CVE-2026-114378

MediumCVSS 6.3/10Last modified Oct 23, 2026

Description

A vulnerability was detected in itsourcecode Online Cake Ordering System 1.0. This affects an unknown part of the file /deleteproduct.php. The manipulation of the argument ID results in sql injection. The attack may be launched remotely. The exploit is now public and may be used.

Metrics

CVSS 3.1 6.3/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

Weakness enumeration

CWE-74 CWE-89

Affected software

No affected versions have been published.

Timeline

Published: Oct 21, 2026
Last modified: Oct 23, 2026
NVD status: Deferred

Related CVEs from 2026

CVE-2026-1143795.4A flaw has been found in EKKOLearnAI ekko-studio up to 1.0.6. This vulnerability affects the function saveGeneratedImages of the file packag CVE-2026-114386.3A vulnerability has been found in theonedev onedev up to 15.0.5. Affected by this vulnerability is an unknown functionality of the file /pro CVE-2026-1143806.3A vulnerability was found in itsourcecode Online Cake Ordering System 1.0. Impacted is an unknown function of the file /inserttrans.php. Per CVE-2026-1143816.3A vulnerability was determined in itsourcecode Online Cake Ordering System 1.0. The affected element is an unknown function of the file /ord CVE-2026-11438210.0A security flaw has been discovered in TOTOLINK EX200 5.2.3c.7200. This affects the function setStaticDhcpConfig of the file /cgi-bin/cstecg CVE-2026-11438310.0A weakness has been identified in TOTOLINK EX200 5.2.3c.7200. This impacts the function setWiFiAclAddConfig of the file /cgi-bin/cstecgi.cgi CVE-2026-1143846.3A security vulnerability has been detected in itsourcecode Online Cake Ordering System 1.0. Affected is an unknown function of the file /tra CVE-2026-1143864.8Pydantic AI Harness before 0.59.0 fails to enforce UsageLimits.tool_calls_limit on nested tool calls dispatched from run_code in the CodeMod CVE-2026-1143878.8Shopper from 2.0.0 before 2.6.0 contains a missing authorization vulnerability that allows admin-panel users holding only access_dashboard t CVE-2026-1143885.3Chamilo LMS 2.0.0 pre-releases from 2.0.0-alpha.1 before 2.0.0-RC.3 contain a missing access control vulnerability in GradebookController th CVE-2026-1143894.3Chamilo LMS from 2.0.0-alpha.4 before 2.0.0-RC.3 contains a missing authorization vulnerability in AiController::openAnswerGrade that allows CVE-2026-114396.3A vulnerability was found in theonedev onedev up to 15.0.5. Affected by this issue is some unknown functionality of the file /projects/ of t