{"id":"CVE-2026-122190","kind":"vulnerability","aliases":["CVE-2026-122190"],"related":[],"title":"Online Food Ordering System: admin category form allows cross-site scripting","description":"A vulnerability was found in SourceCodester Online Food Ordering System 1.0. The impacted element is an unknown function of the file admin/add_category.php of the component Category Management. Performing a manipulation of the argument category_title results in cross site scripting. The attack may be initiated remotely. The exploit has been made public and could be used.","summary":"A flaw in the admin/add_category.php page of SourceCodester Online Food Ordering System 1.0 lets the category_title input carry script that is not properly handled. An attacker who gets an admin to open a crafted link or page could run script in that admin's browser session.","severity":"low","cvss":3.3,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["online-food-ordering","other","php","self-hosted"],"not_affected_if":["admin-area-not-exposed"],"how_to_check":"- Check whether the application runs SourceCodester Online Food Ordering System, version `1.0`, by looking for `admin/add_category.php` in the web root","fix":null,"status":"open","published_at":"2026-11-05T04:17:12+00:00","first_seen_at":"2026-11-05T04:31:48+00:00","triaged_at":"2026-11-05T04:33:38+00:00","updated_at":"2026-11-05T04:33:38+00:00","category":"other","confidence":0.5,"triage":{"at":"2026-11-05T04:33:38Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"internet","title":"Online Food Ordering System: admin category form allows cross-site scripting","impact":"low","summary":"A flaw in the admin/add_category.php page of SourceCodester Online Food Ordering System 1.0 lets the category_title input carry script that is not properly handled. An attacker who gets an admin to open a crafted link or page could run script in that admin's browser session.","audience":"businesses","category":"other","nicknames":[],"who_cares":["php","self-hosted","online-food-ordering"],"confidence":0.5,"fix_status":"unknown","needs_auth":"unknown","worst_case":"script runs in an admin's browser session","analyst_note":"Confirm whether the admin login is required to reach add_category.php and whether a vendor or upstream fix exists; the sources give no fixed version.","how_to_check":"- Check whether the application runs SourceCodester Online Food Ordering System, version `1.0`, by looking for `admin/add_category.php` in the web root\n- unknown","plain_action":"","needs_analyst":true,"not_affected_if":["admin-area-not-exposed"],"who_is_affected":"Teams that run the SourceCodester Online Food Ordering System 1.0 PHP application with its admin area reachable. The flaw sits in the Category Management form, so the admin panel is the exposed surface. Installations where the admin area is not reachable from the network, or that run a different version, are likely not affected. The sources do not give a fixed version.","user_interaction":"yes","needs_special_setup":"unknown","severity_if_unknown":"low"},"cost_usd":0.000695,"input_tokens":4223,"output_tokens":545,"severity_before":"low"},"analyst_status":null,"analyst_note":null,"search":"'-122190':15A,18A '-2026':14A,17A '1.0':40B,85C 'admin':5A,58B,71B 'admin/add_category.php':32B,96C 'allow':8A 'argument':107C 'attack':54B,116C 'browser':73B 'carri':46B 'categori':6A,43B,100C,108C 'compon':99C 'could':66B,128C 'craft':62B 'cross':10A,112C 'cross-sit':9A 'cve':13A,16A 'element':88C 'exploit':122C 'file':95C 'flaw':29B 'food':2A,21B,37B,82C 'form':7A 'found':78C 'function':92C 'get':56B 'handl':52B 'host':27B 'impact':87C 'initi':119C 'input':45B 'let':41B 'link':63B 'made':125C 'manag':101C 'manipul':104C 'may':117C 'onlin':1A,20B,36B,81C 'online-food-ord':19B 'open':60B 'order':3A,22B,38B,83C 'page':33B,65B 'perform':102C 'php':24B 'proper':51B 'public':126C 'remot':120C 'result':110C 'run':67B 'script':12A,47B,68B,114C 'self':26B 'self-host':25B 'session':74B 'site':11A,113C 'sourcecodest':35B,80C 'system':4A,39B,84C 'titl':44B,109C 'unknown':91C 'use':130C 'vulner':76C","nicknames":[],"mitigations":[],"who_affected":"Teams that run the SourceCodester Online Food Ordering System 1.0 PHP application with its admin area reachable. The flaw sits in the Category Management form, so the admin panel is the exposed surface. Installations where the admin area is not reachable from the network, or that run a different version, are likely not affected. The sources do not give a fixed version.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["low","onlinefoodordering","other","php","selfhosted"],"campaign_type":null,"first_public_at":"2026-11-05T04:17:12+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"cna@vuldb.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-122190","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-122190","severity":null,"published_at":"2026-11-05T04:17:12+00:00","modified_at":"2026-11-05T04:17:12+00:00","first_seen_at":"2026-11-05T04:31:48+00:00","fetched_at":"2026-11-05T04:31:48+00:00","note":null}],"documents":[],"exploit_sources":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}