Live › vulnerability › CVE-2026-114381
Go to dashboardThe itsourcecode Online Cake Ordering System 1.0 passes the ID argument of /orderdetail.php into a database query without proper sanitization. A remote attacker can inject SQL to read or alter the application's database, and the exploit has been publicly disclosed.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Teams that deploy the itsourcecode Online Cake Ordering System 1.0 web application with its orderdetail.php page reachable over the network. Deployments that do not run this project, or that block the page from remote users, can skip it.
No product ranges from the sources yet.
1.0 by reviewing the project files or deployment recordorderdetail.php in the web root and review how the ID parameter is used in its SQL queriesorderdetail.php at the web server or until the query is changed to use prepared statements with bound parametersEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
A vulnerability was determined in itsourcecode Online Cake Ordering System 1.0. The affected element is an unknown function of the file /orderdetail.php. Executing a manipulation of the argument ID can lead to sql injection. The attack may be performed from remote. The exploit has been publicly disclosed and may be utilized.
This page as .md · .json · in your agent: get_signal("CVE-2026-114381")
NVD data is provided by NIST and is public domain · EPSS scores by FIRST, used with attribution. Posts quoted belong to their authors.