---
title: "carmelo vulnerabilities: CVEs, CISA KEV and security advisories"
url: https://radicalnotion.ai/vendor/carmelo
type: vendor
description: "carmelo has 127 published CVEs, 0 in CISA KEV and 122 with public exploits."
updated: 2026-03-28
source: RadicalNotion.AI
license: CC BY-NC 4.0 (https://creativecommons.org/licenses/by-nc/4.0/)
---

# carmelo vulnerabilities

- **Published CVEs:** 127
- **In CISA KEV:** 0
- **With a public exploit:** 122
- **With a patch:** 0
- **Average CVSS:** 6.6
- **CVEs in the last two years:** 121
- **First CVE:** 2024-02-22
- **Latest CVE:** 2026-03-28

## Severity breakdown

| Severity | CVEs |
| --- | --- |
| Critical | 12 |
| High | 6 |
| Medium | 109 |
| Low | 0 |
| Unscored | 0 |

## Most affected products

| Product | CVEs |
| --- | --- |
| [simple pizza ordering system](https://radicalnotion.ai/vendor/carmelo/simple-pizza-ordering-system) | 18 |
| [church donation system](https://radicalnotion.ai/vendor/carmelo/church-donation-system) | 14 |
| [intern membership management system](https://radicalnotion.ai/vendor/carmelo/intern-membership-management-system) | 13 |
| [online event judging system](https://radicalnotion.ai/vendor/carmelo/online-event-judging-system) | 10 |
| [simple food order system](https://radicalnotion.ai/vendor/carmelo/simple-food-order-system) | 10 |
| [simple flight ticket booking system](https://radicalnotion.ai/vendor/carmelo/simple-flight-ticket-booking-system) | 9 |
| [simple stock system](https://radicalnotion.ai/vendor/carmelo/simple-stock-system) | 6 |
| [food ordering review system](https://radicalnotion.ai/vendor/carmelo/food-ordering-review-system) | 5 |

## Most common weakness types

| CWE | Name | CVEs |
| --- | --- | --- |
| [CWE-89](https://radicalnotion.ai/cwe/cwe-89) | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') | 83 |
| [CWE-74](https://radicalnotion.ai/cwe/cwe-74) | Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') | 24 |
| [CWE-79](https://radicalnotion.ai/cwe/cwe-79) | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | 9 |
| [CWE-434](https://radicalnotion.ai/cwe/cwe-434) | Unrestricted Upload of File with Dangerous Type | 6 |
| [CWE-284](https://radicalnotion.ai/cwe/cwe-284) | Improper Access Control | 1 |
| [CWE-94](https://radicalnotion.ai/cwe/cwe-94) | Improper Control of Generation of Code ('Code Injection') | 1 |
| [CWE-352](https://radicalnotion.ai/cwe/cwe-352) | Cross-Site Request Forgery (CSRF) | 1 |
| [CWE-425](https://radicalnotion.ai/cwe/cwe-425) | Direct Request ('Forced Browsing') | 1 |

## Assigning CNAs

| CNA | CVEs |
| --- | --- |
| [VulDB](https://radicalnotion.ai/cna/vuldb) | 105 |
| [mitre](https://radicalnotion.ai/cna/mitre) | 22 |

## CVEs by year

| Year | CVEs published |
| --- | --- |
| 2024 | 6 |
| 2025 | 84 |
| 2026 | 37 |

## Latest CVEs

| CVE | Title | Severity | CVSS | EPSS | CISA KEV | Published |
| --- | --- | --- | --- | --- | --- | --- |
| CVE-2026-5019 | code-projects Simple Food Order System Parameter all-orders.php sql injection | medium | 6.9 | 0.5% | No | 2026-03-28 |
| CVE-2026-5018 | code-projects Simple Food Order System Parameter register-router.php sql injection | medium | 6.9 | 0.4% | No | 2026-03-28 |
| CVE-2026-5017 | code-projects Simple Food Order System Parameter all-tickets.php sql injection | medium | 6.9 | 0.3% | No | 2026-03-28 |
| CVE-2026-4533 | code-projects Simple Food Ordering System all-tickets.php sql injection | medium | 5.3 | 0.3% | No | 2026-03-22 |
| CVE-2026-4532 | code-projects Simple Food Ordering System Database Backup food.sql file access | medium | 6.9 | 0.5% | No | 2026-03-22 |
| CVE-2026-4319 | code-projects Simple Food Order System add-item.php sql injection | medium | 6.9 | 0.3% | No | 2026-03-17 |
| CVE-2026-3763 | code-projects Simple Flight Ticket Booking System showhistory.php cross site scripting | medium | 5.3 | 0.4% | No | 2026-03-08 |
| CVE-2026-3745 | code-projects Student Web Portal profile.php sql injection | medium | 5.3 | 0.3% | No | 2026-03-08 |
| CVE-2026-3744 | code-projects Student Web Portal signup.php valreg\_passwdation sql injection | medium | 6.9 | 0.4% | No | 2026-03-08 |
| CVE-2026-3736 | code-projects Simple Flight Ticket Booking System SearchResultRoundtrip.php sql injection | medium | 6.9 | 0.4% | No | 2026-03-08 |
| CVE-2026-3735 | code-projects Simple Flight Ticket Booking System SearchResultOneway.php sql injection | medium | 6.9 | 0.4% | No | 2026-03-08 |
| CVE-2026-3723 | code-projects Simple Flight Ticket Booking System Admindelete.php sql injection | medium | 6.9 | 0.4% | No | 2026-03-08 |

## Frequently asked questions

### How many CVEs does carmelo have?

carmelo has 127 published CVE records since 2024, including 121 in the last two years.

### How many carmelo CVEs are in CISA KEV?

None of carmelo's CVEs are currently listed in CISA's Known Exploited Vulnerabilities catalog.

### Which carmelo products have the most CVEs?

The carmelo products with the most published CVEs are simple pizza ordering system, church donation system, intern membership management system, online event judging system, simple food order system.

### What are the most common weakness types in carmelo CVEs?

carmelo's CVEs most often map to these CWE weakness types: CWE-89 (Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')), CWE-74 (Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')), CWE-79 (Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')), CWE-434 (Unrestricted Upload of File with Dangerous Type).

### Are there public exploits for carmelo vulnerabilities?

Yes — 122 of carmelo's CVEs have a known public exploit.

### How many critical carmelo vulnerabilities are there?

carmelo has 12 critical and 6 high-severity CVEs.

### What is the average severity of carmelo CVEs?

The average CVSS base score across carmelo's scored CVEs is 6.6.

## Related vendors

- [LibreNMS](https://radicalnotion.ai/vendor/librenms) (128 CVEs)
- [RSA](https://radicalnotion.ai/vendor/rsa) (128 CVEs)
- [Cap-go](https://radicalnotion.ai/vendor/cap-go) (127 CVEs)
- [ChurchCRM](https://radicalnotion.ai/vendor/churchcrm) (127 CVEs)
- [Accellion](https://radicalnotion.ai/vendor/accellion) (126 CVEs)
- [Axis Communications](https://radicalnotion.ai/vendor/axis) (126 CVEs)
- [Johnson Controls](https://radicalnotion.ai/vendor/johnson-controls) (126 CVEs)
- [libming](https://radicalnotion.ai/vendor/libming) (126 CVEs)

---

Source: [RadicalNotion.AI](https://radicalnotion.ai/vendor/carmelo). Licensed CC BY-NC 4.0; attribute RadicalNotion.AI and link the source page when you reuse this data.