CVE-2026-113741: Cross Site Scripting in itsourcecode Online Cake Ordering System

The vulnerability in itsourcecode Online Cake Ordering System 1.0 involves improper sanitization of the useruid parameter in the /404.php file, allowing an attacker to inject malicious scripts via cross-site scripting (XSS). This can be triggered remotely without privileges but requires user interaction to exploit. The vulnerability has been publicly disclosed, but no known exploits in the wild have been reported.

Successful exploitation of this XSS vulnerability could allow attackers to execute arbitrary scripts in the context of the affected web application, potentially leading to session hijacking, defacement, or redirection to malicious sites. However, the impact is limited by the need for user interaction and the absence of privilege requirements.

No official patch or remediation information is provided. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, users should apply standard XSS mitigations such as input validation and output encoding on the useruid parameter. Monitoring for updates from the vendor is recommended.