Sourcecodester · Simple Online Food Ordering System · CVE-2026-76050
**Name of the Vulnerable Software and Affected Versions**
SourceCodester Simple Online Food Ordering System version 1.0
**Description**
Remote SQL injection is possible via the `/admin/ajax.php?action=delete menu` endpoint. The issue occurs when the `ID` argument is manipulated, allowing an attacker to execute arbitrary SQL commands on the database.
**Recommendations**
Update SourceCodester Simple Online Food Ordering System version 1.0. At the moment, there is no information about a newer version that contains a fix for this vulnerability.