CVE-2026-15135
HighCVSS 7.3Exploitation Probability (EPSS)
Low risk19th percentile - higher than 19% of all known CVEs
Summary
A SQL injection vulnerability has been discovered in code-projects Online Food Order System 1.0 in the /edit_food_items.php file. Remote manipulation of the update argument allows SQL injection. The exploit has been publicly released.
Risk Assessment
The organization is at risk of unauthorized database access, data leakage of customer and order information, and potential system compromise.
Recommendation
Immediately update the system to the latest version or apply a security patch against SQL injection. Until then, restrict access to the /edit_food_items.php file.
Other vulnerabilities in Online Food Order System
See all- CVE-2026-19917Medium
A flaw has been found in code-projects Online Food Order System 1.0. An unknown function of the file delete_food_items1.php is affected. Manipulation of the argument checkbox leads to SQL injection. The attack can be executed remotely. The exploit has been published and may be used.
- CVE-2026-19916Low
A vulnerability was detected in the Online Food Order System 1.0 by code-projects. It affects an unknown function in the file edit_food_items.php. Manipulation of the argument dname leads to cross-site scripting. The attack can be performed remotely, and the exploit is publicly available.
Original NVD description (English source)
A security flaw has been discovered in code-projects Online Food Order System 1.0. This affects an unknown part of the file /edit_food_items.php. The manipulation of the argument update results in sql injection. It is possible to launch the attack remotely. The exploit has been released to the public and may be used for attacks.