CVE-2026-76049 is a SQL injection vulnerability affecting SourceCodester Simple Online Food Ordering System version 1.0. The flaw exists in the /admin/ajax.php?action=save_menu script where the ID parameter is not properly sanitized, enabling remote attackers to execute arbitrary SQL commands. This vulnerability can be triggered without authentication or user interaction. The CVSS 4.0 vector indicates network attack vector, low complexity, no privileges required, no user interaction, and low to limited impact on confidentiality, integrity, and availability. No official fix or patch has been published by the vendor as of the current data.

Successful exploitation of this vulnerability could allow an attacker to execute arbitrary SQL queries on the backend database, potentially leading to unauthorized data access or modification. The impact is rated medium severity based on the CVSS score of 6.9. There are no confirmed reports of exploitation in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider restricting access to the vulnerable endpoint and applying web application firewall rules to detect and block SQL injection attempts targeting the ID parameter.