Threat Intelligence Database

CVE-2026-4472 is a medium severity SQL injection vulnerability found in the itsourcecode Online Frozen Foods Ordering System version 1.0. The flaw exists in the /admin/admin_edit_supplier.php file, where the Supplier_Name parameter is improperly sanitized, allowing remote attackers to inject malicious SQL code. Exploitation does not require user interaction but does require low-level privileges. The vulnerability can lead to unauthorized data access or modification, impacting confidentiality, integrity, and availability of the system's database. Although no public exploits are currently known in the wild, the vulnerability has been publicly disclosed, increasing the risk of exploitation. Organizations using this software should prioritize patching or applying mitigations to prevent potential attacks. The affected product is niche, so the impact is likely limited to organizations in the frozen foods supply chain using this system. Countries with significant frozen food industries and adoption of this software are at higher risk.

MediumVulnerabilityUnited StatesCanadaUnited Kingdom+7#cve#cve-2026-4472

CVE-2026-4471 is a medium severity SQL injection vulnerability found in itsourcecode Online Frozen Foods Ordering System version 1.0. The flaw exists in the /admin/admin_edit_employee.php file, specifically in the handling of the First_Name parameter. This vulnerability allows remote attackers to manipulate SQL queries without requiring user interaction or privileges, potentially leading to unauthorized data access or modification. Although the exploit code is publicly available, no known active exploitation has been reported. The vulnerability impacts confidentiality, integrity, and availability to a limited extent due to required privileges and limited scope. Organizations using this system should prioritize patching or applying mitigations to prevent exploitation. Countries with significant use of this product or similar e-commerce platforms are at higher risk. The CVSS 4.

MediumVulnerabilityUnited StatesIndiaUnited Kingdom+7#cve#cve-2026-4471

A security flaw has been discovered in itsourcecode Online Frozen Foods Ordering System 1.0. Affected by this issue is some unknown functionality of the file /admin/admin_edit_menu.php. Performing a manipulation of the argument product_name results in sql injection. It is possible to initiate the attack remotely. The exploit has been released to the public and may be used for attacks.

MediumVulnerabilityUnited StatesIndiaUnited Kingdom+7#cve#cve-2026-4470

A vulnerability was identified in itsourcecode Online Frozen Foods Ordering System 1.0. Affected by this vulnerability is an unknown functionality of the file /admin/admin_edit_menu_action.php. Such manipulation of the argument product_name leads to sql injection. The attack may be performed from remote. The exploit is publicly available and might be used.

MediumVulnerabilityUnited StatesIndiaUnited Kingdom+7#cve#cve-2026-4469

A weakness has been identified in itsourcecode Online Frozen Foods Ordering System 1.0. This issue affects some unknown processing of the file /order_online.php. Executing a manipulation of the argument product_name can lead to sql injection. The attack can be launched remotely. The exploit has been made available to the public and could be used for attacks.

MediumVulnerabilityUnited StatesIndiaChina+7#cve#cve-2026-1159

A vulnerability was identified in itsourcecode Online Frozen Foods Ordering System 1.0. This vulnerability affects unknown code of the file /customer_details.php. Such manipulation leads to sql injection. It is possible to launch the attack remotely. The exploit is publicly available and might be used.

MediumVulnerabilityUnited StatesCanadaUnited Kingdom+7#cve#cve-2025-15074

A vulnerability was determined in itsourcecode Online Frozen Foods Ordering System 1.0. This affects an unknown part of the file /contact_us.php. This manipulation of the argument Name causes sql injection. It is possible to initiate the attack remotely. The exploit has been publicly disclosed and may be utilized.

MediumVulnerabilityUnited StatesCanadaUnited Kingdom+7#cve#cve-2025-15073