CVE-2026-78248

HighCVSS 7.3/10Last modified Oct 12, 2026

Description

A vulnerability was determined in SourceCodester Simple Online Food Ordering System 1.0. Impacted is an unknown function of the file /fos/admin/ajax.php?action=save_settings. This manipulation of the argument Name causes sql injection. The attack is possible to be carried out remotely. The exploit has been publicly disclosed and may be utilized.

Metrics

CVSS 3.1 7.3/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

Weakness enumeration

CWE-74CWE-89

Affected software

No affected versions have been published.

Timeline

Published
Aug 24, 2026
Last modified
Oct 12, 2026
NVD status
Deferred

Related CVEs from 2026

CVE-2026-782496.8A path traversal vulnerability exists in the web management interface of multiple Multifunction Devices and Printers, including Apeos C4571 CVE-2026-782504.3A vulnerability was identified in bytebot-ai bytebot 0.0.1. The affected element is an unknown function of the component Agent Execution WorCVE-2026-782519.3DJI drones contain an FTP service that uses hardcoded credentials shared across affected models and permits authenticated users to upload fiCVE-2026-782526.1GitLab has remediated an issue in GitLab CE/EE affecting all versions from 15.3 before 19.1.8, 19.2 before 19.2.6, and 19.3 before 19.3.2 thCVE-2026-782532.3Uncontrolled recursion in QXmlStreamReader::readElementText() in Qt Group Qt allows attackers to cause a denial of service (application crasCVE-2026-782547.4The ftp and scp tasks of Apache Ant can download files from a remote server. A malicious server can provide relative paths that allow it to CVE-2026-782558.7The HTTP media server running on DJI drones serves stored photos and videos through the `/v2` endpoint without authenticating the requestingCVE-2026-782578.8Contributor PHP Object Injection in Booking and Rental Manager <= 2.7.5 versions.CVE-2026-782585.3Unauthenticated Broken Access Control in Booking and Rental Manager <= 2.7.5 versions.CVE-2026-782597.3Unauthenticated Broken Authentication in WPLegalPages <= 3.7.0 versions.CVE-2026-78269.1A heap-based out-of-bounds read in the BufferSerializerIOv2_ReadBuffer function (src/serializers/serializer_io.c) in FalkorDB before 4.18.4 CVE-2026-782609.3Unauthenticated SQL Injection in Epayco <= 8.4.6 versions.