Log in Start free

Vulnerability · Published Nov 5, 2026 · Assigned by VulDB

CVE-2026-122190SourceCodester Online Food Ordering System Category Management add_category.php cross site scripting

Low 2.4

In plain English

A low-severity cross-site scripting in Online Food Ordering System from SourceCodester. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 11% of all known vulnerabilities).

Severity (CVSS 3.1)2.4Low
Exploit odds (30 days)0.2%top 88.7% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack toolingNoneno public tooling known

Official description

A vulnerability was found in SourceCodester Online Food Ordering System 1.0. The impacted element is an unknown function of the file admin/add_category.php of the component Category Management. Performing a manipulation of the argument category_title results in cross site scripting. The attack may be initiated remotely. The exploit has been made public and could be used.

Affected products (as reported)

VendorProductVersions
SourceCodester Online Food Ordering System 1.0

Weakness: CWE-79, CWE-94 · Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:N/I:L/A:N/E:P/RL:X/RC:R

References