VulnerabilityDeferred

CVE-2026-5811

A vulnerability was identified in SourceCodester Online Food Ordering System 1.0.

LOW 2.1EPSS 0.25%

Does this matter?

Lower severity and a low EPSS score (0.25%). Track it; it rarely justifies an emergency change on its own.

Description

A vulnerability was identified in SourceCodester Online Food Ordering System 1.0. Affected by this issue is the function save_product of the file /Actions.php of the component POST Parameter Handler. Such manipulation of the argument price leads to business logic errors. The attack may be performed from remote. The exploit is publicly available and might be used.

CVSS 4.0: 2.1 LOWCVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/M
EPSS: 0.25% probability · 16th percentile
CISA KEV: Not listed
Weakness: CWE-840
Source: cna@vuldb.com

References

https://github.com/meifukun/Web-Security-PoCs/blob/main/Online-Food-Ordering-System/BusinessLogic-Product-NegativePrice.md
https://vuldb.com/submit/787678
https://vuldb.com/vuln/356259
https://vuldb.com/vuln/356259/cti
https://www.sourcecodester.com/

Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.