Online Cake Ordering System CVE-2026-114384

Exploitation requires (1) network reachability to the application's web interface and (2) a valid low-privilege authenticated session, since the CVSS vector specifies PR:L - anonymous exploitation is NOT indicated. The specific attack surface is the 'del' argument of the /transactionsave.php endpoint, which must be reachable and process attacker-supplied input in a SQL query. No special user interaction (UI:N) or non-default configuration is called out in the description; the primary limiting factors are the authentication requirement and the niche, minimal-footprint nature of the affected product (itsourcecode Online Cake Ordering System 1.0).

This is a low-priority issue despite being a publicly disclosed vulnerability. The supplied CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N) with VC:L/VI:L/VA:L yields a base severity of only 2.1, and PR:L confirms an attacker must already hold low-privilege authenticated access to the application before exploiting the del parameter in /transactionsave.php. The E:P temporal metric and the description ('exploit has been disclosed publicly') indicate proof-of-concept code exists, but there is NO CISA KEV listing and NO EPSS score provided in the input, so there is no evidence of actual in-the-wild exploitation - only public POC availability. Signals are internally consistent: a self-contained SQL injection with limited (L) confidentiality, integrity, and availability impact and no scope change. The main caveat is source reliability - all intelligence originates from a single VulDB submission (cna@vuldb.com) plus a GitHub issue; there is no independent vendor advisory. Note also that SQL injection can in principle yield full database compromise (higher than the rated VC:L/VI:L/VA:L), so the limited-impact rating may be conservative - treat the real database exposure as potentially greater than the score suggests.

An attacker who already holds a low-privilege authenticated account on an Online Cake Ordering System 1.0 deployment submits a crafted value for the 'del' parameter to /transactionsave.php, injecting SQL that the application concatenates into a backend query. This allows reading or tampering with database records (e.g., orders, user data). Public proof-of-concept exploit code exists, lowering the skill barrier, though exploitation requires network reachability to the application and valid credentials.