CVE-2026-114378: itsourcecode Online Cake Ordering System deleteproduct.php sql injection
Published Oct 21, 2026
·Updated
A vulnerability was detected in itsourcecode Online Cake Ordering System 1.0. This affects an unknown part of the file /deleteproduct.php. The manipulation of the argument ID results in sql injection. The attack may be launched remotely. The exploit is now public and may be used.
Affected Software
1 affected component
itsourcecode Online Cake Ordering System=1.0
Event History
Oct 21, 2026
CVE Published
via MITRE·08:30 PM
Data Sourced
via MITRE·08:30 PM
DescriptionSeverityWeakness
Frequently Asked Questions
1
What level of access does an attacker need to exploit this issue?
The CVSS vector indicates that low-level privileges are required. Exploitation does not require user interaction and can be launched remotely.
2
What is the likely impact if exploitation succeeds?
The reported CVSS metrics indicate low impact to confidentiality, integrity, and availability. The affected input is the ID argument handled by /deleteproduct.php.
3
Is public exploit information available?
Yes. The vulnerability data states that a public exploit is available and may be used.