CVE-2026-78247

HighCVSS 7.3/10Last modified Oct 12, 2026

Description

A vulnerability was found in SourceCodester Simple Online Food Ordering System 1.0. This issue affects some unknown processing of the file /fos/admin/ajax.php?action=confirm_order. The manipulation of the argument ID results in sql injection. The attack can be executed remotely. The exploit has been made public and could be used.

Metrics

CVSS 3.1 7.3/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

Weakness enumeration

CWE-74 CWE-89

Affected software

No affected versions have been published.

Timeline

Published: Aug 24, 2026
Last modified: Oct 12, 2026
NVD status: Deferred

Related CVEs from 2026

CVE-2026-782487.3A vulnerability was determined in SourceCodester Simple Online Food Ordering System 1.0. Impacted is an unknown function of the file /fos/ad CVE-2026-782496.8A path traversal vulnerability exists in the web management interface of multiple Multifunction Devices and Printers, including Apeos C4571 CVE-2026-782504.3A vulnerability was identified in bytebot-ai bytebot 0.0.1. The affected element is an unknown function of the component Agent Execution Wor CVE-2026-782519.3DJI drones contain an FTP service that uses hardcoded credentials shared across affected models and permits authenticated users to upload fi CVE-2026-782526.1GitLab has remediated an issue in GitLab CE/EE affecting all versions from 15.3 before 19.1.8, 19.2 before 19.2.6, and 19.3 before 19.3.2 th CVE-2026-782532.3Uncontrolled recursion in QXmlStreamReader::readElementText() in Qt Group Qt allows attackers to cause a denial of service (application cras CVE-2026-782547.4The ftp and scp tasks of Apache Ant can download files from a remote server. A malicious server can provide relative paths that allow it to CVE-2026-782558.7The HTTP media server running on DJI drones serves stored photos and videos through the `/v2` endpoint without authenticating the requesting CVE-2026-782578.8Contributor PHP Object Injection in Booking and Rental Manager <= 2.7.5 versions.CVE-2026-782585.3Unauthenticated Broken Access Control in Booking and Rental Manager <= 2.7.5 versions.CVE-2026-782597.3Unauthenticated Broken Authentication in WPLegalPages <= 3.7.0 versions.CVE-2026-78269.1A heap-based out-of-bounds read in the BufferSerializerIOv2_ReadBuffer function (src/serializers/serializer_io.c) in FalkorDB before 4.18.4