CVE-2026-4532

Katalog CVE

CVSS 7.5 · High EPSS 0,67%

Kerentanan Direct Request ('Forced Browsing') pada carmelo simple food order system. Skor CVSS 3.1 7.5 (High) menurut NVD.

Deskripsi (NVD)

A security vulnerability has been detected in code-projects Simple Food Ordering System up to 1.0. Affected by this vulnerability is an unknown functionality of the file /food/sql/food.sql of the component Database Backup Handler. The manipulation leads to files or directories accessible. It is possible to initiate the attack remotely. The exploit has been disclosed publicly and may be used. It is recommended to change the configuration settings.

Rincian

Terbit di NVD

22 Maret 2026

Terakhir diubah

17 Juni 2026

Status NVD

Analyzed

CVSS 3.1

7.5 (High), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-425: Direct Request ('Forced Browsing')
CWE-552: Files or Directories Accessible to External Parties

EPSS (30 hari)

0,67% peluang dieksploitasi; lebih tinggi dari 50,7% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/ahmadmarz10-hub/CVEsMarz/blob/main/Simple%20Food%20Ordering%20System%20Information%20Disclo... exploit · mitigasi · advisory pihak ketiga
• https://vuldb.com/?id.352320 advisory pihak ketiga · vdb entry
• https://vuldb.com/?submit.774338 advisory pihak ketiga · vdb entry
• https://code-projects.org/ product
• https://vuldb.com/?ctiid.352320 permissions required · vdb entry