CVE-2026-122190 · Other
NO FIX YET
A flaw in the admin/add_category.php page of SourceCodester Online Food Ordering System 1.0 lets the category_title input carry script that is not properly handled. An attacker who gets an admin to open a crafted link or page could run script in that admin's browser session.
first public Nov 5, 2026 · 1 source
Check it with your coding agent
It checks your repository and tells you if you’re affected, with the fix.
Teams that run the SourceCodester Online Food Ordering System 1.0 PHP application with its admin area reachable. The flaw sits in the Category Management form, so the admin panel is the exposed surface. Installations where the admin area is not reachable from the network, or that run a different version, are likely not affected. The sources do not give a fixed version.
Not affected if admin-area-not-exposed
Who cares online-food-ordering, php, self-hosted
1.0, by looking for admin/add_category.php in the web rootNo fix yet, per the sources.
A vulnerability was found in SourceCodester Online Food Ordering System 1.0. The impacted element is an unknown function of the file admin/add_category.php of the component Category Management. Performing a manipulation of the argument category_title results in cross site scripting. The attack may be initiated remotely. The exploit has been made public and could be used.
This page as .md · .json · CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.