CVE-2026-76996

HighCVSS 7.3/10Last modified Oct 18, 2026

Description

A security flaw has been discovered in SourceCodester Simple Online Food Ordering System 1.0. Impacted is an unknown function of the file /fos/admin/view_order.php. The manipulation of the argument ID results in sql injection. The attack may be performed from remote. The exploit has been released to the public and may be used for attacks.

Metrics

CVSS 3.1 7.3/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

Weakness enumeration

CWE-74 CWE-89

Affected software

No affected versions have been published.

Timeline

Published: Aug 20, 2026
Last modified: Oct 18, 2026
NVD status: Deferred

Related CVEs from 2026

CVE-2026-769976.3A weakness has been identified in SourceCodester Simple Online Food Ordering System 1.0. The affected element is an unknown function of the CVE-2026-769987.3A security vulnerability has been detected in SourceCodester Simple Online Food Ordering System 1.0. The impacted element is an unknown func CVE-2026-769996.3A vulnerability was detected in SourceCodester CET Automated Grading System with AI Predictive Analytics 1.0. This affects the function add_CVE-2026-77006.3A weakness has been identified in langflow-ai langflow up to 1.10.2. This affects the function eval of the file src/lfx/src/lfx/components/l CVE-2026-770009.8The WP Social Media Login WordPress plugin through 1.0.6 does not verify that a social login was actually completed with the identity provid CVE-2026-770019.8The Social Login & Sharing buttons with Analytics By SoClever WordPress plugin through 1.2.0 does not perform any authentication, authorisat CVE-2026-770029.8The SmilePass Selfie Login WordPress plugin through 1.0.2 does not perform any server-side verification of the identity it is asked to authe CVE-2026-770032.7The Content Mask WordPress plugin before 1.8.5.5 does not check the capability required to publish the post type being created, allowing use CVE-2026-770047.4A flaw has been found in Comfast CF-N1-S 2.6.0.1. This impacts the function sprintf of the file /cgi-bin/mbox-config?method=SET&section=ptes CVE-2026-770059.6The CODE MONKEYS PROPOSALS WordPress plugin through 1.0.1 does not validate a user-supplied file path before deleting a file, and does not CVE-2026-770069.6The WebTotem Backups WordPress plugin before 1.1.0 does not validate a user-supplied file path, does not check the capability of the user ma CVE-2026-770077.5The HEL Online Classroom: AI-powered Online Classrooms WordPress plugin through 1.0.3 does not perform any authorisation check on one of its