CVE-2026-19916

Received Received - Intake

Cross-Site Scripting in Online Food Order System

Publication date: 2026-08-15

Last updated on: 2026-08-15

Assigner: VulDB

Description

A vulnerability was detected in code-projects Online Food Order System 1.0. The affected element is an unknown function of the file edit_food_items.php. Performing a manipulation of the argument dname results in cross site scripting. Remote exploitation of the attack is possible. The exploit is now public and may be used.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-15

Last Modified

2026-08-15

Generated

2026-08-16

AI Q&A

2026-08-16

EPSS Evaluated

N/A

NVD

CVE-2026-19916

Affected Vendors & Products

Vendor	Product	Version / Range
code-projects	online_food_order_system	1.0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-79	The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
CWE-94	The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.

Attack-Flow Graph

Executive Summary

This vulnerability is a cross-site scripting (XSS) issue in the Online Food Order System 1.0. It involves manipulating the 'dname' argument in the edit_food_items.php file, allowing attackers to inject malicious scripts. The exploit is publicly available and can be used remotely.

Detection Guidance

To detect this XSS vulnerability in the Online Food Order System, inspect the edit_food_items.php file for improper input validation of the dname argument. Check for reflected or stored XSS by submitting test payloads like <script>alert(1)</script> in the dname field and observe if it executes.

Impact Analysis

This vulnerability could allow attackers to execute malicious scripts in your browser when you interact with the affected system. This may lead to theft of session cookies, account hijacking, or defacement of web pages. Users with limited privileges could be tricked into triggering the exploit.

Compliance Impact

This XSS vulnerability may violate GDPR by exposing user data through script injection. For HIPAA, it could compromise protected health information if exploited on systems handling such data. Compliance risks include unauthorized data access and breaches of confidentiality requirements.

Mitigation Strategies

Immediately update the edit_food_items.php file to sanitize user input for the dname argument. Implement strict input validation to reject or escape HTML/script tags. Apply web application firewalls to filter malicious payloads. Consider removing the vulnerable component if not essential.

Hi! I’m here to help you understand CVE-2026-19916. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70