CVE-2026-76995CWE-284CWE-434broken-access-controlunrestricted-file-upload

CVE-2026-76995

Medium · published August 20, 2026

CVSS v3.1
4.7
EPSS
0%
Percentile
32.6
In the wild
Unconfirmed
What it is

A vulnerability was identified in SourceCodester Simple Online Food Ordering System 1.0. This issue affects some unknown processing of the file /admin/ajax.php?action=save_menu. The manipulation of the argument img leads to unrestricted upload. The attack is possible to be carried out remotely. The exploit is publicly available and might be used.

The record
Technical detail
CVSS v3.1
4.7 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L
CVSS v4.0
5.1 · CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P
EPSS
0.00396 · 32.6th percentile
Weaknesses
CWE-284 · Improper Access Control; CWE-434 · Unrestricted Upload of File with Dangerous Type
Published
2026-08-20T19:18Z
References (6)
https://github.com/hubdk01/cve/issues/1 · [email protected]https://vuldb.com/cve/CVE-2026-76995 · [email protected]https://vuldb.com/submit/880371 · [email protected]https://vuldb.com/vuln/393618 · [email protected]https://vuldb.com/vuln/393618/cti · [email protected]https://www.sourcecodester.com/ · [email protected]
EPSS history
Timeline
  • 20 AUG 14:45Z
    SourceCodester Simple Online Food Ordering System ajax.php save_menu unrestricted upload
    cvelistv5