Online Cake Ordering System EUVD-2026-109586

Exploitation requires a low-privilege authenticated session (CVSS PR:L) on the Online Cake Ordering System 1.0 web application; the attacker then manipulates the ID argument sent to /deletetransac.php, which is passed into a SQL query without proper sanitization (CWE-89). The exact injection string and query context are not described in the available sources. Limiting factors: valid authentication is needed (not fully unauthenticated), the product is a rare niche application with minimal real-world deployment, and no fixed version is identified in the supplied data. No user interaction is required (UI:N).

The signals point to a low-to-moderate, non-urgent issue rather than a top priority. The supplied CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L) yields a base score of 5.3 (Medium): remotely reachable with low complexity, but requiring low-privilege authentication (PR:L) and producing only partial confidentiality, integrity and availability impact on the vulnerable system (no scope change). The vuln.today Decision label is 'this_month', consistent with a Medium severity and no sign of mass exploitation. It is NOT in CISA KEV (no KEV data supplied), so there is no confirmed active exploitation. A public PoC reference exists (a GitHub issue) but it is not verified as working exploit code, so POC availability must not be treated as active exploitation. No EPSS score was provided, so real-world exploitation probability cannot be quantified from this data. The affected software - itsourcecode Online Cake Ordering System - is an obscure hobby/educational PHP project with negligible production footprint, which further lowers real-world risk. Net: a genuine SQL injection worth patching on a normal cycle, but not an emergency, and the PR:L requirement plus tiny deployment base limit widespread impact.

A remote attacker holding a low-privilege account on an Online Cake Ordering System 1.0 instance manipulates the ID argument passed to /deletetransac.php, injecting SQL to read or tamper with database contents. A public PoC reference exists but is not verified as working exploit code, so operational reliability is unconfirmed. The CVSS vector (AV:N/AC:L/PR:L/UI:N) indicates the attack is network-based, low-complexity, and needs authentication but no user interaction.