CVE-2026-116602Medium· 6.5▾ SunlitA vulnerability was detected in SourceCodester Online Food Ordering System 1.0. This issue affects the function unlink of the file admin/delete.php. Performing a manipulation of the argument image_name results in path traversal. The atta…
▾ Sunlit zone — Low / medium · no exploitation signal
impact 35.8 · likelihood 0.1 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Exploit-prediction probability, daily snapshots since Oct 27.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via CVEORG
0.5%
A vulnerability was detected in SourceCodester Online Food Ordering System 1.0. This issue affects the function unlink of the file admin/delete.php. Performing a manipulation of the argument image_name results in path traversal. The attack is possible to be carried out remotely. The exploit is now public and may be used.
online_food_ordering_system 1.0Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-116604Medium· 6.5SourceCodester Online Food Ordering System delete_admin.php missing authentication
CVE-2026-116605Medium· 5.3SourceCodester Online Food Ordering System order.php client-side enforcement of server-side security
CVE-2026-116603Medium· 4.7SourceCodester Online Food Ordering System add_food.php unrestricted upload
CVE-2026-92385Low· 2.4A vulnerability has been found in SourceCodester Online Food Ordering System 1.0
CVE-2026-116055Medium· 6.3SourceCodester Performance Indicator System deleteproduct.php sql injection
CVE-2026-116060High· 7.3SourceCodester Performance Indicator System adddealer.php sql injection