Which versions of Online Food Ordering System are affected by CVE-2026-10694?

SourceCodester Online Food Ordering System 2.0 contains a critical file inclusion vulnerability (CVE-2026-10694) that allows any unauthenticated internet attacker to access arbitrary files on…

Is there a public PoC exploit available for CVE-2026-10694?

Yes, a public proof-of-concept exploit is available for CVE-2026-10694. Prioritise patching immediately. EPSS: 0.0%.

How to fix or mitigate CVE-2026-10694?

24 hours: Conduct inventory of all production instances of SourceCodester Online Food Ordering System 2.0; immediately implement network access controls or Web Application Firewall rules blocking suspicious 'page' parameter values and path traversal sequences. 7 days: Contact SourceCodester for official patch timeline and severity assessment; initiate evaluation of alternative food ordering platforms if vendor cannot commit to remediation within 30 days. 30 days: Deploy patched version when available, or complete migration to alternative solution; implement application-level input validation on the 'page' parameter as interim technical safeguard.

Online Food Ordering System CVE-2026-10694

Q: What is the CVSS score of CVE-2026-10694?

CVE-2026-10694 has a CVSS 4.0 base score of 5.5 (Medium). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2026-34059 MEDIUM

External Control of File Name or Path (CWE-73)

2026-06-03 VulDB

GHSA-4wh8-2pqj-9gw4

PHP Information Disclosure Online Food Ordering System Sourcecodester

5.5

CVSS 4.0 · Vendor: VulDB

Severity by source

Vendor (VulDB) PRIMARY

5.5 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from Vendor (VulDB) · only source for this CVE.

CVSS VectorVendor: VulDB

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Severity Changed

Jun 03, 2026 - 01:22 NVD

HIGH MEDIUM

CVSS changed

Jun 03, 2026 - 01:22 NVD

7.3 (HIGH) 5.5 (MEDIUM)

Analysis Generated

Jun 03, 2026 - 00:44 vuln.today

DescriptionCVE.org

A vulnerability was detected in SourceCodester Online Food Ordering System 2.0. Affected by this issue is the function include of the file /index.php. The manipulation of the argument page results in file inclusion. The attack can be launched remotely. The exploit is now public and may be used.

AnalysisAI

File inclusion in SourceCodester Online Food Ordering System 2.0 allows remote attackers to manipulate the 'page' parameter of /index.php to include arbitrary files via the application's include() function. Publicly available exploit code exists (referenced on GitHub), and the CVSS 7.3 score combined with no authentication or user interaction requirements (AV:N/AC:L/PR:N/UI:N) makes this trivially exploitable against any exposed deployment. The vulnerability falls under CWE-73 (External Control of File Name or Path) and primarily enables information disclosure, though depending on PHP configuration it may escalate to code execution.

Technical ContextAI

SourceCodester Online Food Ordering System is a PHP-based web application commonly used as a learning project or small-business deployment, distributed via sourcecodester.com. The flaw exists in /index.php where the user-supplied 'page' query parameter is passed directly into PHP's include() construct without sanitization or allow-listing. CWE-73 (External Control of File Name or Path) covers exactly this pattern - when user input controls a filesystem path, attackers can traverse directories (../) or, depending on PHP configuration (allow_url_include, allow_url_fopen), potentially include remote files. The CPE string cpe:2.3:a:sourcecodester:online_food_ordering_system:*:*:* indicates all versions are presumed affected, with version 2.0 explicitly named in the description.

RemediationAI

No vendor-released patch identified at time of analysis - SourceCodester projects are typically community-distributed scripts without formal patch pipelines, so administrators should plan to fix the code in place. The immediate fix is to replace the dynamic include in /index.php with an allow-list mapping of page identifiers to fixed file paths (for example, a switch statement that maps 'home' → 'pages/home.php') and reject any request whose 'page' value is not in the allow-list; this eliminates path traversal and remote inclusion entirely. As a compensating control, place the application behind a WAF rule blocking ../, null bytes, and absolute paths in the 'page' parameter, and harden PHP by setting allow_url_include=Off and allow_url_fopen=Off in php.ini to prevent escalation from LFI to RCE - the side effect being that any legitimate remote file fetches in other application code will break. If the application is not actively needed, removing it from public exposure is the safest action. Track upstream activity at https://vuldb.com/vuln/367963 and the exploit details at https://github.com/Mikkoseven/cve/issues/4.