CVE-2026-15135 MEDIUM

CVE-2026-15135: code-projects Online Food Order System edit_food_items.php sql injection

Vendor Code-Projects
Product Online Food Order System
Weakness CWE-89 · SQLi
Published July 8, 2026
Last update July 9, 2026
View on NVD All CVEs

CVSS base score

6.9/10
Attack vector Network
Attack complexity Low
Privileges required None
User interaction None
Confidentiality —
Integrity —

CVSS vector

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P

What the vulnerability does

01Description

A security flaw has been discovered in code-projects Online Food Order System 1.0. This affects an unknown part of the file /edit_food_items.php. The manipulation of the argument update results in sql injection. It is possible to launch the attack remotely. The exploit has been released to the public and may be used for attacks.

Key dates

02Disclosure timeline

July 8, 2026 CVE published
July 9, 2026 Record updated

Related vulnerabilities

04Related CVE

CVE-2026-65520 WordPress WP OAuth Server plugin <= 6.2.0 - SQL Injection vulnerability CVE-2026-28184 WordPress Form Maker by 10Web plugin <= 1.15.44 - SQL Injection vulnerability CVE-2026-28002 WordPress Booktics plugin 1.0.22 - SQL Injection vulnerability CVE-2026-61969 WordPress Listdom plugin <= 5.6.0 - SQL Injection vulnerability CVE-2026-15993 Form Maker by 10Web <= 1.15.44 - Authenticated (Subscriber+) SQL Injection via '{username}' Placeholder in Dynamic-Choice Field WHERE Clause