CVE-2026-5811
SourceCodester Online Food Ordering System POST Parameter Actions.php save_product logic error
LOW 2.1EPSS 0.4%
A vulnerability was identified in SourceCodester Online Food Ordering System 1.0. Affected by this issue is the function save_product of the file /Actions.php of the component POST Parameter Handler. Such manipulation of the argument price leads to business logic errors. The attack may be performed from remote. The exploit is publicly available and might be used.
- Affected
- SourceCodester · Online Food Ordering System
- CVSS v4.0 VULDB
- 2.1 LOW
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X - CVSS v3.1 VULDB
- 5.4 MEDIUM
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L - CVSS v2.0 VULDB
- 5.5 MEDIUM
AV:N/AC:L/Au:S/C:N/I:P/A:P - EPSS
- 0.41% chance of exploitation in the next 30 days, 34th percentile
- Published
- 2026-04-08
- Updated
- 2026-04-09
Proof-of-concept exploits (1)
- meifukun/Web-Security-PoCs/blob/main/Online-Food-Ordering-System/BusinessLogic-Product-Ne…0★ · 2026-02-28