CVE-2026-76049

Name of the Vulnerable Software and Affected Versions SourceCodester Simple Online Food Ordering System version 1.0

Description Remote SQL injection is possible through the manipulation of the ID argument in the '/admin/ajax.php?action=save menu' endpoint. SQL injection is a technique where an attacker inserts malicious SQL code into a query, allowing them to manipulate the database.

Recommendations Update SourceCodester Simple Online Food Ordering System version 1.0 to a version that contains a fix for this issue. As a temporary workaround, restrict access to the '/admin/ajax.php?action=save menu' endpoint to minimize the risk of exploitation.