The 2026-113741 vulnerability arises from improper handling of the 'useruid' argument in the /404.php script of itsourcecode's Online Cake Ordering System. An attacker can inject arbitrary HTML or JavaScript into the response, enabling execution of malicious script within the victim’s browser. This permits a range of client‑side attacks such as cookie theft, session hijacking, defacement, or phishing—catastrophic for confidentiality, integrity, or availability of user data.

Affected configurations are the baseline 1.0 release of itsourcecode Online Cake Ordering System. The flaw resides in the public 404 error handling page, a component frequently exposed to all external users. No other versions are mentioned as affected in the available CNA data.

The flaw carries a CVSS score of 5.3, indicating moderate severity, and a very low EPSS (<1%), with no record in CISA KEV. Despite the modest exploitation likelihood, the remote nature and public disclosure mean any internet‑exposed installation is vulnerable. Attackers need only craft a malicious 'useruid' value, making the risk tangible for sites that have not applied a vendor‑issued fix or mitigated input validation.