CVE-2026-108959
MediumCVSS 6.3Exploitation Probability (EPSS)
Low risk9th percentile - higher than 9% of all known CVEs
Summary
A vulnerability was detected in Online Cake Ordering System 1.0. An unknown function in /addtransacdetail.php is susceptible to SQL injection via the ID argument. The attack can be performed remotely, and the exploit has been publicly disclosed.
Risk Assessment
An attacker can remotely manipulate SQL queries, potentially leading to unauthorized data access or modification. The public availability of the exploit increases the risk of exploitation.
Recommendation
It is recommended to apply patches or updates immediately, and to validate and sanitize input in /addtransacdetail.php.
Other vulnerabilities in Online Cake Ordering System
See all- CVE-2026-113741Medium
A vulnerability has been found in itsourcecode Online Cake Ordering System 1.0. Affected by this issue is some unknown functionality of the file /404.php. Such manipulation of the argument useruid leads to cross site scripting. The attack may be performed from remote. The exploit has been disclosed to the public and may be used.
- CVE-2026-113740Medium
A flaw has been found in itsourcecode Online Cake Ordering System 1.0. Affected by this vulnerability is an unknown functionality of the file /deletecustomer.php. This manipulation of the argument ID causes sql injection. The attack is possible to be carried out remotely. The exploit has been published and may be used.
Original NVD description (English source)
A security vulnerability has been detected in itsourcecode Online Cake Ordering System 1.0. This impacts an unknown function of the file /addtransacdetail.php. The manipulation of the argument ID leads to sql injection. The attack is possible to be carried out remotely. The exploit has been disclosed publicly and may be used.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS