CVE-2026-0585

CriticalCVSS 9.8/10Last modified Oct 26, 2026

Description

A security vulnerability has been detected in code-projects Online Product Reservation System 1.0. Impacted is an unknown function of the file /order_view.php of the component GET Parameter Handler. Such manipulation of the argument transaction_id leads to sql injection. The attack can be executed remotely. The exploit has been disclosed publicly and may be used.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-74 CWE-89

Affected software

Vendor	Product	Versions
code-projects	Online Product Reservation System	1.0

References

https://code-projects.org/Product
https://github.com/foeCat/CVE/blob/main/OnlineProductReservation_PHP/sqli_order_view.php.mdExploit, Third Party Advisory
https://github.com/foeCat/CVE/blob/main/OnlineProductReservation_PHP/sqli_order_view.php.md#pocExploit, Third Party Advisory
https://vuldb.com/?ctiid.339477Permissions Required, VDB Entry
https://vuldb.com/?id.339477Third Party Advisory, VDB Entry
https://vuldb.com/?submit.731096Third Party Advisory, VDB Entry

Timeline

Published: Jan 5, 2026
Last modified: Oct 26, 2026
NVD status: Analyzed

Related CVEs from 2026

CVE-2026-05866.1A vulnerability was detected in code-projects Online Product Reservation System 1.0. The affected element is an unknown function of the file CVE-2026-05875.4A security flaw has been discovered in Xinhu Rainrock RockOA up to 2.7.1. Affected is an unknown function of the file rock_page_gong.php of CVE-2026-05886.1A weakness has been identified in Xinhu Rainrock RockOA up to 2.7.1. Affected by this vulnerability is an unknown functionality of the file CVE-2026-05897.3A vulnerability was found in code-projects Online Product Reservation System 1.0. Impacted is an unknown function of the component Administr CVE-2026-05909.8A vulnerability was determined in code-projects Online Product Reservation System 1.0. The affected element is an unknown function of the fi CVE-2026-05919.8A vulnerability was identified in code-projects Online Product Reservation System 1.0. The impacted element is an unknown function of the fi CVE-2026-05929.8A security flaw has been discovered in code-projects Online Product Reservation System 1.0. This affects an unknown function of the file /ha CVE-2026-05935.3The WP Go Maps (formerly WP Google Maps) plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability CVE-2026-05946.1The List Site Contributors plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'alpha' parameter in versions up to,CVE-2026-05955.4GitLab has remediated an issue in GitLab CE/EE affecting all versions from 13.9 before 18.6.6, 18.7 before 18.7.4, and 18.8 before 18.8.4 th CVE-2026-05967.8A command injection vulnerability exists in mlflow/mlflow when serving a model with `enable_mlserver=True`. The `model_uri` is embedded dire CVE-2026-05979.8A flaw has been found in Campcodes Supplier Management System 1.0. Affected by this issue is some unknown functionality of the file /retaile