CVE-2026-30527

5.4 mediumEPSS 0.2%

Medium (5.4) in oretnom23 online food ordering system. EPSS 0.2% chance of exploitation in the next 30 days.

A Stored Cross-Site Scripting (XSS) vulnerability exists in SourceCodester Online Food Ordering System v1.0 in the Category management module within the admin panel. The application fails to properly sanitize user input supplied to the "Category Name" field when creating or updating a category. When an administrator or user visits the Category list page (or any page where this category is rendered), the injected JavaScript executes immediately in their browser.

Severity

CVSS 3.1

5.4 medium

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

EPSS: 0.2% chance of exploitation in the next 30 days; higher than 14% of CVEs (scores of 2026-10-31)
CWE: CWE-79
Published: 2026-03-27
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

Affected

oretnom23:online_food_ordering_system

References

https://github.com/meifukun/Web-Security-PoCs/blob/main/Online-Food-Ordering-System/Stored-XSS-Category-Name.md

Check your stack JSON