CVE-2026-123988: SililaWijesinghe Food Ordering System admin exposure of information through directory listing

Published Nov 7, 2026

Updated

A vulnerability has been found in SililaWijesinghe Food Ordering System up to ba314e897e3365600461e5ea59432e39ceaa0fa5. This issue affects some unknown processing of the file /Food-Ordering-System/admin/. Such manipulation leads to exposure of information through directory listing. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. This product does not use versioning. This is why information about affected and unaffected releases are unavailable. The vendor was contacted early about this disclosure but did not respond in any way.

Event History

Nov 7, 2026

CVE Published

via MITRE·02:00 PM

Data Sourced

via MITRE·02:00 PM

DescriptionSeverityWeakness

Data Sourced

via NVD·02:17 PM

DescriptionSeverityWeakness

Frequently Asked Questions

Who is exposed to this issue?

Instances of SililaWijesinghe Food Ordering System that expose the /Food-Ordering-System/admin/ path are potentially affected. The issue can be exploited remotely, so an attacker does not need local access to target a reachable deployment.

What does an attacker need to exploit it?

The available information identifies remote exploitation and public exploit disclosure, but does not state that authentication or any special privileges are required. Exposure depends on the affected admin directory being accessible in a way that permits directory listing.

How can I check whether my deployment is affected?

Request the /Food-Ordering-System/admin/ path on the deployed application and determine whether the server returns a directory index or lists directory contents. The product does not use versioning, so affected and unaffected releases cannot be identified by a version number.

What can be done if a patch is not available?

Disable directory listing for the affected path and restrict access to /Food-Ordering-System/admin/ to authorized administrators. The vendor did not respond to the disclosure, and no affected or fixed release information is available.

CVE-2026-123988: SililaWijesinghe Food Ordering System admin exposure of information through directory listing

Event History

Frequently Asked Questions

Who is exposed to this issue?

What does an attacker need to exploit it?

How can I check whether my deployment is affected?

What can be done if a patch is not available?

Company

Resources

Contact

Frequently Asked Questions

Who is exposed to this issue?

What does an attacker need to exploit it?

How can I check whether my deployment is affected?

What can be done if a patch is not available?