CVE-2026-76995: SourceCodester Simple Online Food Ordering System ajax.php save_menu unrestricted upload

Published Aug 20, 2026

Updated

A vulnerability was identified in SourceCodester Simple Online Food Ordering System 1.0. This issue affects some unknown processing of the file /admin/ajax.php?action=savemenu. The manipulation of the argument img leads to unrestricted upload. The attack is possible to be carried out remotely. The exploit is publicly available and might be used.

Affected Software

1 affected component

Sourcecodester Simple Online Food Ordering System=1.0

Event History

Aug 20, 2026

CVE Published

via MITRE·02:45 PM

Data Sourced

via MITRE·02:45 PM

DescriptionSeverityWeakness

Frequently Asked Questions

What level of access does an attacker need to exploit this issue?

The CVSS vector indicates high privileges are required. The attack can be performed remotely and does not require user interaction.

Which functionality should be treated as exposed?

The affected processing is the img argument handled by /admin/ajax.php?action=save_menu. This is associated with menu-saving functionality in SourceCodester Simple Online Food Ordering System 1.0.

Is exploit code available?

Yes. A public exploit is available, so organizations using the affected software should assume exploitation attempts are possible.