CVE-2026-90854

HighCVSS 7.3/10Last modified Sep 16, 2026

Description

A security flaw has been discovered in SourceCodester/katojkalemba Online Food Ordering System 1.0. The impacted element is an unknown function of the file /web/category-foods.php. The manipulation of the argument ID results in sql injection. It is possible to launch the attack remotely. The exploit has been released to the public and may be used for attacks.

Metrics

CVSS 3.1 7.3/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

Weakness enumeration

CWE-74CWE-89

Affected software

No affected versions have been published.

Timeline

Published
Sep 15, 2026
Last modified
Sep 16, 2026
NVD status
Deferred

Related CVEs from 2026

CVE-2026-908557.3A weakness has been identified in SourceCodester/katojkalemba Online Food Ordering System 1.0. This affects an unknown function of the file CVE-2026-908567.3A security vulnerability has been detected in SourceCodester College Notes Gallery Management System 1.0. This impacts an unknown function oCVE-2026-908576.3A vulnerability was detected in SourceCodester College Notes Gallery Management System 1.0. Affected is an unknown function of the file /dasCVE-2026-908587.3A flaw has been found in subhajitkhan online-clinic-management-system up to e9ee77a8827a1446220fa07ee693dc4d9a29a578. Affected by this vulneCVE-2026-90867.3A flaw was found in Keycloak. A remote attacker with administrative privileges, specifically those with `manage-client` permission or accessCVE-2026-908607.1The Canva Mobile App for HarmonyOS before v1.15.1 did not restrict the headers returned to an external origin running in a privileged WebVieCVE-2026-90878.1A flaw was found in Keycloak. The cross-session verification proof is keyed only by (local userId, idpAlias) and is not bound to the upstreaCVE-2026-908767.3A vulnerability has been found in SourceCodester Online Faculty Clearance System 1.0. Affected by this vulnerability is an unknown functionaCVE-2026-908777.3A vulnerability was found in SourceCodester Online Faculty Clearance System 1.0. Affected by this issue is some unknown functionality of theCVE-2026-908784.3A vulnerability was determined in vllm-project vLLM up to 0.27.1. This affects an unknown part of the file /v1/chat/completions of the compoCVE-2026-908797.3A vulnerability was identified in zyx0814 FilePress up to 3.0.1. This vulnerability affects unknown code of the file dzz/publish/search.php CVE-2026-90882.7A flaw was found in org.keycloak.services. An administrator with delegated access to read group memberships and users can bypass user profil
CVE-2026-90854: High severity, CVSS 7.3 | Vulnix