CVE-2026-76995

MediumCVSS 4.7/10Last modified Oct 18, 2026

Description

A vulnerability was identified in SourceCodester Simple Online Food Ordering System 1.0. This issue affects some unknown processing of the file /admin/ajax.php?action=save_menu. The manipulation of the argument img leads to unrestricted upload. The attack is possible to be carried out remotely. The exploit is publicly available and might be used.

Metrics

CVSS 3.1 4.7/10CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L

Weakness enumeration

CWE-284 CWE-434

Affected software

No affected versions have been published.

Timeline

Published: Aug 20, 2026
Last modified: Oct 18, 2026
NVD status: Deferred

Related CVEs from 2026

CVE-2026-769967.3A security flaw has been discovered in SourceCodester Simple Online Food Ordering System 1.0. Impacted is an unknown function of the file /f CVE-2026-769976.3A weakness has been identified in SourceCodester Simple Online Food Ordering System 1.0. The affected element is an unknown function of the CVE-2026-769987.3A security vulnerability has been detected in SourceCodester Simple Online Food Ordering System 1.0. The impacted element is an unknown func CVE-2026-769996.3A vulnerability was detected in SourceCodester CET Automated Grading System with AI Predictive Analytics 1.0. This affects the function add_CVE-2026-77006.3A weakness has been identified in langflow-ai langflow up to 1.10.2. This affects the function eval of the file src/lfx/src/lfx/components/l CVE-2026-770009.8The WP Social Media Login WordPress plugin through 1.0.6 does not verify that a social login was actually completed with the identity provid CVE-2026-770019.8The Social Login & Sharing buttons with Analytics By SoClever WordPress plugin through 1.2.0 does not perform any authentication, authorisat CVE-2026-770029.8The SmilePass Selfie Login WordPress plugin through 1.0.2 does not perform any server-side verification of the identity it is asked to authe CVE-2026-770032.7The Content Mask WordPress plugin before 1.8.5.5 does not check the capability required to publish the post type being created, allowing use CVE-2026-770047.4A flaw has been found in Comfast CF-N1-S 2.6.0.1. This impacts the function sprintf of the file /cgi-bin/mbox-config?method=SET&section=ptes CVE-2026-770059.6The CODE MONKEYS PROPOSALS WordPress plugin through 1.0.1 does not validate a user-supplied file path before deleting a file, and does not CVE-2026-770069.6The WebTotem Backups WordPress plugin before 1.1.0 does not validate a user-supplied file path, does not check the capability of the user ma