Threat Intelligence Database

A vulnerability was detected in SourceCodester Online Food Ordering System 2.0. Affected by this issue is the function include of the file /index.php. The manipulation of the argument page results in file inclusion. The attack can be launched remotely. The exploit is now public and may be used.

CVE-2026-5811 is a medium severity vulnerability in SourceCodester Online Food Ordering System version 1.0. It involves business logic errors caused by manipulation of the price parameter in the save_product function within the /Actions.php file. The vulnerability can be exploited remotely without user interaction or privileges. Although an exploit is publicly available, there are no known exploits in the wild. No official patch or remediation guidance has been provided yet.

A SQL Injection vulnerability exists in SourceCodester Online Food Ordering System v1.0 in the Actions.php file (specifically the save_customer action). The application fails to properly sanitize user input supplied to the "username" parameter. This allows an attacker to inject malicious SQL commands.

CriticalVulnerabilityUnited StatesIndiaPhilippines+7#cve#cve-2026-30530

A SQL Injection vulnerability exists in SourceCodester Online Food Ordering System v1.0 in the Actions.php file (specifically the save_user action). The application fails to properly sanitize user input supplied to the "username" parameter. This allows an authenticated attacker to inject malicious SQL commands.

HighVulnerabilityUnited StatesIndiaPhilippines+7#cve#cve-2026-30529

A SQL Injection vulnerability exists in SourceCodester Online Food Ordering System v1.0 in the Actions.php file (specifically the save_category action). The application fails to properly sanitize user input supplied to the "name" parameter. This allows an authenticated attacker to inject malicious SQL commands.

HighVulnerabilityUnited StatesIndiaPhilippines+7#cve#cve-2026-30531

A SQL Injection vulnerability exists in SourceCodester Online Food Ordering System v1.0 in the admin/manage_product.php file via the "id" parameter.

CriticalVulnerabilityUnited StatesIndiaBrazil+7#cve#cve-2026-30533

A SQL Injection vulnerability exists in SourceCodester Online Food Ordering System v1.0 in the admin/view_product.php file via the "id" parameter.

CriticalVulnerabilityUnited StatesIndiaBrazil+7#cve#cve-2026-30532

A weakness has been identified in code-projects Online Food Ordering System 1.0. This affects an unknown part of the file /dbfood/localhost.sql. This manipulation causes files or directories accessible. The attack can be initiated remotely. The exploit has been made available to the public and could be used for attacks. It is advisable to modify the configuration settings.

CVE-2026-4899 is a cross-site scripting (XSS) vulnerability in version 1.0 of the code-projects Online Food Ordering System. The issue exists in the /dbfood/food.php file where the 'cuisines' parameter can be manipulated to execute malicious scripts. This vulnerability can be exploited remotely and requires user interaction. The CVSS score is 4.8, indicating a medium severity level. There is no information about an available patch or official remediation. Exploit code has been publicly released, but no known exploits in the wild have been reported.