Live › vulnerability › CVE-2026-116605
Go to dashboardThe SourceCodester Online Food Ordering System 1.0 relies on client-side checks for server-side security in order.php, so a remote attacker can manipulate the price or title argument. The exploit has been published and could be used.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-27 01:34 UTC. All times on this page are UTC.
Teams running the SourceCodester Online Food Ordering System 1.0 PHP application on their own servers are exposed, since the flaw is in how order.php handles submitted values. Teams not running this specific application can skip it, and the sources do not say whether other versions are affected.
No product ranges from the sources yet.
1.0 by reviewing the installed filesorder.php to see whether the price and title values are validated on the serverEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
A vulnerability was found in SourceCodester Online Food Ordering System 1.0. The impacted element is an unknown function of the file order.php. The manipulation of the argument price/title results in client-side enforcement of server-side security. It is possible to launch the attack remotely. The exploit has been made public and could be used.
This page as .md · .json · in your agent: get_signal("CVE-2026-116605")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.