CVE-2026-4900

MediumCVSS 5.3/10Last modified Jun 17, 2026

Description

A weakness has been identified in code-projects Online Food Ordering System 1.0. This affects an unknown part of the file /dbfood/localhost.sql. This manipulation causes files or directories accessible. The attack can be initiated remotely. The exploit has been made available to the public and could be used for attacks. It is advisable to modify the configuration settings.

Metrics

CVSS 3.1 5.3/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Weakness enumeration

CWE-425 CWE-552

Affected software

Vendor	Product	Versions
code-projects	Online Food Ordering System	1.0

References

Timeline

Published: Mar 26, 2026
Last modified: Jun 17, 2026
NVD status: Deferred

Related CVEs from 2026

CVE-2026-490007.0An insecure password scheme refers to vulnerabilities arising from improper selection of encryption algorithms, inadequate key management, o CVE-2026-490015.3Cross-site request forgery (CSRF) vulnerabilities allow attackers to exploit a user's authenticated session to forge cross-site requests, in CVE-2026-490029.1Access control failure means that an application does not effectively check user access permissions, so that unauthorized users can access s CVE-2026-490039.6Attackers can exploit command injection vulnerabilities to delete core system runtime files, causing the monitoring module to crash and beco CVE-2026-490046.5The built-in PostgreSQL service on the mobile device suffers from misconfiguration flaws and command injection vulnerabilities. This service CVE-2026-490052.4The root password hash of the device can be obtained through unencrypted information in the firmware.CVE-2026-490065.3By accessing unencrypted information in the device firmware, an attacker can obtain credentials related to TLS transmission.CVE-2026-490077.5By accessing unencrypted information in the device firmware, an attacker can obtain the initial login credentials for the device's web inter CVE-2026-490086.5By accessing unencrypted information in the device firmware, an attacker can obtain credentials related to the integrity verification of a s CVE-2026-490093.1Northern.tech Mender Server v4.1.0, v4.0.1 and below, and fixed in v4.1.1 and v4.0.2 allows Directory Traversal.CVE-2026-49016.5AlanWeb SCADA saves sensitive information into a log file. Critically, user credentials are logged allowing the attacker to obtain further a CVE-2026-490147.8In GDAL 3.1.0 through 3.13.0, scanForGeometryContainers in the netCDF driver allows code execution via a stack-based buffer overflow. It rea