Cake Ordering System EUVD-2026-107554

Exploitation requires an authenticated session with at least low-privilege access (CVSS PR:L) to reach the product-deletion functionality at /deleteproduct.php, then manipulation of the ID parameter with SQL injection payloads. The attack is remote over the network with no user interaction. The primary limiting factors are: (1) a valid account is required - this is not unauthenticated, so it is not exploitable by anonymous internet attackers against a default login wall; and (2) the affected application is a niche PHP project unlikely to be internet-exposed in enterprise environments. No non-default configuration is otherwise needed; the vulnerable deletion endpoint appears to be standard application functionality.

This is a moderate, not high, priority. The CVSS 4.0 base score is 5.3 (Medium), driven by a network attack vector (AV:N), low complexity (AC:L), and no user interaction (UI:N), but tempered by a privilege requirement (PR:L - authentication needed) and only Low impact to confidentiality, integrity, and availability (VC:L/VI:L/VA:L), with no scope/subsequent-system effects. A public exploit exists (POC=YES) and the vector carries E:P (Proof-of-Concept exploit maturity), but there is NO CISA KEV listing and no EPSS score was provided, so there is no evidence of widespread or automated real-world exploitation. The signals are internally consistent: a disclosed PoC against an obscure, low-footprint PHP application reported by VulDB. The practical risk is bounded by two factors the raw score already reflects - exploitation requires an authenticated account, and the affected product (itsourcecode Online Cake Ordering System) is a niche tutorial-grade project with negligible production deployment. EPSS data is missing, which limits probabilistic exploitation forecasting; absence should not be read as low risk, but given the product's obscurity, targeted opportunistic use is far more likely than mass exploitation.

An authenticated low-privilege user (PR:L) sends a crafted HTTP request to /deleteproduct.php, manipulating the ID parameter to inject SQL and extract or alter database contents such as user credentials or product records. A public proof-of-concept exploit is available, lowering the skill barrier, and no user interaction is required. Because impact is rated Low across C/I/A, successful injection yields partial data disclosure or manipulation rather than full database compromise.