CVE-2026-78197
HighCVSS 7.3Exploitation Probability (EPSS)
Low risk18th percentile - higher than 18% of all known CVEs
Summary
A weakness has been identified in SourceCodester Simple Online Food Ordering System 1.0. This vulnerability affects unknown code in the file /fos/admin/ajax.php?action=save_user. Manipulation of the Username argument causes SQL injection. The attack may be initiated remotely, and the exploit is public.
Risk Assessment
A remote attacker can manipulate SQL queries, potentially leading to unauthorized database access, data theft, or system integrity compromise.
Recommendation
Apply vendor patches or implement parameterized queries to prevent SQL injection. Restrict access to the admin panel.
Other vulnerabilities in SourceCodester Simple Online Food Ordering System
See all- CVE-2026-81203High
A vulnerability has been found in SourceCodester Simple Online Food Ordering System 1.0. This affects an unknown function of the file /admin/ajax.php?action=login2. The manipulation of the argument email leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.
- CVE-2026-78248High
A vulnerability was determined in SourceCodester Simple Online Food Ordering System 1.0. Impacted is an unknown function of the file /fos/admin/ajax.php?action=save_settings. This manipulation of the argument Name causes sql injection. The attack is possible to be carried out remotely. The exploit has been publicly disclosed and may be utilized.
- CVE-2026-78247High
SQL injection vulnerability in SourceCodester Simple Online Food Ordering System 1.0 in the file /fos/admin/ajax.php?action=confirm_order. Manipulation of the argument ID allows remote attack. The exploit has been made public.
- CVE-2026-78199High
A vulnerability was detected in SourceCodester Simple Online Food Ordering System 1.0 in an unknown function of the file /fos/view_prod.php. Manipulation of the ID argument results in SQL injection. Remote exploitation is possible, and the exploit is now public.
- CVE-2026-78198High
A security vulnerability has been detected in SourceCodester Simple Online Food Ordering System 1.0 in some unknown processing of the file /fos/admin/ajax.php?action=add_to_cart. Manipulation of the pid argument leads to SQL injection. The attack may be launched remotely, and the exploit has been disclosed publicly.
- CVE-2026-76998High
Vulnerability in SourceCodester Simple Online Food Ordering System version 1.0 in the file /admin/ajax.php?action=delete_category is due to SQL injection via the ID argument. A remote attacker can exploit this flaw to manipulate the database.
- CVE-2026-76997Medium
The vulnerability in SourceCodester Simple Online Food Ordering System version 1.0 concerns SQL injection in an unknown function of the file /admin/ajax.php?action=save_category. Manipulation of the ID argument allows remote attack, and the exploit is publicly available.
- CVE-2026-76996High
A SQL injection vulnerability was discovered in SourceCodester Simple Online Food Ordering System 1.0 in the file /fos/admin/view_order.php. Manipulation of the ID argument allows remote attackers to inject SQL code. The exploit has been publicly released and may be used in attacks.
- CVE-2026-76995Medium
The vulnerability in SourceCodester Simple Online Food Ordering System version 1.0 concerns unrestricted file upload in the file /admin/ajax.php?action=save_menu. Manipulation of the img argument allows remote attack, and the exploit is publicly available.
- CVE-2026-76050High
A vulnerability was found in SourceCodester Simple Online Food Ordering System 1.0, affecting an unknown function in /admin/ajax.php?action=delete_menu. Manipulation of ID leads to SQL injection. Remote attack is possible and exploit is public.
Original NVD description (English source)
A weakness has been identified in SourceCodester Simple Online Food Ordering System 1.0. This vulnerability affects unknown code of the file /fos/admin/ajax.php?action=save_user. This manipulation of the argument Username causes sql injection. The attack may be initiated remotely. The exploit has been made available to the public and could be used for attacks.