EUVD-2026-16456Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
Lifecycle Timeline
6DescriptionCVE.org
A security flaw has been discovered in code-projects Online Food Ordering System 1.0. Affected by this issue is some unknown functionality of the file /dbfood/food.php. The manipulation of the argument cuisines results in cross site scripting. It is possible to launch the attack remotely. The exploit has been released to the public and may be used for attacks.
AnalysisAI
The code-projects Online Food Ordering System versions up to 1.0 contain a stored cross-site scripting (XSS) vulnerability in the /dbfood/food.php file via the cuisines parameter, allowing authenticated attackers with high privileges to inject malicious scripts that execute in users' browsers. The vulnerability carries a CVSS score of 2.4 (low severity) but has publicly available exploit code and confirmed documentation on GitHub, limiting its practical impact due to high privilege requirements and user interaction dependency. Remote exploitation is possible, but the attack requires an authenticated user with high-level administrative privileges and victim user interaction, substantially constraining real-world exploitation likelihood.
Technical ContextAI
The vulnerability is rooted in inadequate input sanitization of the 'cuisines' parameter in a PHP-based web application, classified as CWE-79 (Improper Neutralization of Input During Web Page Generation). The code-projects Online Food Ordering System (CPE: cpe:2.3:a:code-projects:online_food_ordering_system:*:*:*:*:*:*:*:*) fails to properly encode or validate user-supplied input before rendering it in HTML context within the food.php endpoint. This classic web application flaw allows attackers to bypass client-side and server-side validation, embedding arbitrary JavaScript code that persists in the application's data store and executes whenever the affected page is rendered in a user's browser.
RemediationAI
Patch availability and exact remediated versions have not been independently confirmed from the available references. Organizations deploying code-projects Online Food Ordering System should immediately contact the vendor at code-projects.org for security advisory information and available patches. As interim mitigation while awaiting vendor guidance, implement strict input validation and output encoding on the cuisines parameter using parameterized queries or prepared statements, apply context-aware HTML entity encoding before rendering user input, restrict administrative access to trusted users and IP ranges, and deploy Web Application Firewall (WAF) rules to detect and block XSS payloads in the cuisines parameter. Consider implementing Content Security Policy (CSP) headers to prevent inline script execution, and audit existing database records for injected malicious content.
In PHP versions 7.1.x below 7.1.33, 7.2.x below 7.2.24 and 7.3.x below 7.3.11 in certain configurations of FPM setup it
sapi/cgi/cgi_main.c in PHP before 5.3.12 and 5.4.x before 5.4.2, when configured as a CGI script (aka php-cgi), does not
(1) boardData102.php, (2) boardData103.php, (3) boardDataJP.php, (4) boardDataNA.php, and (5) boardDataWW.php in Netgear
The '/common/download_agent_installer.php' script in the Quest KACE System Management Appliance 8.0.318 is accessible by
ProjectSend versions prior to r1720 are affected by an improper authentication vulnerability. Rated critical severity (C
Roundcube Webmail contains a critical PHP object deserialization vulnerability (CVE-2025-49113, CVSS 9.9) that allows au
Util/PHP/eval-stdin.php in PHPUnit before 4.8.28 and 5.x before 5.6.3 allows remote attackers to execute arbitrary PHP c
Palo Alto Networks PAN-OS management web interface contains an authentication bypass allowing unauthenticated attackers
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
The get_referers function in /opt/ws/bin/sblistpack in Sophos Web Appliance before 3.7.9.1 and 3.8 before 3.8.1.1 allows
The Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today