CVE-2026-78247
HighCVSS 7.3Exploitation Probability (EPSS)
Low risk34th percentile - higher than 34% of all known CVEs
Summary
SQL injection vulnerability in SourceCodester Simple Online Food Ordering System 1.0 in the file /fos/admin/ajax.php?action=confirm_order. Manipulation of the argument ID allows remote attack. The exploit has been made public.
Risk Assessment
An attacker can gain unauthorized access to the database, modify data, or steal sensitive information, potentially leading to system integrity compromise.
Recommendation
Update the system to the latest version or apply a patch. Use parameterized queries and input validation to prevent SQL injection.
Other vulnerabilities in SourceCodester Simple Online Food Ordering System
See all- CVE-2026-81203High
A vulnerability has been found in SourceCodester Simple Online Food Ordering System 1.0. This affects an unknown function of the file /admin/ajax.php?action=login2. The manipulation of the argument email leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.
- CVE-2026-78248High
A vulnerability was determined in SourceCodester Simple Online Food Ordering System 1.0. Impacted is an unknown function of the file /fos/admin/ajax.php?action=save_settings. This manipulation of the argument Name causes sql injection. The attack is possible to be carried out remotely. The exploit has been publicly disclosed and may be utilized.
- CVE-2026-78199High
A vulnerability was detected in SourceCodester Simple Online Food Ordering System 1.0 in an unknown function of the file /fos/view_prod.php. Manipulation of the ID argument results in SQL injection. Remote exploitation is possible, and the exploit is now public.
- CVE-2026-78198High
A security vulnerability has been detected in SourceCodester Simple Online Food Ordering System 1.0 in some unknown processing of the file /fos/admin/ajax.php?action=add_to_cart. Manipulation of the pid argument leads to SQL injection. The attack may be launched remotely, and the exploit has been disclosed publicly.
- CVE-2026-78197High
A weakness has been identified in SourceCodester Simple Online Food Ordering System 1.0. This vulnerability affects unknown code in the file /fos/admin/ajax.php?action=save_user. Manipulation of the Username argument causes SQL injection. The attack may be initiated remotely, and the exploit is public.
- CVE-2026-76998High
Vulnerability in SourceCodester Simple Online Food Ordering System version 1.0 in the file /admin/ajax.php?action=delete_category is due to SQL injection via the ID argument. A remote attacker can exploit this flaw to manipulate the database.
- CVE-2026-76997Medium
The vulnerability in SourceCodester Simple Online Food Ordering System version 1.0 concerns SQL injection in an unknown function of the file /admin/ajax.php?action=save_category. Manipulation of the ID argument allows remote attack, and the exploit is publicly available.
- CVE-2026-76996High
A SQL injection vulnerability was discovered in SourceCodester Simple Online Food Ordering System 1.0 in the file /fos/admin/view_order.php. Manipulation of the ID argument allows remote attackers to inject SQL code. The exploit has been publicly released and may be used in attacks.
- CVE-2026-76995Medium
The vulnerability in SourceCodester Simple Online Food Ordering System version 1.0 concerns unrestricted file upload in the file /admin/ajax.php?action=save_menu. Manipulation of the img argument allows remote attack, and the exploit is publicly available.
- CVE-2026-76050High
A vulnerability was found in SourceCodester Simple Online Food Ordering System 1.0, affecting an unknown function in /admin/ajax.php?action=delete_menu. Manipulation of ID leads to SQL injection. Remote attack is possible and exploit is public.
Original NVD description (English source)
A vulnerability was found in SourceCodester Simple Online Food Ordering System 1.0. This issue affects some unknown processing of the file /fos/admin/ajax.php?action=confirm_order. The manipulation of the argument ID results in sql injection. The attack can be executed remotely. The exploit has been made public and could be used.