SQL injection in the 'del' parameter of /transactionsave.php in itsourcecode Online Cake Ordering System 1.0 lets an authenticated low-privilege remote attacker manipulate backend SQL queries, and publicly available exploit code exists. Impact is limited to low confidentiality, integrity, and availability effects per the assessed vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L, and the niche deployment footprint keeps overall risk low.
SQL injection in itsourcecode Online Cake Ordering System 1.0 lets an authenticated low-privileged remote user manipulate the prcd argument submitted to /inserttrans.php and alter backend database queries, with publicly available exploit code but no confirmed active exploitation (not listed in CISA KEV). The assessed CVSS 3.1 impact is low across confidentiality, integrity, and availability, and practical risk is further limited because this is a narrowly deployed tutorial application.
SQL injection in itsourcecode Online Cake Ordering System 1.0 allows an authenticated low-privileged remote user to manipulate the ID argument of /deletecustomer.php and alter database queries. Publicly available exploit code exists, but the application is a niche tutorial-style system rarely deployed in production, so the realistic priority is LOW despite remote reachability. The weakness is limited to low confidentiality, integrity, and availability impact and requires valid credentials before exploitation.
SvelteKit (@sveltejs/kit) before 3.0.0 can send a victim's browser to an attacker-controlled site when an enhanced form action (use:enhance) accepts an action path beginning with // and a non-redirect form result is used for navigation. The issue is a client-side open redirect (CWE-601) requiring a crafted link or form action plus victim interaction, and it does not compromise the SvelteKit server or expose application data; only off-site navigation is possible. No public exploit code was identified at time of analysis, and the CVSS v4 score is 2.1.
Uncontrolled resource consumption in the IoTDB JDBC Driver (versions 1.3.3 through 2.0.10) can let attacker-influenced database responses or endpoints exhaust resources in the client application that integrates the driver, degrading or denying availability on that host. The flaw is client-side, so exposure requires an application to use the affected driver to establish IoTDB connections; the Apache advisory does not name the exact triggering feature. No public exploit code or CISA KEV entry was identified at time of analysis, and the assessed impact is limited to availability (CVSS 3.1: AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L).