CVE-2026-114384: itsourcecode Online Cake Ordering System transactionsave.php sql injection
Published Oct 21, 2026
·Updated
A security vulnerability has been detected in itsourcecode Online Cake Ordering System 1.0. Affected is an unknown function of the file /transactionsave.php. Such manipulation of the argument del leads to sql injection. The attack can be launched remotely. The exploit has been disclosed publicly and may be used.
Affected Software
1 affected component
itsourcecode Online Cake Ordering System=1.0
Event History
Oct 21, 2026
CVE Published
via MITRE·10:00 PM
Data Sourced
via MITRE·10:00 PM
DescriptionSeverityWeakness
Frequently Asked Questions
1
Who is exposed to this issue?
Deployments of itsourcecode Online Cake Ordering System 1.0 that expose /transactionsave.php to remote users are potentially exposed. The vulnerable behavior involves the del argument.
2
What does an attacker need to exploit it?
The attack can be launched remotely with low attack complexity and does not require user interaction. The supplied vector indicates that the attacker requires low-level privileges.
3
Is public exploit information available?
Yes. The exploit has been publicly disclosed and may be used.