Accounts Manager App 1.0. This vulnerability affects unknown code of the file update-account.php of the component Update Account Page. The manipulation of the argument Account Name/Username/Password/Link leads to cross site scripthttps://patchthecve.com/cve/CVE-2024-7749.htmlhttps://patchthecve.com/cve/CVE-2024-7749.htmlWed, 17 Jun 2026 08:20:50 +0000LOW 3.5: A vulnerability, which was classified as problematic, was found in SourceCodester Accounts Manager App 1.0. Affected is an unknown function of the file /endpoint/add-account.php. The manipulation of the argument account_name leads to cross site scripting. It is possible to launch the attack remotelyhttps://patchthecve.com/cve/CVE-2024-7748.htmlhttps://patchthecve.com/cve/CVE-2024-7748.htmlWed, 17 Jun 2026 08:20:50 +0000MEDIUM 6.3: A vulnerability, which was classified as critical, has been found in SourceCodester Accounts Manager App 1.0. This issue affects some unknown processing of the file /endpoint/delete-account.php. The manipulation of the argument account leads to sql injection. The attack may be initiated remotely. Thhttps://patchthecve.com/cve/CVE-2024-7660.htmlhttps://patchthecve.com/cve/CVE-2024-7660.htmlWed, 17 Jun 2026 08:20:38 +0000LOW 3.5: A vulnerability has been found in SourceCodester File Manager App 1.0 and classified as problematic. Affected by this vulnerability is an unknown functionality of the component Add File Handler. The manipulation of the argument File Title/Uploaded By leads to cross site scripting. The attack can be