The vulnerability CVE-2026-4844 affects code-projects Online Food Ordering System version 1.0. It is an SQL injection issue in the Admin Login Module's /admin.php file, specifically through the Username argument. This allows an unauthenticated remote attacker to inject SQL commands, potentially compromising the backend database. The CVSS 4.0 base score is 6.9 (medium severity), reflecting network attack vector, low complexity, no privileges or user interaction required, and limited impact on confidentiality, integrity, and availability. No patch or official fix information is currently available.

Successful exploitation of this vulnerability could allow an attacker to execute arbitrary SQL commands on the backend database, potentially leading to unauthorized data access or modification. The impact is limited to the affected version 1.0 of the Online Food Ordering System and specifically the Admin Login Module. There are no confirmed active exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, it is recommended to restrict access to the /admin.php interface, implement web application firewall rules to detect and block SQL injection attempts targeting the Username parameter, and review input validation and sanitization in the affected module.