Live › vulnerability › CVE-2026-114378
Go to dashboardThe itsourcecode Online Cake Ordering System 1.0 takes the ID argument of /deleteproduct.php without proper sanitizing, so a remote request can inject SQL. An attacker could read or change the shop's database, and a public exploit now exists.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Sites running the itsourcecode Online Cake Ordering System 1.0 PHP application with the /deleteproduct.php page reachable. The sources do not say whether other versions are affected or whether the page requires a login.
No product ranges from the sources yet.
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
A vulnerability was detected in itsourcecode Online Cake Ordering System 1.0. This affects an unknown part of the file /deleteproduct.php. The manipulation of the argument ID results in sql injection. The attack may be launched remotely. The exploit is now public and may be used.
This page as .md · .json · in your agent: get_signal("CVE-2026-114378")
NVD data is provided by NIST and is public domain · EPSS scores by FIRST, used with attribution. Posts quoted belong to their authors.