CVE-2026-5811

MediumCVSS 5.4/10Last modified Jul 24, 2026

Description

A vulnerability was identified in SourceCodester Online Food Ordering System 1.0. Affected by this issue is the function save_product of the file /Actions.php of the component POST Parameter Handler. Such manipulation of the argument price leads to business logic errors. The attack may be performed from remote. The exploit is publicly available and might be used.

Metrics

CVSS 3.1 5.4/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L

Weakness enumeration

CWE-840

Affected software

No affected versions have been published.

Timeline

Published: Apr 8, 2026
Last modified: Jul 24, 2026
NVD status: Deferred

Related CVEs from 2026

CVE-2026-581136.1A vulnerability has been identified in Teamcenter V2412 (All versions < V2412.0013), Teamcenter V2506 (All versions < V2506.0010), Teamcente CVE-2026-5811510.0A vulnerability has been identified in SIMATIC IoT2050 Advanced (6ES7647-0BA00-1YA2) (All versions < V4.3.4.1 running Industrial OS with Nod CVE-2026-581168.8LLaMA-Factory through 0.9.5 contains a remote code execution vulnerability that allows attackers with WebUI access to execute arbitrary Pyth CVE-2026-58125.4A security flaw has been discovered in SourceCodester Pharmacy Product Management System 1.0. This affects an unknown part of the file add-s CVE-2026-581229.1Hermes WebUI before 0.51.307 contains an authentication bypass vulnerability that allows unauthenticated remote attackers to circumvent loca CVE-2026-581239.8Hermes WebUI before 0.51.788 contains an unauthenticated remote code execution vulnerability that allows remote attackers to execute arbitra CVE-2026-581269.8PACSgear PACS Scan 5.2.1 contains an unauthenticated remote code execution vulnerability that allows remote attackers to read and write arbi CVE-2026-581279.8PACSgear MediaWriter 5.2.1 exposes a .NET Remoting TCP service on port 9000 via PacsgearMediaServerEngine.dll, registered with ObjectURIs Re CVE-2026-58137.3A weakness has been identified in PHPGurukul Online Course Registration 3.1. This vulnerability affects unknown code of the file /check_avai CVE-2026-581389.8Orkes Conductor 3.21.21 before 3.30.2 contains an unauthenticated remote code execution vulnerability that allows remote attackers to execut CVE-2026-581396.5The DuckDB AWS extension for DuckDB contains a security policy bypass vulnerability that allows any database user with SQL execution permiss CVE-2026-58147.3A security vulnerability has been detected in PHPGurukul Online Course Registration 3.1. This issue affects some unknown processing of the f