CVE-2026-76996
HighCVSS 7.3Exploitation Probability (EPSS)
Low risk18th percentile - higher than 18% of all known CVEs
Summary
A SQL injection vulnerability was discovered in SourceCodester Simple Online Food Ordering System 1.0 in the file /fos/admin/view_order.php. Manipulation of the ID argument allows remote attackers to inject SQL code. The exploit has been publicly released and may be used in attacks.
Risk Assessment
An attacker can gain unauthorized access to the database, steal or modify data, posing a serious threat to data integrity and confidentiality.
Recommendation
Apply vendor patches or restrict access to view_order.php, and use parameterized queries.
Other vulnerabilities in SourceCodester Simple Online Food Ordering System
See all- CVE-2026-81203High
A vulnerability has been found in SourceCodester Simple Online Food Ordering System 1.0. This affects an unknown function of the file /admin/ajax.php?action=login2. The manipulation of the argument email leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.
- CVE-2026-78248High
A vulnerability was determined in SourceCodester Simple Online Food Ordering System 1.0. Impacted is an unknown function of the file /fos/admin/ajax.php?action=save_settings. This manipulation of the argument Name causes sql injection. The attack is possible to be carried out remotely. The exploit has been publicly disclosed and may be utilized.
- CVE-2026-78247High
SQL injection vulnerability in SourceCodester Simple Online Food Ordering System 1.0 in the file /fos/admin/ajax.php?action=confirm_order. Manipulation of the argument ID allows remote attack. The exploit has been made public.
- CVE-2026-78199High
A vulnerability was detected in SourceCodester Simple Online Food Ordering System 1.0 in an unknown function of the file /fos/view_prod.php. Manipulation of the ID argument results in SQL injection. Remote exploitation is possible, and the exploit is now public.
- CVE-2026-78198High
A security vulnerability has been detected in SourceCodester Simple Online Food Ordering System 1.0 in some unknown processing of the file /fos/admin/ajax.php?action=add_to_cart. Manipulation of the pid argument leads to SQL injection. The attack may be launched remotely, and the exploit has been disclosed publicly.
- CVE-2026-78197High
A weakness has been identified in SourceCodester Simple Online Food Ordering System 1.0. This vulnerability affects unknown code in the file /fos/admin/ajax.php?action=save_user. Manipulation of the Username argument causes SQL injection. The attack may be initiated remotely, and the exploit is public.
- CVE-2026-76998High
Vulnerability in SourceCodester Simple Online Food Ordering System version 1.0 in the file /admin/ajax.php?action=delete_category is due to SQL injection via the ID argument. A remote attacker can exploit this flaw to manipulate the database.
- CVE-2026-76997Medium
The vulnerability in SourceCodester Simple Online Food Ordering System version 1.0 concerns SQL injection in an unknown function of the file /admin/ajax.php?action=save_category. Manipulation of the ID argument allows remote attack, and the exploit is publicly available.
- CVE-2026-76995Medium
The vulnerability in SourceCodester Simple Online Food Ordering System version 1.0 concerns unrestricted file upload in the file /admin/ajax.php?action=save_menu. Manipulation of the img argument allows remote attack, and the exploit is publicly available.
- CVE-2026-76050High
A vulnerability was found in SourceCodester Simple Online Food Ordering System 1.0, affecting an unknown function in /admin/ajax.php?action=delete_menu. Manipulation of ID leads to SQL injection. Remote attack is possible and exploit is public.
Original NVD description (English source)
A security flaw has been discovered in SourceCodester Simple Online Food Ordering System 1.0. Impacted is an unknown function of the file /fos/admin/view_order.php. The manipulation of the argument ID results in sql injection. The attack may be performed from remote. The exploit has been released to the public and may be used for attacks.