Description
A vulnerability was found in SourceCodester Online Food Ordering System 1.0. The impacted element is an unknown function of the file admin/add_category.php of the component Category Management. Performing a manipulation of the argument category_title results in cross site scripting. The attack may be initiated remotely. The exploit has been made public and could be used.
Published: 2026-11-05
Score: 4.8 Medium
EPSS: n/a
KEV: No
Impact: Cross‑Site Scripting that can be triggered by manipulating the category_title parameter in the admin/add_category.php file
Action: Assess Impact
AI Analysis

Impact

A reflected cross‑site scripting flaw exists in the add_category.php component of the SourceCodester Online Food Ordering System. By submitting a specially crafted value for the category_title parameter, an attacker can cause arbitrary JavaScript to execute in the browser of any user who views the impacted page. The vulnerability is triggered by remote input and can lead to credential theft, session hijacking, or phishing attacks against site visitors.

Affected Systems

All installations of SourceCodester Online Food Ordering System version 1.0 that expose the admin/add_category.php page. The flaw is located in the Category Management module and affects the anonymous or authenticated usage of that endpoint.

Risk and Exploitability

The CVSS score of 4.8 indicates moderate severity. The EPSS score is not publicly available, and the vulnerability is not currently listed in the CISA KEV catalog, but a public exploit exists. Attackers can trigger the flaw remotely via a crafted HTTP request. Successful exploitation would allow execution of malicious JavaScript in the victim’s browser, potentially compromising personal data, session cookies, and other sensitive information on the same domain.

Generated by OpenCVE AI on November 5, 2026 at 04:20 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Identify all servers that run SourceCodester Online Food Ordering System 1.0 and confirm whether admin/add_category.php is accessible from the internet or internal network.
  • Modify the add_category.php script to sanitise or escape the category_title input before rendering it—use functions such as htmlspecialchars or a dedicated templating engine to prevent reflected script execution.
  • Enforce strict authentication and role‑based access control on the admin panel so that only authorised administrators can submit category titles.

Generated by OpenCVE AI on November 5, 2026 at 04:20 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Thu, 05 Nov 2026 03:30:00 +0000

Type Values Removed Values Added
Description A vulnerability was found in SourceCodester Online Food Ordering System 1.0. The impacted element is an unknown function of the file admin/add_category.php of the component Category Management. Performing a manipulation of the argument category_title results in cross site scripting. The attack may be initiated remotely. The exploit has been made public and could be used.
Title SourceCodester Online Food Ordering System Category Management add_category.php cross site scripting
First Time appeared Sourcecodester
Sourcecodester online Food Ordering System
Weaknesses CWE-79
CWE-94
CPEs cpe:2.3:a:sourcecodester:online_food_ordering_system:*:*:*:*:*:*:*:*
Vendors & Products Sourcecodester
Sourcecodester online Food Ordering System
References
Metrics cvssV2_0

{'score': 3.3, 'vector': 'AV:N/AC:L/Au:M/C:N/I:P/A:N/E:POC/RL:ND/RC:UR'}

cvssV3_0

{'score': 2.4, 'vector': 'CVSS:3.0/AV:N/AC:L/PR:H/UI:R/S:U/C:N/I:L/A:N/E:P/RL:X/RC:R'}

cvssV3_1

{'score': 2.4, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:N/I:L/A:N/E:P/RL:X/RC:R'}

cvssV4_0

{'score': 4.8, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P'}

Subscriptions

Sourcecodester Online Food Ordering System
cve-icon MITRE

Status: PUBLISHED

Assigner: VulDB

Published:

Updated: 2026-11-05T03:15:20.803Z

Reserved: 2026-11-04T19:09:52.172Z

Link: CVE-2026-122190

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Deferred

Published: 2026-11-05T04:17:12.170

Modified: 2026-11-05T04:17:12.333

Link: CVE-2026-122190

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-11-05T04:45:14Z

Weaknesses
  • CWE-79

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

  • CWE-94

    Improper Control of Generation of Code ('Code Injection')