Live › vulnerability › CVE-2026-113741
Go to dashboarditsourcecode Online Cake Ordering System 1.0 has a cross-site scripting flaw in its /404.php page, where the useruid argument is not sanitized. A remote attacker can craft a link that runs script in a visitor's browser, which can steal session data or act as that user.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Sites running itsourcecode Online Cake Ordering System 1.0 that serve the /404.php page. The sources do not say which configurations are affected beyond that. Teams not running this product can skip it.
No product ranges from the sources yet.
/404.php exists in the web root.Unknown from the sources.
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
A vulnerability has been found in itsourcecode Online Cake Ordering System 1.0. Affected by this issue is some unknown functionality of the file /404.php. Such manipulation of the argument useruid leads to cross site scripting. The attack may be performed from remote. The exploit has been disclosed to the public and may be used.
This page as .md · .json · in your agent: get_signal("CVE-2026-113741")
NVD data is provided by NIST and is public domain · EPSS scores by FIRST, used with attribution. Posts quoted belong to their authors.