{"id":"CVE-2026-116603","title":"SourceCodester Online Food Ordering System add_food.php unrestricted upload","summary":"A flaw has been found in SourceCodester Online Food Ordering System 1.0. Impacted is an unknown function of the file admin/add_food.php. Executing a manipulation of the argument image can lead to unrestricted upload. The attack may be pe…","severity":"medium","cvss":4.7,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R","cvssSource":"cna","cwe":["CWE-434","CWE-284"],"vendor":"SourceCodester","product":"Online Food Ordering System","affected":["online_food_ordering_system 1.0"],"published":"2026-10-26","updated":"2026-10-26","sourceUpdated":"2026-10-26T23:30:13.680Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-116603","references":[{"url":"https://vuldb.com/vuln/426509","label":"VDB-426509 | SourceCodester Online Food Ordering System add_food.php unrestricted upload"},{"url":"https://vuldb.com/vuln/426509/cti","label":"VDB-426509 | CTI Indicators (IOB, IOC, TTP, IOA)"},{"url":"https://vuldb.com/cve/CVE-2026-116603","label":"CVE-2026-116603 | CVE Analysis and Report"},{"url":"https://vuldb.com/submit/1022954","label":"Submit #1022954 | SourceCodester Online Food Ordering System in PHP and MySQL Source Code 1.0 Unrestricted File Upload Leading to Remote Code Execution"},{"url":"https://github.com/CyberShailendra/SourceCodesterUnrestrictedFileUploadLeadingtoRemoteCode-Execution"},{"url":"https://www.sourcecodester.com/"}],"tags":["cve.org"],"epss":0.00292,"epssPercentile":0.21697,"ingestedAt":"2026-10-27T16:11:59.166Z","slug":"CVE-2026-116603","body":"## Overview\n\nA flaw has been found in SourceCodester Online Food Ordering System 1.0. Impacted is an unknown function of the file admin/add_food.php. Executing a manipulation of the argument image can lead to unrestricted upload. The attack may be performed from remote. The exploit has been published and may be used.\n\n## Affected\n\n- `online_food_ordering_system 1.0`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"sunlit","depthScore":26,"depthScoreParts":{"impact":25.9,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[]}