CVE-2026-114381: SQL Injection in itsourcecode Online Cake Ordering System
Description
CVE-2026-114381 is a medium severity SQL injection vulnerability in itsourcecode Online Cake Ordering System version 1.0. The flaw exists in an unknown function within the /orderdetail.php file, where manipulation of the ID argument allows remote attackers to perform SQL injection. The vulnerability has been publicly disclosed, but no official patch or remediation is currently documented.
CVSS v4.0
Score 5.3medium
Affected software
itsourcecode
Online Cake Ordering System
pkg:github/itsourcecode/online_cake_ordering_systemcpe:2.3:a:itsourcecode:online_cake_ordering_system:*:*:*:*:*:*:*:*Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The vulnerability identified as CVE-2026-114381 affects itsourcecode Online Cake Ordering System version 1.0. It is caused by improper sanitization of the ID parameter in an unknown function within the /orderdetail.php file, enabling remote attackers to inject SQL commands. This can lead to unauthorized access or modification of the backend database. The vulnerability has a CVSS 4.0 base score of 5.3, indicating medium severity. Exploit code has been publicly disclosed, but there is no information about active exploitation in the wild or an official patch.
Potential Impact
Successful exploitation of this SQL injection vulnerability could allow an attacker with low privileges to execute arbitrary SQL commands remotely, potentially leading to unauthorized data access or modification. The vulnerability's medium severity reflects limited impact due to required privileges and low complexity of attack.
Mitigation Recommendations
No official patch or remediation has been documented for this vulnerability. Users of itsourcecode Online Cake Ordering System version 1.0 should monitor the vendor's advisory channels for updates. Until a fix is available, restricting access to the affected endpoint and validating or sanitizing input parameters at the application level may reduce risk.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- VulDB
- Date Reserved
- 2026-10-21T11:22:54.692Z
- Cvss Version
- 4.0
- State
- PUBLISHED
Threat ID: 6ad932a14d27ba8daa058c03
Added to database: 10/21/2026, 21:46:09 UTC
Last enriched: 10/21/2026, 22:01:04 UTC
Last updated: 10/21/2026, 22:01:04 UTC
Views: 4
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.