Online Food Ordering System EUVD-2026-80835

Exploitation requires authenticated administrative access to the application's admin panel to reach /admin/update_category.php (CVSS PR:H), plus user interaction (UI:P) - an admin must view the page where the injected payload renders. It affects the Category Update component of Online Food Ordering System 1.0 specifically. Limiting factors: the high-privilege prerequisite means an attacker must already be an authenticated admin (or have hijacked such an account), the impact is confined to limited integrity in the browser context (VC:N/VA:N), and there is no confidentiality or availability effect, making this closer to admin self-XSS than a remotely weaponizable pre-auth flaw.

This is a low-severity stored/reflected cross-site scripting flaw (CWE-79) in the Category Update function (/admin/update_category.php) of SourceCodester Online Food Ordering System 1.0. The vendor CVSS 4.0 score is only 1.9, and the vector CVSS:4.0/AV:N/AC:L/PR:H/UI:P/VC:N/VI:L/VA:N reflects the reality: exploitation targets an admin-side endpoint (PR:H - high privileges required), needs user interaction (UI:P), and yields only limited integrity impact (VI:L) with no confidentiality or availability impact. A public exploit exists (VulDB, POC on GitHub gist and Google Drive), so 'publicly available exploit code exists' - but there is no CISA KEV listing and no EPSS score was provided, so there is no evidence of active or widespread exploitation. The high-privilege requirement is the dominant limiting factor: an attacker who can reach /admin/update_category.php already holds administrative access, making this closer to self-XSS or a stepping stone against a co-admin than a broadly damaging flaw. Net assessment: real but very low priority - a genuine bug with public POC, but the PR:H barrier and negligible impact make it a low real-world risk despite public disclosure.

An authenticated administrator (or an attacker who has already compromised admin credentials) submits a category update via /admin/update_category.php containing a malicious script payload in an unsanitized field. When the stored/reflected value is later rendered in the admin interface, the script executes in the browser of an admin viewing the page. A public exploit/POC is available (VulDB, GitHub gist, and Google Drive link), lowering the effort to reproduce, though the required admin privileges sharply limit realistic abuse.