Vulnerability · Published Sep 16, 2026 · Assigned by VulDB

CVE-2026-92385SourceCodester Online Food Ordering System Category Update update_category.php cross site scripting

Low 2.4

In plain English

A low-severity cross-site scripting in Online Food Ordering System from SourceCodester. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 32% of all known vulnerabilities).

Severity (CVSS 3.1)2.4Low

Exploit odds (30 days)0.4%top 68.2% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

A vulnerability has been found in SourceCodester Online Food Ordering System 1.0. The affected element is an unknown function of the file /admin/update_category.php of the component Category Update. The manipulation leads to cross site scripting. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.

Affected products (as reported)

Vendor	Product	Versions
SourceCodester	Online Food Ordering System	1.0

Weakness: CWE-79, CWE-94 · Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:N/I:L/A:N/E:P/RL:X/RC:R

References

VDB-405522 | SourceCodester Online Food Ordering System Category Update update_category.php cross site scripting vdb-entry
VDB-405522 | CTI Indicators (IOB, IOC, TTP, IOA) signature, permissions-required
CVE-2026-92385 | CVE Analysis and Report third-party-advisory
Submit #939727 | SourceCodester Online Food Ordering System 1.0 Stored XSS via Unrestricted File Upload third-party-advisory
https://gist.github.com/MuhammadAmmar-Hacker/d0426a562fe0fa59efbfe7d45778ed27 related
https://drive.google.com/file/d/1nwr_EravSW9f62itP8sS6OpE3rqRDVkn/view?usp=sharing exploit
https://www.sourcecodester.com/ product