{"id":"CVE-2026-123988","kind":"vulnerability","aliases":["CVE-2026-123988"],"related":[],"title":"Food Ordering System: admin directory listing exposes files to remote visitors","description":"A vulnerability has been found in SililaWijesinghe Food Ordering System up to ba314e897e3365600461e5ea59432e39ceaa0fa5. This issue affects some unknown processing of the file /Food-Ordering-System/admin/. Such manipulation leads to exposure of information through directory listing. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. This product does not use versioning. This is why information about affected and unaffected releases are unavailable. The vendor was contacted early about this disclosure but did not respond in any way.","summary":"The SililaWijesinghe Food Ordering System serves a directory listing of its /admin/ folder. A remote attacker can browse those files without logging in, which may reveal internal files.","severity":"medium","cvss":5.5,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["food-ordering-system","other","php","self-hosted"],"not_affected_if":["admin-folder-blocked","not-deployed"],"how_to_check":"- Request the `/Food-Ordering-System/admin/` path on your deployment without logging in and see whether a file listing appears\n- Check the web server config for `Options Indexes` (Apache) or `autoindex on` (nginx) covering that folder","fix":null,"status":"open","published_at":"2026-11-07T14:17:02+00:00","first_seen_at":"2026-11-07T14:47:39+00:00","triaged_at":"2026-11-07T14:49:45+00:00","updated_at":"2026-11-07T14:49:45+00:00","category":"other","confidence":0.6,"triage":{"at":"2026-11-07T14:49:45Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"internet","title":"Food Ordering System: admin directory listing exposes files to remote visitors","impact":"low","summary":"The SililaWijesinghe Food Ordering System serves a directory listing of its /admin/ folder. A remote attacker can browse those files without logging in, which may reveal internal files.","audience":"businesses","category":"other","nicknames":[],"who_cares":["food-ordering-system","php","self-hosted"],"confidence":0.6,"fix_status":"unknown","needs_auth":"no","worst_case":"Attacker lists admin folder files, possibly reading internal source details.","analyst_note":"Confirm which files the directory listing exposes and whether any contain credentials, via the NVD entry https://nvd.nist.gov/vuln/detail/CVE-2026-123988.","how_to_check":"- Request the `/Food-Ordering-System/admin/` path on your deployment without logging in and see whether a file listing appears\n- Check the web server config for `Options Indexes` (Apache) or `autoindex on` (nginx) covering that folder\n- unknown","plain_action":"","needs_analyst":true,"not_affected_if":["admin-folder-blocked","not-deployed"],"who_is_affected":"Any site that runs this food ordering application with its admin folder reachable from the internet is exposed. The sources do not name affected versions, since the product does not use versioning and the vendor did not respond. Installations that block direct access to the admin folder are not affected.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000707,"input_tokens":4328,"output_tokens":548,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-123988':14A,17A '-2026':13A,16A '/admin':38B '/food-ordering-system/admin':77C 'admin':4A 'affect':70C,117C 'attack':42B,89C 'ba314e897e3365600461e5ea59432e39ceaa0fa5':67C 'brows':44B 'contact':126C 'cve':12A,15A 'directori':5A,34B,86C 'disclos':98C 'disclosur':130C 'earli':127C 'exploit':95C 'expos':7A 'exposur':82C 'file':8A,46B,54B,76C 'folder':39B 'food':1A,19B,29B,62C 'food-ordering-system':18B 'found':59C 'host':26B 'inform':84C,115C 'intern':53B 'issu':69C 'launch':92C 'lead':80C 'list':6A,35B,87C 'log':48B 'manipul':79C 'may':51B,103C 'order':2A,20B,30B,63C 'php':23B 'process':73C 'product':107C 'public':101C 'releas':120C 'remot':10A,41B,93C 'respond':134C 'reveal':52B 'self':25B 'self-host':24B 'serv':32B 'sililawijesingh':28B,61C 'system':3A,21B,31B,64C 'unaffect':119C 'unavail':122C 'unknown':72C 'use':105C,110C 'vendor':124C 'version':111C 'visitor':11A 'vulner':56C 'way':137C 'without':47B","nicknames":[],"mitigations":[],"who_affected":"Any site that runs this food ordering application with its admin folder reachable from the internet is exposed. The sources do not name affected versions, since the product does not use versioning and the vendor did not respond. Installations that block direct access to the admin folder are not affected.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["foodorderingsystem","medium","other","php","selfhosted"],"campaign_type":null,"search_a":"'-123988':14A,17A '-2026':13A,16A 'admin':4A 'cve':12A,15A 'directori':5A 'expos':7A 'file':8A 'food':1A 'list':6A 'order':2A 'remot':10A 'system':3A 'visitor':11A","search_b":"'/admin':38B 'attack':42B 'brows':44B 'directori':34B 'file':46B,54B 'folder':39B 'food':19B,29B 'food-ordering-system':18B 'host':26B 'intern':53B 'list':35B 'log':48B 'may':51B 'order':20B,30B 'php':23B 'remot':41B 'reveal':52B 'self':25B 'self-host':24B 'serv':32B 'sililawijesingh':28B 'system':21B,31B 'without':47B","search_c":"'/food-ordering-system/admin':77C 'affect':70C,117C 'attack':89C 'ba314e897e3365600461e5ea59432e39ceaa0fa5':67C 'contact':126C 'directori':86C 'disclos':98C 'disclosur':130C 'earli':127C 'exploit':95C 'exposur':82C 'file':76C 'food':62C 'found':59C 'inform':84C,115C 'issu':69C 'launch':92C 'lead':80C 'list':87C 'manipul':79C 'may':103C 'order':63C 'process':73C 'product':107C 'public':101C 'releas':120C 'remot':93C 'respond':134C 'sililawijesingh':61C 'system':64C 'unaffect':119C 'unavail':122C 'unknown':72C 'use':105C,110C 'vendor':124C 'version':111C 'vulner':56C 'way':137C","first_public_at":"2026-11-07T14:17:02+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"cna@vuldb.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-123988","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-123988","severity":null,"published_at":"2026-11-07T14:17:02+00:00","modified_at":"2026-11-07T14:17:02+00:00","first_seen_at":"2026-11-07T14:47:39+00:00","fetched_at":"2026-11-07T14:47:39+00:00","note":null}],"documents":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}