CVE-2026-5018

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

A weakness has been identified in code-projects Simple Food Order System 1.0. Affected is an unknown function of the file register-router.php of the component Parameter Handler. Executing a manipulation of the argument Name can lead to sql injection. The attack can be launched remotely. The exploit has been made available to the public and could be used for attacks.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-74 CWE-89

Affected software

Vendor	Product	Versions
code-projects	Simple Food Order System	1.0

References

https://code-projects.org/Product
https://github.com/6Justdododo6/CVE/issues/16Exploit, Issue Tracking, Mitigation, Third Party Advisory
https://vuldb.com/submit/779336Third Party Advisory, VDB Entry
https://vuldb.com/vuln/353903Third Party Advisory, VDB Entry
https://vuldb.com/vuln/353903/ctiPermissions Required, VDB Entry

Timeline

Published: Mar 28, 2026
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2026

CVE-2026-501808.7Langroid is a framework for building large-language-model-powered applications. Prior to version 0.64.0, `SQLChatAgent` in `langroid` ships CVE-2026-501817.1Langroid is a framework for building large-language-model-powered applications. Prior to version 0.64.0, Langroid's `ReadFileTool` and `Writ CVE-2026-501826.1WWBN AVideo is an open source video platform. Versions prior to 29.0 contain an unauthenticated Reflected XSS vulnerability through AVideo Y CVE-2026-501834.7WWBN AVideo is an open source video platform. Versions 29.0 and below contain a stored Cross-Site Scripting vulnerability in the YouTubeAPI CVE-2026-501846.1Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to CVE-2026-501853.3RustCrypto CMOV provides conditional move CPU intrinsics which are guaranteed on major platforms to execute in constant-time and not be rewr CVE-2026-501868.84gaBoards is a boards system for realtime project management. Prior to 3.3.8, 4gaBoards allows an authenticated project manager to supply tr CVE-2026-501878.8Oh My Zsh is a community-driven framework for managing Zsh configuration. Prior to 2026-05-28, the dotenv plugin in plugins/dotenv/dotenv.pl CVE-2026-501886.9Kirby is an open-source content management system. Prior to 4.9.4 and 5.4.4, Kirby sites and plugins using the Kirby Http Remote class, incl CVE-2026-501897.2Appsmith is a platform to build admin panels, internal tools, and dashboards. Prior to 2.1, Appsmith's bundled supervisord exposes an XML-RP CVE-2026-50199.8A security vulnerability has been detected in code-projects Simple Food Order System 1.0. Affected by this vulnerability is an unknown funct CVE-2026-501908.6Shaarli is a personal bookmarking service. Versions prior to 0.16.3 are vulnerable to stored XSS in `application/front/controller/visitor/Bo