Live › vulnerability › CVE-2026-116604
Go to dashboardAn unknown function in admin/delete_admin.php of SourceCodester Online Food Ordering System 1.0 takes an ID argument without requiring authentication. A remote attacker can use it to trigger admin deletion actions without logging in, and the exploit is public.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-27 00:25 UTC. All times on this page are UTC.
Sites running SourceCodester Online Food Ordering System 1.0 with the admin directory reachable from the internet. Installations where the admin area is restricted to a private network or behind another authentication layer are less exposed. The sources do not name a specific configuration beyond the affected file.
No product ranges from the sources yet.
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
A vulnerability has been found in SourceCodester Online Food Ordering System 1.0. The affected element is an unknown function of the file admin/delete_admin.php. The manipulation of the argument ID leads to missing authentication. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.
This page as .md · .json · in your agent: get_signal("CVE-2026-116604")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.