Live › vulnerability › CVE-2026-113740
Go to dashboardThe itsourcecode Online Cake Ordering System 1.0 passes the ID argument of /deletecustomer.php into a SQL query without sanitizing it. A remote attacker can alter database queries to read or change stored customer data, and a public exploit exists.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Teams running the itsourcecode Online Cake Ordering System 1.0 PHP application that expose /deletecustomer.php. The sources do not say whether any other version is affected or whether a vendor fix exists.
No product ranges from the sources yet.
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
A flaw has been found in itsourcecode Online Cake Ordering System 1.0. Affected by this vulnerability is an unknown functionality of the file /deletecustomer.php. This manipulation of the argument ID causes sql injection. The attack is possible to be carried out remotely. The exploit has been published and may be used.
This page as .md · .json · in your agent: get_signal("CVE-2026-113740")
NVD data is provided by NIST and is public domain · EPSS scores by FIRST, used with attribution. Posts quoted belong to their authors.