CVE-2026-1159

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

A weakness has been identified in itsourcecode Online Frozen Foods Ordering System 1.0. This issue affects some unknown processing of the file /order_online.php. Executing a manipulation of the argument product_name can lead to sql injection. The attack can be launched remotely. The exploit has been made available to the public and could be used for attacks.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-74 CWE-89

Affected software

No affected versions have been published.

Timeline

Published: Jan 19, 2026
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2026

CVE-2026-115908.6The WP Support Plus Responsive Ticket System WordPress plugin through 9.1.2 does not sanitize user-supplied array keys before using them in CVE-2026-115914.4The Widgets for Google Reviews plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, a CVE-2026-115924.3The Email Subscribers & Newsletters – Email Marketing, Post Notifications & Newsletter Plugin for WordPress plugin for WordPress is vulnerab CVE-2026-1159296.8MongoDB Compass relies on Electron, a third-party runtime that carries its own TLS root certificate store. This root certificate store has t CVE-2026-1159319.9Postiz lets a signed-in user ask the backend to run a function on one of their connected channels. The backend did not restrict which functi CVE-2026-1159329.6When a post is published, Postiz treats a media path that is not a web address as a file on the server's disk, but it does not check that th CVE-2026-1159339.9Postiz signs its session, invitation and password reset tokens with one shared secret and without any marker of what a token is for. A route CVE-2026-1159358.8The app/process-api-response-headers action accepts fake Craft API response headers from any authenticated control panel user. A non-admi CVE-2026-1159377.5The Mollie webhook endpoint accepts two independent, attacker-controlled parameters and never verifies that they belong together: * comm CVE-2026-1159388.8Craft CMS allows any authenticated control panel user to submit an element-search condition whose element selector is evaluated as a sandbox CVE-2026-115946.1IBM WebSphere Application Server 9.0, and 8.5 is affected by a cross-site scripting vulnerability in the administrative console.CVE-2026-115957.5IBM WebSphere Application Server 9.0, and 8.5 could allow a remote attacker to obtain sensitive information from the administrative console'