CVE-2026-4898

MEDIUM

code-projects Online Food Ordering System contact.php cross site scripting

Title source: cna

Description

A vulnerability was identified in code-projects Online Food Ordering System 1.0. Affected by this vulnerability is an unknown functionality of the file /dbfood/contact.php. The manipulation of the argument Name leads to cross site scripting. It is possible to initiate the attack remotely. The exploit is publicly available and might be used.

References (5)

[Vdb Entry, Technical Description] https://vuldb.com/?id.353640

[Signature, Permissions Required] https://vuldb.com/?ctiid.353640

[Third Party Advisory] https://vuldb.com/?submit.776430

[Exploit] https://github.com/ahmadmarz10-hub/CVEsMarz/blob/main/Stored%20Cross-Site%20Scripting%20(XSS)%20in%20Online%20Food%20Ordering%20System%20in%20PHP.md

View Exploit ZIP pw:eip

[Product] https://code-projects.org/

Scores

CVSS v3 4.3

EPSS 0.0003

EPSS Percentile 10.5%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

Details

CWE

CWE-79 CWE-94

Status published

Products (1)

code-projects/Online Food Ordering System 1.0

Published Mar 26, 2026

Tracked Since Mar 27, 2026