Vulnerability · Published Mar 22, 2026 · Assigned by VulDB

CVE-2026-4532code-projects Simple Food Ordering System Database Backup food.sql file access

Medium 5.3

In plain English

A medium-severity security flaw in Simple Food Ordering System from code-projects. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 40% of all known vulnerabilities).

Severity (CVSS 3.1)5.3Medium

Exploit odds (30 days)0.5%top 59.8% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

A security vulnerability has been detected in code-projects Simple Food Ordering System up to 1.0. Affected by this vulnerability is an unknown functionality of the file /food/sql/food.sql of the component Database Backup Handler. The manipulation leads to files or directories accessible. It is possible to initiate the attack remotely. The exploit has been disclosed publicly and may be used. It is recommended to change the configuration settings.

Affected products (as reported)

Vendor	Product	Versions
code-projects	Simple Food Ordering System	1.0

Weakness: CWE-552, CWE-425 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N/E:P/RL:W/RC:R

References

VDB-352320 | code-projects Simple Food Ordering System Database Backup food.sql file access vdb-entry
VDB-352320 | CTI Indicators (IOB, IOC, TTP, IOA) signature, permissions-required
Submit #774338 | Code-Projects Simple Food Ordering System in PHP 1.0 Information Disclosure third-party-advisory
https://github.com/ahmadmarz10-hub/CVEsMarz/blob/main/Simple%20Food%20Ordering%20System%20Information%20Disclosure%20%20.md exploit
https://code-projects.org/ product