CVE-2026-5017

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

A security flaw has been discovered in code-projects Simple Food Order System 1.0. This impacts an unknown function of the file /all-tickets.php of the component Parameter Handler. Performing a manipulation of the argument Status results in sql injection. The attack can be initiated remotely. The exploit has been released to the public and may be used for attacks.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-74CWE-89

Affected software

No affected versions have been published.

Timeline

Published
Mar 28, 2026
Last modified
Jun 17, 2026
NVD status
Analyzed

Related CVEs from 2026

CVE-2026-501707.5Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior toCVE-2026-501716.1Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior toCVE-2026-501737.2Flow-Like is a platform for building end-to-end use cases. Prior to version 1.0.4, `GET /api/v1/apps/{app_id}/invoke/presign` grants Azure BCVE-2026-501767.5The WebSocket Application Programming Interface lacks restrictions on the number of authentication requests. This absence of rate limiting mCVE-2026-501788.8The Angular Language Service VS Code Extension provides a rich editing experience for Angular templates. the client-side Angular Language SeCVE-2026-501794.2Actual is a local-first personal finance tool. Prior to 26.6.0, exportToCSV and exportQueryToCSV in packages/loot-core/src/server/transactioCVE-2026-50189.8A weakness has been identified in code-projects Simple Food Order System 1.0. Affected is an unknown function of the file register-router.phCVE-2026-501808.7Langroid is a framework for building large-language-model-powered applications. Prior to version 0.64.0, `SQLChatAgent` in `langroid` ships CVE-2026-501817.1Langroid is a framework for building large-language-model-powered applications. Prior to version 0.64.0, Langroid's `ReadFileTool` and `WritCVE-2026-501826.1WWBN AVideo is an open source video platform. Versions prior to 29.0 contain an unauthenticated Reflected XSS vulnerability through AVideo YCVE-2026-501834.7WWBN AVideo is an open source video platform. Versions 29.0 and below contain a stored Cross-Site Scripting vulnerability in the YouTubeAPI CVE-2026-501846.1Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to