Online Food Order System CVE-2026-19916

Q: What is the CVSS score of CVE-2026-19916?

CVE-2026-19916 has a CVSS 4.0 base score of 2.0 (Low). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.2%.

LOW

Cross-site Scripting (XSS) (CWE-79)

2026-08-15 cna@vuldb.com

PHP XSS

2.0

CVSS 4.0 · Vendor: vuldb

Severity by source

Vendor (vuldb) PRIMARY

2.0 LOW

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

5.4 MEDIUM

Network-accessible XSS requiring low-privilege authentication and victim interaction; scope changes to victim browser context, yielding low C and I impact.

3.1 AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (vuldb).

CVSS VectorVendor: vuldb

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

Scope

Lifecycle Timeline

Analysis Generated

Aug 15, 2026 - 22:31 vuln.today

DescriptionCVE.org

A vulnerability was detected in code-projects Online Food Order System 1.0. The affected element is an unknown function of the file edit_food_items.php. Performing a manipulation of the argument dname results in cross site scripting. Remote exploitation of the attack is possible. The exploit is now public and may be used.

AnalysisAI

Cross-site scripting in code-projects Online Food Order System 1.0 allows authenticated remote attackers to inject malicious scripts via the dname parameter in edit_food_items.php. When a separate victim user views the manipulated food item entry, the injected script executes within their browser session. Publicly available exploit code exists per a GitHub proof-of-concept, though no active exploitation has been confirmed by CISA KEV.

Technical ContextAI

The affected product is a PHP-based web application - Online Food Order System version 1.0 - published by code-projects. The root cause is CWE-79 (Improper Neutralization of Input During Web Page Generation), meaning the dname parameter - likely representing a food item display name - is rendered in the HTML response without adequate sanitization or output encoding. This allows attacker-controlled JavaScript to be embedded in the page and executed in any victim's browser that subsequently views the affected content. No CPE string was supplied in the source intelligence. The application is tagged as a PHP project reported through VulDB (cna@vuldb.com).

Affected ProductsAI

The affected product is code-projects Online Food Order System version 1.0, specifically the PHP script edit_food_items.php where the dname argument is vulnerable to cross-site scripting. No CPE string was included in the source intelligence. The vendor website is referenced at https://code-projects.org/ and the VulDB advisory is available at https://vuldb.com/vuln/390166. No additional versions or related products are identified in the available data.

RemediationAI

No vendor-released patch has been identified at time of analysis. The primary fix is to apply proper HTML output encoding to the dname parameter in edit_food_items.php before rendering it in the page - for example, using PHP's htmlspecialchars() with ENT_QUOTES to prevent script injection. As a compensating control, access to edit_food_items.php should be restricted to trusted administrative accounts only, reducing the attacker surface area; note this limits who can edit food items, which may affect application usability. Implementing a Content Security Policy (CSP) header that disallows inline scripts can significantly reduce the impact of any successful XSS by blocking injected code from executing. Details of the public proof-of-concept are available at https://github.com/zzzxc643/CVE1/blob/main/project1/vul6.md and the VulDB advisory at https://vuldb.com/vuln/390166.