---
id: "CVE-2026-112087"
kind: "vulnerability"
aliases: ["CVE-2026-112087"]
title: "itsourcecode Online Cake Ordering System: SQL injection in confirm.php cancel parameter"
severity: "medium"
cvss: 6.5
epss: null
exploited: false
status: "open"
category: "other"
products: []
ecosystems: []
tags: ["other", "php", "self-hosted", "sql-injection"]
not_affected_if: ["not-installed"]
published_at: "2026-10-19T07:16:30+00:00"
first_seen_at: "2026-10-23T21:57:17+00:00"
updated_at: "2026-10-25T03:57:22+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-112087", "first_seen_at": "2026-10-23T21:57:17+00:00"}]
---

# itsourcecode Online Cake Ordering System: SQL injection in confirm.php cancel parameter

The itsourcecode Online Cake Ordering System 1.0 does not sanitize the cancel argument passed to confirm.php, which allows SQL injection. A remote attacker can send crafted requests to read or alter the application's database.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- unknown

## Fix

- unknown

## Timeline

- 2026-10-23T21:57:17+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-112087

## From the sources

A weakness has been identified in itsourcecode Online Cake Ordering System 1.0. This issue affects some unknown processing of the file confirm.php. This manipulation of the argument cancel causes sql injection. The attack may be initiated remotely. The exploit has been made available to the public and could be used for attacks.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_