What is the CVSS score of EUVD-2026-16676?

EUVD-2026-16676 has a CVSS 3.1 base score of 9.8 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.0%.

Which versions of PHP are affected by EUVD-2026-16676?

Organizations using SourceCodester Online Food Ordering System face critical risk from CVE-2026-30530, a SQL injection vulnerability rated CVSS 9.8.

Is there a public PoC exploit available for EUVD-2026-16676?

Yes, a public proof-of-concept exploit is available for EUVD-2026-16676. Prioritise patching immediately. EPSS: 0.0%.

How to fix or mitigate EUVD-2026-16676?

Within 24 hours: Identify all affected systems running SourceCodester Online Food Ordering System and apply vendor patches immediately. Validate that input sanitization is in place for all user-controlled parameters.

PHP EUVD-2026-16676

| CVE-2026-30530 CRITICAL

SQL Injection (CWE-89)

2026-03-27 cve@mitre.org

SQLi PHP

9.8

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

9.8 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

PoC Detected

Mar 30, 2026 - 18:18 vuln.today

Public exploit code

EUVD ID Assigned

Mar 27, 2026 - 16:22 euvd

EUVD-2026-16676

Analysis Generated

Mar 27, 2026 - 16:22 vuln.today

CVE Published

Mar 27, 2026 - 16:16 nvd

CRITICAL 9.8

DescriptionCVE.org

A SQL Injection vulnerability exists in SourceCodester Online Food Ordering System v1.0 in the Actions.php file (specifically the save_customer action). The application fails to properly sanitize user input supplied to the "username" parameter. This allows an attacker to inject malicious SQL commands.

Articles & Coverage 1

vuln.today Threat Landscape 23/03-30/03/2026: Supply Chain Attacks and Auth Failures Surge Mar 30, 2026

AnalysisAI

SQL injection in SourceCodester Online Food Ordering System v1.0 allows remote attackers to execute arbitrary SQL commands through unsanitized input in the save_customer action's username parameter. The application fails to implement proper input validation or prepared statements, enabling attackers to manipulate database queries directly. Publicly available exploit code exists, and this vulnerability affects the PHP-based web application with no confirmed patch status at time of analysis.

Technical ContextAI

The vulnerability resides in the Actions.php file of a PHP-based web application framework, specifically within the save_customer action handler. The root cause is improper input sanitization of the username parameter, which falls under CWE classification for SQL injection flaws. SQL injection vulnerabilities occur when user-supplied input is concatenated directly into SQL queries without using parameterized statements or prepared statements. In PHP applications, this typically manifests when variables are embedded in query strings via string concatenation or simple escaping mechanisms that fail to account for SQL metacharacters and context-specific encoding requirements. The affected product is SourceCodester Online Food Ordering System v1.0, a PHP application commonly used for restaurant ordering platforms.

RemediationAI

The primary remediation is to upgrade SourceCodester Online Food Ordering System to a patched version if available from the vendor; however, no specific patched version number has been confirmed in the available data. Immediate mitigations include: implement parameterized queries or prepared statements for all database operations, particularly in the save_customer action handler; apply input validation to enforce expected username format (alphanumeric, length restrictions); use ORM frameworks that abstract SQL generation; and deploy a Web Application Firewall (WAF) with SQL injection detection rules to block malicious payloads. Restrict database user privileges to the minimum required for the application's normal operations to limit damage from successful injection. For the Online Food Ordering System, contact the SourceCodester vendor directly or check their repository for available updates, and conduct a comprehensive code review of all user input handling across the application to identify similar injection vectors.