CVE-2026-5017

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

A security flaw has been discovered in code-projects Simple Food Order System 1.0. This impacts an unknown function of the file /all-tickets.php of the component Parameter Handler. Performing a manipulation of the argument Status results in sql injection. The attack can be initiated remotely. The exploit has been released to the public and may be used for attacks.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-74 CWE-89

Affected software

Vendor	Product	Versions
code-projects	Simple Food Order System	1.0

References

https://code-projects.org/Product
https://github.com/6Justdododo6/CVE/issues/15Exploit, Issue Tracking, Mitigation, Third Party Advisory
https://vuldb.com/submit/779331Third Party Advisory, VDB Entry
https://vuldb.com/vuln/353902Third Party Advisory, VDB Entry
https://vuldb.com/vuln/353902/ctiPermissions Required, VDB Entry

Timeline

Published: Mar 28, 2026
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2026

CVE-2026-501707.5Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to CVE-2026-501716.1Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to CVE-2026-501737.2Flow-Like is a platform for building end-to-end use cases. Prior to version 1.0.4, `GET /api/v1/apps/{app_id}/invoke/presign` grants Azure B CVE-2026-501758.4Untrusted pointer dereference in the FirmwareWakingVector for the Intel(R) Slim Bootloader within Ring 0: Bare Metal OS may allow an escalat CVE-2026-501767.5The WebSocket Application Programming Interface lacks restrictions on the number of authentication requests. This absence of rate limiting m CVE-2026-501774.8Deserialization of untrusted data for some Intel(R) Neural Compressor software before version 3.8 within Ring 3: User Applications may allow CVE-2026-501788.8The Angular Language Service VS Code Extension provides a rich editing experience for Angular templates. the client-side Angular Language Se CVE-2026-501794.2Actual is a local-first personal finance tool. Prior to 26.6.0, exportToCSV and exportQueryToCSV in packages/loot-core/src/server/transactio CVE-2026-50189.8A weakness has been identified in code-projects Simple Food Order System 1.0. Affected is an unknown function of the file register-router.ph CVE-2026-501808.7Langroid is a framework for building large-language-model-powered applications. Prior to version 0.64.0, `SQLChatAgent` in `langroid` ships CVE-2026-501817.1Langroid is a framework for building large-language-model-powered applications. Prior to version 0.64.0, Langroid's `ReadFileTool` and `Writ CVE-2026-501826.1WWBN AVideo is an open source video platform. Versions prior to 29.0 contain an unauthenticated Reflected XSS vulnerability through AVideo Y