Live › vulnerability › CVE-2026-116101
Go to dashboardThe itsourcecode Online Cake Ordering System 1.0 passes the ID argument of /deletetransac.php into a SQL query without sanitizing it. A remote attacker can alter database queries to read or change order data, and a public exploit exists.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-26 01:38 UTC. All times on this page are UTC.
Sites that run the itsourcecode Online Cake Ordering System 1.0 PHP application with /deletetransac.php reachable from the internet are exposed. The sources do not say whether a login is required to reach the page. Teams that do not run this product can skip it.
No product ranges from the sources yet.
deletetransac.php in the web root.1.0 from the application files or vendor source.Unknown from the sources.
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
A vulnerability was found in itsourcecode Online Cake Ordering System 1.0. The affected element is an unknown function of the file /deletetransac.php. The manipulation of the argument ID results in sql injection. The attack may be performed from remote. The exploit has been made public and could be used.
This page as .md · .json · in your agent: get_signal("CVE-2026-116101")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.