Cake Ordering System CVE-2026-113741

Exploitation requires an attacker to deliver a crafted link whose useruid parameter to /404.php carries a script payload, and requires the victim to interact by opening that link (CVSS UI:P) - this victim-interaction requirement is the primary limiting factor, as the attacker cannot trigger execution unassisted. No authentication is required (PR:N), and no special server configuration is indicated; the flaw is in the default handling of the useruid argument on the 404.php error page of Online Cake Ordering System 1.0. Impact is confined to the victim's browser session (reflected, non-persistent XSS) with no server-side confidentiality or availability impact.

This is a low-priority issue despite being network-reachable. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N) and the vendor base score of 2.1 both characterize it as a low-impact reflected cross-site scripting (CWE-79) flaw requiring victim interaction, with no confidentiality or availability impact and only limited integrity impact. The exploit maturity is E:P (proof-of-concept), and the description confirms a public exploit has been disclosed, so publicly available exploit code exists - but there is NO CISA KEV listing and no EPSS score supplied in the input, so there is no evidence of active or widespread exploitation. The signals are consistent rather than conflicting: low severity, PoC-only maturity, and a reflected XSS in an obscure PHP application together indicate this is a high-noise, low-real-risk advisory typical of VulDB-sourced disclosures for small itsourcecode projects, not an urgent priority. Note the data is thin: references point only to VulDB, the vendor homepage, and a GitHub issue - no vendor patch advisory is present, so fix availability cannot be confirmed.

An attacker crafts a malicious URL targeting /404.php with a payload injected into the useruid parameter and lures a victim into clicking it (e.g., via phishing or a malicious link). When the victim's browser loads the page, the unsanitized useruid value is reflected and the injected script executes in the victim's session context. A public proof-of-concept for this reflected XSS has been disclosed.