CVE-2026-116605
SourceCodester Online Food Ordering System order.php client-side enforcement of server-side security
SourceCodester Online Food Ordering System
CVSS
6.9MediumExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)No scoreNo FIRST EPSS score in this snapshot yet
Fixed inNone listedNo source names a fixed version. Check the vendor advisory below
What fixes it
No source in this snapshot names a fixed version. The vendor advisories under References are the place to check.
Description
A vulnerability was found in SourceCodester Online Food Ordering System 1.0. The impacted element is an unknown function of the file order.php. The manipulation of the argument price/title results in client-side enforcement of server-side security. It is possible to launch the attack remotely. The exploit has been made public and could be used.
Text from CVE List
Affected versions 1
- Online Food Ordering Systemaffected: 1.0CVE List
References 6
- vuldb.com/cve/CVE-2026-116605Advisoryvia CVE List
- vuldb.com/submit/1022965Advisoryvia CVE List
- github.com/CyberShailendra/SourceCodesterOrderPrice-AmountTamperingviaHiddenFormFieldsExploitvia CVE List
- vuldb.com/vuln/426511Referencevia CVE List
- vuldb.com/vuln/426511/ctiReferencevia CVE List
- sourcecodester.com/Referencevia CVE List