Vulnerability · Published Mar 26, 2026 · Assigned by VulDB
CVE-2026-4844code-projects Online Food Ordering System Admin Login admin.php sql injection
High 7.3
In plain English
A high-severity SQL injection in Online Food Ordering System from code-projects. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 26% of all known vulnerabilities).
Severity (CVSS 3.1)7.3High
Exploit odds (30 days)0.3%top 73.7% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack toolingNoneno public tooling known
Official description
A vulnerability was detected in code-projects Online Food Ordering System 1.0. This issue affects some unknown processing of the file /admin.php of the component Admin Login Module. The manipulation of the argument Username results in sql injection. The attack may be performed from remote. The exploit is now public and may be used.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| code-projects | Online Food Ordering System | 1.0 |
Weakness: CWE-89, CWE-74 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R
References
- VDB-353149 | code-projects Online Food Ordering System Admin Login admin.php sql injection vdb-entry, technical-description
- VDB-353149 | CTI Indicators (IOB, IOC, TTP, IOA) signature, permissions-required
- Submit #776137 | code-projects Online Food Ordering System 1.0 SQL Injection third-party-advisory
- https://gist.github.com/HxH404/8e5bd42c0f968a92a23edc5e7b879955 exploit
- https://code-projects.org/ product