CVE-2026-116605 (CVSS 5.3)

Description

A vulnerability was found in SourceCodester Online Food Ordering System 1.0. The impacted element is an unknown function of the file order.php. The manipulation of the argument price/title results in client-side enforcement of server-side security. It is possible to launch the attack remotely. The exploit has been made public and could be used.

Is your site exposed to CVE-2026-116605?

Run a free security scan — no signup, results in seconds.

CVSS v3.1 Score

5.3

MEDIUM

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Weakness Type (CWE)

CWE-602 CWE-602

References

Other References

https://github.com/CyberShailendra/SourceCodesterOrderPrice-AmountTamperingviaHiddenFormFields https://vuldb.com/cve/CVE-2026-116605 https://vuldb.com/submit/1022965 https://vuldb.com/vuln/426511 https://vuldb.com/vuln/426511/cti https://www.sourcecodester.com/

Frequently Asked Questions

What is CVE-2026-116605? +

A vulnerability was found in SourceCodester Online Food Ordering System 1.0. The impacted element is an unknown function of the file order.php. The manipulation of the argument price/title results in client-side enforcement of server-side security. It is possible to launch the attack remotely. The exploit has been made public and could be used. It has a CVSS v3.1 base score of 5.3 (MEDIUM).

How severe is CVE-2026-116605? +

CVE-2026-116605 has a CVSS v3.1 score of 5.3 out of 10, rated MEDIUM. This is a medium-severity vulnerability that should be remediated as part of regular maintenance.

How do I check if I'm vulnerable to CVE-2026-116605? +

You can use Secably's free Website Scanner to check your website for known vulnerabilities. For infrastructure scanning, use the Port Scanner to identify exposed services that may be affected. Check the vendor advisories linked above for specific patch and version information.

Related Vulnerabilities

CVE-2026-110314

Client-Side Enforcement of Server-Side Security vulnerability in the WebSocket connection handling of mtrudel bandit allows a remote client to keep …

CVE-2026-63301

In Quick.CMS, the administrative user interface restricts deletion of the primary language by omitting the corresponding option from the interface; …

CVE-2026-77026

Joomla Extension - tassos.gr - Client-controlled validation bypass in Convert Forms extension < 5.2.5 - The front-end Submissions view did …

CVE-2026-82189

Joomla Extension - j2commerce.com - Any order can be marked Failed by anyone in J2Store 1.0.0-3.3.2, 4.0.0-4.0.22, 4.1.0-4.1.7 - Unauthenticated …

CVE-2026-54047

Laci Synchroni is a decentralized mod and appearance sync server and plugin for Dalamud. Versions of the backend prior to …

CVE-2026-45274

MyBooks is anebook management web server also known as Talebook. In 3.41.2 and earlier, the SignUp.post handler for POST /api/user/sign_up …

CVE-2026-116605