CVE-2026-30527

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2026-30527
A Stored Cross-Site Scripting (XSS) vulnerability exists in SourceCodester Online Food Ordering System v1.0 in the Category management module within the admin panel. The application fails to properly sanitize user input supplied to the "Category Name" field when creating or updating a category. When an administrator or user visits the Category list page (or any page where this category is rendered), the injected JavaScript executes immediately in their browser.

5.4 /10

CVSS v3 : MEDIUM

V3 Legend

Vector :

Exploitability : 2.3 / Impact : 2.7

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction REQUIRED

Confidentiality Impact LOW

Integrity Impact LOW

Availability Impact NONE

Scope CHANGED

References
Link Resource
https://github.com/meifukun/Web-Security-PoCs/blob/main/Online-Food-Ordering-System/Stored-XSS-Category-Name.md Exploit Third Party Advisory
Configurations

Configuration 1 (hide)

cpe:2.3:a:oretnom23:online_food_ordering_system:1.0:*:*:*:*:*:*:*
History

30 Mar 2026, 17:21

Type Values Removed Values Added
CVSS v2 : unknown
v3 : unknown 		v2 : unknown
v3 : 5.4
CPE cpe:2.3:a:oretnom23:online_food_ordering_system:1.0:*:*:*:*:*:*:*
CWE CWE-79
First Time Oretnom23 online Food Ordering System
Oretnom23
References () https://github.com/meifukun/Web-Security-PoCs/blob/main/Online-Food-Ordering-System/Stored-XSS-Category-Name.md - () https://github.com/meifukun/Web-Security-PoCs/blob/main/Online-Food-Ordering-System/Stored-XSS-Category-Name.md - Exploit, Third Party Advisory
Information

Published : 2026-03-27 16:16

Updated : 2026-03-30 17:21

NVD link : CVE-2026-30527

Mitre link : CVE-2026-30527

CVE.ORG link : CVE-2026-30527

JSON object : View

Products Affected

oretnom23

  • online_food_ordering_system
CWE
CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')