CVE-2026-78198 SourceCodester Simple Online Food Ordering System ajax.php add_to_cart sql injection

A security vulnerability has been detected in SourceCodester Simple Online Food Ordering System 1.0. This issue affects some unknown processing of the file /fos/admin/ajax.php?action=addtocart. Such manipulation of the argument pid leads to sql injection. The attack may be launched remotely. The...

CVE-2026-4080: Improper Neutralization of Input During Web Page Generation

The Easy Cart plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'addtocart' shortcode in all versions up to and including 1.8. This is due to insufficient input sanitization and output escaping on user-supplied shortcode attributes. Specifically, the ectpaddtocart function...

CVE-2026-7648: Authorization Bypass Through User-Controlled Key

The LearnPress – WordPress LMS Plugin for Create and Sell Online Courses plugin for WordPress is vulnerable to payment bypass through user-controlled key in all versions up to, and including, 4.3.5. This is due to improper handling of user-supplied request parameters in the REST API endpoint, whi...

CVE-2026-7410: Improper Neutralization of Special Elements used in an SQL Command

A vulnerability has been found in SourceCodester Pizzafy Ecommerce System 1.0. This vulnerability affects unknown code of the file /admin/ajax.php?action=addtocart. The manipulation of the argument pid leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to...

SourceCodester Pizzafy Ecommerce System 注入漏洞

SourceCodester Pizzafy Ecommerce System is an open-source e-commerce system developed by SourceCodester. Version 1.0 of the SourceCodester Pizzafy Ecommerce System has a SQL injection vulnerability, which arises from the parameter pid being manipulated in the file admin/ajax.php?action=addtocart...

CVE-2025-13202: Improper Neutralization of Input During Web Page Generation

A security flaw has been discovered in code-projects Simple Cafe Ordering System 1.0. This affects an unknown part of the file /addtocart. Performing manipulation of the argument productname results in cross site scripting. It is possible to initiate the attack remotely. The exploit has been...

CVE-2025-2387: Improper Neutralization of Special Elements used in an SQL Command

A vulnerability was found in SourceCodester Online Food Ordering System 2.0. It has been classified as critical. Affected is an unknown function of the file /admin/ajax.php?action=addtocart. The manipulation of the argument pid leads to sql injection. It is possible to launch the attack remotely...

Vastal I-Tech Dating Zone SQL Injection Vulnerability

Vastal I-Tech Dating Zone is a dating site system. The system supports user registration, search and forums. A SQL injection vulnerability exists in Vastal I-Tech Dating Zone version 0.9.9. A remote attacker can exploit the vulnerability by sending the 'productid' parameter to the addtocart.php...