Which versions of Simple Food Ordering System are affected by CVE-2026-4532?

Organizations using code-projects Simple Food Ordering System should be aware of moderate risk from CVE-2026-4532, a file access vulnerability rated CVSS 5.3.

Is there a public PoC exploit available for CVE-2026-4532?

Yes, a public proof-of-concept exploit is available for CVE-2026-4532. Prioritise patching immediately. EPSS: 0.0%.

How to fix or mitigate CVE-2026-4532?

Within 30 days: Identify affected systems running code-projects Simple Food Ordering System and apply vendor patches as part of regular patch cycle. Monitor vendor channels for patch availability.

Simple Food Ordering System CVE-2026-4532

Q: What is the CVSS score of CVE-2026-4532?

CVE-2026-4532 has a CVSS 4.0 base score of 5.5 (Medium). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2026-14266 MEDIUM

Files or Directories Accessible to External Parties (CWE-552)

2026-03-22 VulDB

GHSA-mcqg-vw6x-qfjx

Information Disclosure Path Traversal Simple Food Ordering System Code Projects

5.5

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

5.5 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

PoC Detected

Apr 10, 2026 - 01:16 vuln.today

Public exploit code

EUVD ID Assigned

Mar 22, 2026 - 01:45 euvd

EUVD-2026-14266

Analysis Generated

Mar 22, 2026 - 01:45 vuln.today

CVE Published

Mar 22, 2026 - 01:32 nvd

MEDIUM 5.5

DescriptionCVE.org

A security vulnerability has been detected in code-projects Simple Food Ordering System up to 1.0. Affected by this vulnerability is an unknown functionality of the file /food/sql/food.sql of the component Database Backup Handler. The manipulation leads to files or directories accessible. It is possible to initiate the attack remotely. The exploit has been disclosed publicly and may be used. It is recommended to change the configuration settings.

AnalysisAI

The Simple Food Ordering System through version 1.0 allows unauthenticated remote attackers to access sensitive database files through improper access controls in the Database Backup Handler component. Public exploit code exists for this vulnerability, which could enable attackers to retrieve database backups containing sensitive information. Configuration changes are recommended as no patch is currently available.

Technical ContextAI

The vulnerability is rooted in CWE-552 (Files or Directories Accessible to External Parties), a common weakness where backup or configuration files are improperly secured and accessible via web-facing paths. The affected product, code-projects Simple Food Ordering System (CPE: cpe:2.3:a:code-projects:simple_food_ordering_system), stores database backup files at a predictable, unauthenticated path (/food/sql/food.sql) without proper access controls. This allows directory traversal or direct file enumeration attacks. The Database Backup Handler component fails to enforce authentication or authorization checks on backup file access, treating database exports as publicly accessible resources. The underlying issue is misconfiguration of web server routing and file permissions, likely exacerbated by the deployment of sensitive database SQL files within the web root.

RemediationAI

The primary remediation is to upgrade code-projects Simple Food Ordering System to a patched version released after version 1.0 once available. As an immediate interim measure, restrict direct web access to the /food/sql/ directory by implementing web server access controls (e.g., deny rules in .htaccess for Apache or location blocks in nginx.conf), removing the database backup file from the web-accessible directory, and moving database backups to a location outside the web root with restricted filesystem permissions. Implement authentication and authorization checks on any remaining database export functionality. Additionally, review and audit all other database backup files and sensitive configuration files to ensure they are not stored in web-accessible locations. Monitor access logs for suspicious requests to /food/sql/ paths. Detailed remediation guidance is available via the VulDB report at https://vuldb.com/?ctiid.352320.