Live › vulnerability › CVE-2026-114267
Go to dashboardSourceCodester Food Order Management System 1.0 has admin PHP endpoints (add_admin, add_food, change_pwd, delete, edit_admin and others) with no server-side authentication check. An unauthenticated remote attacker can create admin accounts, change admin passwords, edit or delete data. A public write-up exists and no fix has been published.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Teams running the SourceCodester Food Order Management System 1.0 PHP application, usually a small self-hosted restaurant or ordering site. The sources do not name a patched version or a fix, so any instance reachable from the internet should be treated as exposed until its admin area is restricted. Teams that do not run this product can skip it.
| Product | Ecosystem | Affected | Fixed in |
|---|---|---|---|
| Food Order Management System | sourcecodester | 1.0 | – |
user]) check followed by exit at the top of every admin/*.php fileEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
A vulnerability was detected in SourceCodester Food Order Management System 1.0. Affected is an unknown function of the component Admin Endpoint. The manipulation results in missing authorization. The attack may be performed from remote. The exploit is now public and may be used.
This page as .md · .json · in your agent: get_signal("CVE-2026-114267")
NVD data is provided by NIST and is public domain · EPSS scores by FIRST, used with attribution. Posts quoted belong to their authors.