CVE-2026-76997
MediumCVSS 6.3Exploitation Probability (EPSS)
Low risk10th percentile - higher than 10% of all known CVEs
Summary
The vulnerability in SourceCodester Simple Online Food Ordering System version 1.0 concerns SQL injection in an unknown function of the file /admin/ajax.php?action=save_category. Manipulation of the ID argument allows remote attack, and the exploit is publicly available.
Risk Assessment
The risk includes the possibility of remote SQL injection, potentially leading to unauthorized database access, data theft, or modification.
Recommendation
It is recommended to immediately apply patches or updates to the system and implement SQL injection protections such as parameterized queries.
Other vulnerabilities in SourceCodester Simple Online Food Ordering System
See all- CVE-2026-81203High
A vulnerability has been found in SourceCodester Simple Online Food Ordering System 1.0. This affects an unknown function of the file /admin/ajax.php?action=login2. The manipulation of the argument email leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.
- CVE-2026-78248High
A vulnerability was determined in SourceCodester Simple Online Food Ordering System 1.0. Impacted is an unknown function of the file /fos/admin/ajax.php?action=save_settings. This manipulation of the argument Name causes sql injection. The attack is possible to be carried out remotely. The exploit has been publicly disclosed and may be utilized.
- CVE-2026-78247High
SQL injection vulnerability in SourceCodester Simple Online Food Ordering System 1.0 in the file /fos/admin/ajax.php?action=confirm_order. Manipulation of the argument ID allows remote attack. The exploit has been made public.
- CVE-2026-78199High
A vulnerability was detected in SourceCodester Simple Online Food Ordering System 1.0 in an unknown function of the file /fos/view_prod.php. Manipulation of the ID argument results in SQL injection. Remote exploitation is possible, and the exploit is now public.
- CVE-2026-78198High
A security vulnerability has been detected in SourceCodester Simple Online Food Ordering System 1.0 in some unknown processing of the file /fos/admin/ajax.php?action=add_to_cart. Manipulation of the pid argument leads to SQL injection. The attack may be launched remotely, and the exploit has been disclosed publicly.
- CVE-2026-78197High
A weakness has been identified in SourceCodester Simple Online Food Ordering System 1.0. This vulnerability affects unknown code in the file /fos/admin/ajax.php?action=save_user. Manipulation of the Username argument causes SQL injection. The attack may be initiated remotely, and the exploit is public.
- CVE-2026-76998High
Vulnerability in SourceCodester Simple Online Food Ordering System version 1.0 in the file /admin/ajax.php?action=delete_category is due to SQL injection via the ID argument. A remote attacker can exploit this flaw to manipulate the database.
- CVE-2026-76996High
A SQL injection vulnerability was discovered in SourceCodester Simple Online Food Ordering System 1.0 in the file /fos/admin/view_order.php. Manipulation of the ID argument allows remote attackers to inject SQL code. The exploit has been publicly released and may be used in attacks.
- CVE-2026-76995Medium
The vulnerability in SourceCodester Simple Online Food Ordering System version 1.0 concerns unrestricted file upload in the file /admin/ajax.php?action=save_menu. Manipulation of the img argument allows remote attack, and the exploit is publicly available.
- CVE-2026-76050High
A vulnerability was found in SourceCodester Simple Online Food Ordering System 1.0, affecting an unknown function in /admin/ajax.php?action=delete_menu. Manipulation of ID leads to SQL injection. Remote attack is possible and exploit is public.
Original NVD description (English source)
A weakness has been identified in SourceCodester Simple Online Food Ordering System 1.0. The affected element is an unknown function of the file /admin/ajax.php?action=save_category. This manipulation of the argument ID causes sql injection. It is possible to initiate the attack remotely. The exploit has been made available to the public and could be used for attacks.