What is the CVSS score of CVE-2026-30527?

CVE-2026-30527 has a CVSS 3.1 base score of 5.4 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N. EPSS exploitation probability: 0.0%.

Is there a public PoC exploit available for CVE-2026-30527?

Yes, a public proof-of-concept exploit is available for CVE-2026-30527. Prioritise patching immediately. EPSS: 0.0%.

Online Food Ordering System CVE-2026-30527

EUVD-2026-16672 MEDIUM

Cross-site Scripting (XSS) (CWE-79)

2026-03-27 cve@mitre.org

XSS Online Food Ordering System Oretnom23

5.4

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

5.4 MEDIUM

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

Required

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

PoC Detected

Apr 06, 2026 - 14:16 vuln.today

Public exploit code

EUVD ID Assigned

Mar 27, 2026 - 16:22 euvd

EUVD-2026-16672

Analysis Generated

Mar 27, 2026 - 16:22 vuln.today

CVE Published

Mar 27, 2026 - 16:16 nvd

MEDIUM 5.4

DescriptionCVE.org

A Stored Cross-Site Scripting (XSS) vulnerability exists in SourceCodester Online Food Ordering System v1.0 in the Category management module within the admin panel. The application fails to properly sanitize user input supplied to the "Category Name" field when creating or updating a category. When an administrator or user visits the Category list page (or any page where this category is rendered), the injected JavaScript executes immediately in their browser.

AnalysisAI

Stored XSS in SourceCodester Online Food Ordering System v1.0 allows authenticated administrators to inject malicious JavaScript via the Category Name field in the admin panel, with payloads executing in the browsers of any user viewing the Category list. Publicly available exploit code exists; the vulnerability stems from insufficient input sanitization on a critical administrative function that affects all downstream users who access affected categories.

Technical ContextAI

The vulnerability is a Stored Cross-Site Scripting (XSS) flaw classified under CWE-79 (Improper Neutralization of Input During Web Page Generation). The Online Food Ordering System fails to sanitize or encode user-supplied input in the Category Name field during creation and update operations within the admin panel. Unlike reflected XSS, the injected payload is persisted in the application's data store and executes whenever any authenticated user views the affected category in the system, making it a high-impact attack vector. The root cause is the absence of input validation, output encoding, or content security policy enforcement at both the input (server-side sanitization) and output (HTML entity encoding) boundaries.

RemediationAI

Immediate remediation requires upgrading SourceCodester Online Food Ordering System to a patched version released by the vendor; however, no specific patched version number was provided in the available intelligence. Until a patched version is confirmed available and deployed, implement server-side input validation and output encoding: sanitize all user input to the Category Name field using a whitelist approach (e.g., alphanumeric characters and safe punctuation only), and apply HTML entity encoding when rendering category names in any output context. Additionally, deploy a Content Security Policy (CSP) header to restrict inline script execution, and conduct a comprehensive audit of other admin-panel input fields for similar XSS vulnerabilities. Reference the public exploit at https://github.com/meifukun/Web-Security-PoCs/blob/main/Online-Food-Ordering-System/Stored-XSS-Category-Name.md for technical details on the injection point and payload patterns to inform your testing and remediation validation.