Low severity · published Sep 16, 2026
CVE-2026-92385
SourceCodester Online Food Ordering System Category Update update_category.php cross site scripting
2.4
CVSS
0.4%
EPSS
No
On KEV
Description
A vulnerability has been found in SourceCodester Online Food Ordering System 1.0. The affected element is an unknown function of the file /admin/update_category.php of the component Category Update. The manipulation leads to cross site scripting. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:N/I:L/A:N
Attack vector
Network
Complexity
Low
Privileges
High
User interaction
Required
Confidentiality
None
Integrity
Low
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.4% · higher than 31% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
OF
Online Food Ordering System · SourceCodester
1.0 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-92385
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-92385
drive.google.com
https://drive.google.com/file/d/1nwr_EravSW9f62itP8sS6OpE3rqRDVkn/view?usp=sharing
gist.github.com
https://gist.github.com/MuhammadAmmar-Hacker/d0426a562fe0fa59efbfe7d45778ed27
vuldb.com
https://vuldb.com/cve/CVE-2026-92385
vuldb.com
https://vuldb.com/submit/939727
vuldb.com
https://vuldb.com/vuln/405522
vuldb.com
https://vuldb.com/vuln/405522/cti
More from Online Food Ordering System
7.3
CVE-2026-90855
SourceCodester/katojkalemba Online Food Ordering System order.php sql injection
7.3
CVE-2026-90854
SourceCodester/katojkalemba Online Food Ordering System category-foods.php sql injection
7.3
CVE-2026-10694
SourceCodester Online Food Ordering System index.php include file inclusion
6.5
CVE-2026-116604
SourceCodester Online Food Ordering System delete_admin.php missing authentication
6.5
CVE-2026-116602
SourceCodester Online Food Ordering System delete.php unlink path traversal