{"id":"CVE-2026-90854","state":"PUBLISHED","title":"SourceCodester/katojkalemba Online Food Ordering System category-foods.php sql injection","description":"A security flaw has been discovered in SourceCodester/katojkalemba Online Food Ordering System 1.0. The impacted element is an unknown function of the file /web/category-foods.php. The manipulation of the argument ID results in sql injection. It is possible to launch the attack remotely. The exploit has been released to the public and may be used for attacks.","publishedAt":"2026-09-15T02:30:13.589Z","updatedAt":"2026-09-16T16:57:48.935Z","severity":{"score":6.9,"label":"Medium","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P","source":"VulDB"},"assigner":"VulDB","products":["SourceCodester Online Food Ordering System","katojkalemba Online Food Ordering System"],"affected":[{"vendor":"SourceCodester","product":"Online Food Ordering System","versions":[{"version":"1.0","status":"affected"}],"cpes":["cpe:2.3:a:sourcecodester:online_food_ordering_system:*:*:*:*:*:*:*:*"]},{"vendor":"katojkalemba","product":"Online Food Ordering System","versions":[{"version":"1.0","status":"affected"}],"cpes":["cpe:2.3:a:katojkalemba:online_food_ordering_system:*:*:*:*:*:*:*:*"]}],"references":["https://vuldb.com/vuln/403411","https://vuldb.com/vuln/403411/cti","https://vuldb.com/cve/CVE-2026-90854","https://vuldb.com/submit/927127"],"weaknesses":["CWE-89","CWE-74"],"ingestedAt":"2026-10-29T20:13:34.582Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2026/90xxx/CVE-2026-90854.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2026-90854","state":"PUBLISHED","datePublished":"2026-09-15T02:30:13.589Z","dateUpdated":"2026-09-16T16:57:48.935Z","assignerShortName":"VulDB","assignerOrgId":"1af790b2-7ee1-4545-860a-a788eba489b5","dateReserved":"2026-09-14T05:42:03.657Z"},"containers":{"cna":{"title":"SourceCodester/katojkalemba Online Food Ordering System category-foods.php sql injection","descriptions":[{"lang":"en","value":"A security flaw has been discovered in SourceCodester/katojkalemba Online Food Ordering System 1.0. The impacted element is an unknown function of the file /web/category-foods.php. The manipulation of the argument ID results in sql injection. It is possible to launch the attack remotely. The exploit has been released to the public and may be used for attacks."}],"affected":[{"vendor":"SourceCodester","product":"Online Food Ordering System","versions":[{"version":"1.0","status":"affected"}],"cpes":["cpe:2.3:a:sourcecodester:online_food_ordering_system:*:*:*:*:*:*:*:*"]},{"vendor":"katojkalemba","product":"Online Food Ordering System","versions":[{"version":"1.0","status":"affected"}],"cpes":["cpe:2.3:a:katojkalemba:online_food_ordering_system:*:*:*:*:*:*:*:*"]}],"references":[{"url":"https://vuldb.com/vuln/403411","name":"VDB-403411 | SourceCodester/katojkalemba Online Food Ordering System category-foods.php sql injection","tags":["vdb-entry","technical-description"]},{"url":"https://vuldb.com/vuln/403411/cti","name":"VDB-403411 | CTI Indicators (IOB, IOC, TTP, IOA)","tags":["signature","permissions-required"]},{"url":"https://vuldb.com/cve/CVE-2026-90854","name":"CVE-2026-90854 | CVE Analysis and Report","tags":["third-party-advisory"]},{"url":"https://vuldb.com/submit/927127","name":"Submit #927127 | SourceCodester   Online Food Ordering System 1.0  CWE-89","tags":["third-party-advisory"]}],"metrics":[{"cvssV4_0":{"version":"4.0","baseScore":6.9,"vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P","baseSeverity":"MEDIUM"}},{"cvssV3_1":{"version":"3.1","baseScore":7.3,"vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R","baseSeverity":"HIGH"}},{"cvssV3_0":{"version":"3.0","baseScore":7.3,"vectorString":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R","baseSeverity":"HIGH"}},{"cvssV2_0":{"version":"2.0","baseScore":7.5,"vectorString":"AV:N/AC:L/Au:N/C:P/I:P/A:P/E:POC/RL:ND/RC:UR"}}],"problemTypes":[{"descriptions":[{"cweId":"CWE-89","type":"CWE","lang":"en","description":"SQL Injection"}]},{"descriptions":[{"cweId":"CWE-74","type":"CWE","lang":"en","description":"Injection"}]}],"providerMetadata":{"shortName":"VulDB","orgId":"1af790b2-7ee1-4545-860a-a788eba489b5","dateUpdated":"2026-09-15T02:30:13.589Z"},"timeline":[{"time":"2026-09-14T00:00:00.000Z","lang":"en","value":"Advisory disclosed"},{"time":"2026-09-14T02:00:00.000Z","lang":"en","value":"VulDB entry created"},{"time":"2026-09-14T07:47:13.000Z","lang":"en","value":"VulDB entry last update"}],"credits":[{"lang":"en","value":"ameenk (VulDB User)","type":"reporter"},{"lang":"en","value":"VulDB Vulnerability Moderation Team","type":"coordinator"}],"tags":["x_freeware"],"x_generator":["VulDB PVTS v202609"]},"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"timestamp":"2026-09-16T16:57:21.061659Z","id":"CVE-2026-90854","options":[{"Exploitation":"none"},{"Automatable":"yes"},{"Technical Impact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2026-09-16T16:57:48.935Z"}}]}}}