Medium severity · published Sep 9, 2024
CVE-2024-8604
SourceCodester Online Food Ordering System Create an Account Page index.php cross site scripting
6.1
CVSS
0.6%
EPSS
No
On KEV
Description
A vulnerability classified as problematic has been found in SourceCodester Online Food Ordering System 2.0. This affects an unknown part of the file index.php of the component Create an Account Page. The manipulation of the argument First Name/Last Name leads to cross site scripting. It is possible to initiate the attack remotely.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
Required
Confidentiality
Low
Integrity
Low
Availability
None
Scope
Changed
Exploitation
Is it being used?
Exploit prediction (EPSS)0.6% · higher than 47% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
OF
Online Food Ordering System · SourceCodester
2.0 · source: vendor, NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2024-8604
CVE.org
https://www.cve.org/CVERecord?id=CVE-2024-8604
Permissions Required
https://vuldb.com/?ctiid.276831
Third Party Advisory
https://vuldb.com/?id.276831
Third Party Advisory
https://vuldb.com/?submit.404660
Product
https://www.sourcecodester.com/
More from Online Food Ordering System
7.3
CVE-2026-90855
SourceCodester/katojkalemba Online Food Ordering System order.php sql injection
7.3
CVE-2026-90854
SourceCodester/katojkalemba Online Food Ordering System category-foods.php sql injection
7.3
CVE-2026-10694
SourceCodester Online Food Ordering System index.php include file inclusion
6.5
CVE-2026-116604
SourceCodester Online Food Ordering System delete_admin.php missing authentication
6.5
CVE-2026-116602
SourceCodester Online Food Ordering System delete.php unlink path traversal