Which versions of PHP are affected by CVE-2026-5019?

Simple Food Order System 1.0 contains an unauthenticated SQL injection vulnerability in its order management interface that allows remote attackers to directly access, modify, or delete the entire…

Is there a public PoC exploit available for CVE-2026-5019?

Yes, a public proof-of-concept exploit is available for CVE-2026-5019. Prioritise patching immediately. EPSS: 0.0%.

How to fix or mitigate CVE-2026-5019?

Within 24 hours: Identify all systems running Simple Food Order System 1.0 and isolate affected instances from production networks if possible, or restrict network access to trusted IPs only. Within 7 days: Implement Web Application Firewall (WAF) rules to block SQL injection patterns in the Status parameter of all-orders.php, and enable database activity monitoring. Within 30 days: Evaluate migration to a patched alternative food ordering system or conduct a comprehensive code audit and remediation of the all-orders.php Status parameter input validation.

PHP CVE-2026-5019

Q: What is the CVSS score of CVE-2026-5019?

CVE-2026-5019 has a CVSS 4.0 base score of 5.5 (Medium). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2026-16959 MEDIUM

SQL Injection (CWE-89)

2026-03-28 VulDB

GHSA-2m22-876p-4x3q

PHP SQLi Simple Food Order System Code Projects

5.5

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

5.5 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

CVSS changed

Apr 29, 2026 - 01:11 NVD

6.9 (MEDIUM) 5.5 (MEDIUM)

PoC Detected

Apr 02, 2026 - 20:31 vuln.today

Public exploit code

EUVD ID Assigned

Mar 28, 2026 - 23:45 euvd

EUVD-2026-16959

Analysis Generated

Mar 28, 2026 - 23:45 vuln.today

CVE Published

Mar 28, 2026 - 23:30 nvd

MEDIUM 6.9

DescriptionCVE.org

A security vulnerability has been detected in code-projects Simple Food Order System 1.0. Affected by this vulnerability is an unknown functionality of the file all-orders.php of the component Parameter Handler. The manipulation of the argument Status leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed publicly and may be used.

AnalysisAI

SQL injection in code-projects Simple Food Order System 1.0 allows unauthenticated remote attackers to extract, modify, or delete database contents via the Status parameter in all-orders.php. The vulnerability has a publicly available exploit and requires no authentication or user interaction (CVSS 7.3, AV:N/AC:L/PR:N). No vendor-released patch identified at time of analysis, representing elevated risk for installations of this PHP-based food ordering application.

Technical ContextAI

This is a classic SQL injection vulnerability (CWE-89) in a PHP web application's parameter handling logic. The vulnerable component (all-orders.php) fails to properly sanitize or parameterize the Status argument before incorporating it into SQL queries. Code-projects Simple Food Order System is an open-source food ordering management application written in PHP, likely using MySQL or MariaDB as its backend database. SQL injection occurs when untrusted input is concatenated directly into SQL statements, allowing attackers to break out of the intended query logic and execute arbitrary SQL commands. The CPE identifier (cpe:2.3:a:code-projects:simple_food_order_system:*:*:*:*:*:*:*:*) confirms this affects the Simple Food Order System product from code-projects, with version 1.0 specifically identified as vulnerable.

RemediationAI

No vendor-released patch identified at time of analysis for Simple Food Order System 1.0. Given the absence of an official patch from code-projects and the public exploit availability, affected organizations should immediately implement defense-in-depth mitigations: (1) Apply input validation and parameterized queries to all-orders.php, specifically sanitizing the Status parameter using prepared statements or equivalent SQL injection defenses in PHP (mysqli_prepare or PDO with bound parameters); (2) Deploy web application firewall (WAF) rules to block SQL injection patterns targeting the Status parameter; (3) Restrict network access to the application to trusted IP ranges if possible; (4) Monitor database query logs for suspicious SQL syntax indicating exploitation attempts. Consider migrating to actively maintained, security-focused alternatives if code-projects does not release a patch. Reference materials available at https://vuldb.com/vuln/353904 and exploit details at https://github.com/6Justdododo6/CVE/issues/17. Organizations should subscribe to code-projects.org advisories or monitor the project repository for future security updates.