EUVD-2026-16456Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization Output encoding, context-aware escaping
MITRE ATT&CK
2 techniques across 2 tactics: Initial Access, Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Impact | Despite the low CVSS score of 2.4, the vulnerability presents limited real-world risk when analyzed against exploitation probability and operational constraints. The CVSS vector (CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:N/I:L/A:N/E:P/RL:X/RC:R) reveals critical mitigating factors: PR:H indicates high privilege requirements (administrator-level access), AC:L indicates low attack complexity once privileged, but crucially UI:R requires user interaction (a victim must view the malicious payload). The E:P indicator confirms public exploit code exists, elevating exploitability slightly, but the combination of administrative privilege prerequisite and user interaction requirement substantially reduces EPSS-equivalent risk. This is a low-priority vulnerability primarily relevant to insider threat scenarios or post-compromise lateral movement by low-privilege attackers who obtain administrative credentials-it does not represent a direct public-facing attack vector for unauthenticated users. |
| Exploit ScenarioDerived | An administrator with legitimate access to the Online Food Ordering System could inject a malicious JavaScript payload (e.g., a keylogger or session-stealing script) into the cuisines parameter via the /dbfood/food.php endpoint. When another user or administrator views the food menu or cuisines page, the stored XSS payload executes in their browser context, potentially capturing session tokens, redirecting them to a phishing site, or performing unauthorized actions on their behalf. Publicly available exploit documentation on GitHub provides step-by-step instructions for crafting and injecting such payloads, lowering the technical barrier for attackers who obtain or misuse administrative credentials. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Mar 26, 2026
The code-projects Online Food Ordering System versions up to 1.0 contain a stored cross-site scripting (XSS) vulnerability in the /dbfood/food.php file via the cuisines parameter, allowing authenticated attackers with high privileges to inject malicious scripts that execute in users' browsers. The vulnerability carries a CVSS score of 2.4 (low severity) but has publicly available exploit code and confirmed documentation on GitHub, limiting its practical impact due to high privilege requirements and user interaction dependency. Remote exploitation is possible, but the attack requires an authenticated user with high-level administrative privileges and victim user interaction, substantially constraining real-world exploitation likelihood.
RemediationAI
Patch availability and exact remediated versions have not been independently confirmed from the available references. Organizations deploying code-projects Online Food Ordering System should immediately contact the vendor at code-projects.org for security advisory information and available patches. As interim mitigation while awaiting vendor guidance, implement strict input validation and output encoding on the cuisines parameter using parameterized queries or prepared statements, apply context-aware HTML entity encoding before rendering user input, restrict administrative access to trusted users and IP ranges, and deploy Web Application Firewall (WAF) rules to detect and block XSS payloads in the cuisines parameter. Consider implementing Content Security Policy (CSP) headers to prevent inline script execution, and audit existing database records for injected malicious content.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The vulnerability is rooted in inadequate input sanitization of the 'cuisines' parameter in a PHP-based web application, classified as CWE-79 (Improper Neutralization of Input During Web Page Generation). The code-projects Online Food Ordering System (CPE: cpe:2.3:a:code-projects:online_food_ordering_system:*:*:*:*:*:*:*:*) fails to properly encode or validate user-supplied input before rendering it in HTML context within the food.php endpoint. This classic web application flaw allows attackers to bypass client-side and server-side validation, embedding arbitrary JavaScript code that persists in the application's data store and executes whenever the affected page is rendered in a user's browser.
Know when Online Food Ordering System gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
Lifecycle Timeline
4DescriptionCVE.org
A security flaw has been discovered in code-projects Online Food Ordering System 1.0. Affected by this issue is some unknown functionality of the file /dbfood/food.php. The manipulation of the argument cuisines results in cross site scripting. It is possible to launch the attack remotely. The exploit has been released to the public and may be used for attacks.
Executive ViewAI
Organizations using A security flaw should be aware of moderate risk from CVE-2026-4899, a cross-site scripting vulnerability rated CVSS 4.8. Attackers could inject scripts to steal sessions or perform actions as authenticated users. Proof-of-concept code is publicly available. Organizations should apply vendor updates when available and monitor for exploitation.
Apply vendor patch. If patching is delayed: implement CSP headers, enable HttpOnly cookies, deploy WAF XSS rules.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
GitHub
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Cross-Site Scripting occurs when an application accepts untrusted data and sends it to a web browser without proper validation or encoding.
More in Online Food Ordering System
View allAn arbitrary file upload vulnerability in the component /fos/admin/ajax.php of Food Ordering System v2.0 allows attacker
Remote Code Exection (RCE) vulnerability exists in Sourcecodester Online Food Ordering System 2.0 via a maliciously craf
Multiple SQL Injection vulnerabilities in tourist5 Online-food-ordering-system 1.0. Rated critical severity (CVSS 9.8),
An arbitrary file upload vulnerability in the component /admin/ajax.php?action=save_menu of Online Food Ordering System
SQL injection in SourceCodester Online Food Ordering System v1.0 allows remote attackers to execute arbitrary SQL comman
Online Food Ordering System v1.0 is vulnerable to multiple Unauthenticated SQL Injection vulnerabilities. Rated critical
Online Food Ordering System v1.0 is vulnerable to multiple Unauthenticated SQL Injection vulnerabilities. Rated critical
Online Food Ordering System v1.0 is vulnerable to multiple Unauthenticated SQL Injection vulnerabilities. Rated critical
Online Food Ordering System v1.0 is vulnerable to multiple Unauthenticated SQL Injection vulnerabilities. Rated critical
Online Food Ordering System v1.0 is vulnerable to multiple Unauthenticated SQL Injection vulnerabilities. Rated critical
Online Food Ordering System v1.0 is vulnerable to multiple Unauthenticated SQL Injection vulnerabilities. Rated critical
Online Food Ordering System v1.0 is vulnerable to multiple Unauthenticated SQL Injection vulnerabilities. Rated critical
Exploit-DB