CVE-2026-123988 · Other
NO FIX YET
The SililaWijesinghe Food Ordering System serves a directory listing of its /admin/ folder. A remote attacker can browse those files without logging in, which may reveal internal files.
first public Nov 7, 2026 · 1 source
Check it with your coding agent
It checks your repository and tells you if you’re affected, with the fix.
Any site that runs this food ordering application with its admin folder reachable from the internet is exposed. The sources do not name affected versions, since the product does not use versioning and the vendor did not respond. Installations that block direct access to the admin folder are not affected.
Not affected if admin-folder-blocked, not-deployed
Who cares food-ordering-system, php, self-hosted
/Food-Ordering-System/admin/ path on your deployment without logging in and see whether a file listing appearsOptions Indexes (Apache) or autoindex on (nginx) covering that folderNo fix yet, per the sources.
A vulnerability has been found in SililaWijesinghe Food Ordering System up to ba314e897e3365600461e5ea59432e39ceaa0fa5. This issue affects some unknown processing of the file /Food-Ordering-System/admin/. Such manipulation leads to exposure of information through directory listing. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. This product does not use versioning. This is why information about affected and unaffected releases are unavailable. The vendor was contacted early about this disclosure but did not respond in any way.
This page as .md · .json · CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.