CVE-2026-114380: itsourcecode Online Cake Ordering System inserttrans.php sql injection
A vulnerability was found in itsourcecode Online Cake Ordering System 1.0. Impacted is an unknown function of the file /inserttrans.php. Performing a manipulation of the argument prcd results in sql injection. The attack is possible to be carried out remotely. The exploit has been made public and could be used.
Affected Software
Event History
Frequently Asked Questions
What access does an attacker need to exploit this issue?
The vulnerability is remotely exploitable and has low attack complexity, but the CVSS vector indicates that an attacker needs low-level privileges (PR:L). No user interaction is required.
Which component should be prioritized for investigation?
Prioritize the /inserttrans.php endpoint, specifically handling of the prcd argument. The affected product version identified in the available data is itsourcecode Online Cake Ordering System 1.0.
How likely is active exploitation?
A public exploit is available, and the CVSS temporal metrics identify exploit maturity as proof-of-concept (E:P). Systems exposing the affected endpoint should be treated as at increased risk.