CVE-2026-113740: itsourcecode Online Cake Ordering System deletecustomer.php sql injection

Published Oct 21, 2026

Updated

A flaw has been found in itsourcecode Online Cake Ordering System 1.0. Affected by this vulnerability is an unknown functionality of the file /deletecustomer.php. This manipulation of the argument ID causes sql injection. The attack is possible to be carried out remotely. The exploit has been published and may be used.

Affected Software

1 affected component

itsourcecode Online Cake Ordering System=1.0

Event History

Oct 21, 2026

CVE Published

via MITRE·12:45 AM

Data Sourced

via MITRE·12:45 AM

DescriptionSeverityWeakness

Frequently Asked Questions

Who can exploit this issue?

The vulnerability is remotely exploitable, but the CVSS vector indicates that an attacker needs low-level privileges. No user interaction is required.

What component should be investigated?

Investigate the /deletecustomer.php endpoint, specifically handling of its ID argument. The affected product version identified in the available data is itsourcecode Online Cake Ordering System 1.0.

Is exploit code available?

Yes. The available data states that an exploit has been published and may be used.