CVE-2026-114381
Low · CVSS 2.1Published 2026-10-21
CVSS
2.1
Low
EPSS
—
exploit probability
Active Exploit
No
not yet listed
Low — routine — Low severity. Handle in normal patch cycle.
What is CVE-2026-114381?
A vulnerability was determined in itsourcecode Online Cake Ordering System 1.0. The affected element is an unknown function of the file /orderdetail.php. Executing a manipulation of the argument ID can lead to sql injection. The attack may be performed from remote. The exploit has been publicly disclosed and may be utilized.
Likely affects:PHP
CVSS Score Explained
CVSS 2.1 is Low severity. Impact is limited and exploitation is difficult. Patch when convenient.
EPSS Exploitation Probability
No EPSS score yet — model needs more data on this CVE.
References & Patches
- ›https://github.com/xiangchao02/submit/issues/1
- ›https://itsourcecode.com/
- ›https://vuldb.com/cve/CVE-2026-114381
- ›https://vuldb.com/submit/1019792
- ›https://vuldb.com/vuln/424739
- ›https://vuldb.com/vuln/424739/cti
Track vulnerabilities for your stack
Tell us what tech you run — Node.js, Python, Java, nginx, whatever — and get a weekly email when new CVEs affect it.
Recent CVEs
- CVE-2026-6945Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.—
- CVE-2026-113705A vulnerability was determined in a2aproject a2a-rs up to 0.4.3. This issue affects some unknown processing of the file a2a-server/src/error.rs. Executing a manipulation can lead to information exposure through error message. The attack can be executed remotely. This patch is called 713b943af94ab2d521d483b841618b97a2e78a4d. A patch should be applied to remediate this issue.6.9
- CVE-2026-112202Imager::File::GIF versions before 1.006 for Perl allow out-of-bounds reads when consolidating GIF images.
With `gif_consolidate => 1`, palette indices from the image are used without checking the colour table's bounds. The i_readgif_low routine reads beyond the heap allocation and copies the bytes into output pixels. The default GIF reader is not affected.
The same code ships bundled in the Imager distribution.
An attacker supplying a crafted GIF can disclose adjacent heap memory through the decoded output and may crash the process.—
- CVE-2026-9825IBM Cyber Fraud 1.0.0 through 1.0.2 has a missing secure attribute allowing sensitive cookies to be transmitted over unencrypted connections, potentially enabling an attacker to intercept session data through network-based attacks.3.7
- CVE-2026-91668Vulnerability in the Oracle Data Integrator product of Oracle Fusion Middleware (component: Dictionary Repository). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable vulnerability allows low privileged attacker with network access via SQL to compromise Oracle Data Integrator. Successful attacks of this vulnerability can result in takeover of Oracle Data Integrator. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).8.8
- CVE-2026-92559IBM App Connect Enterprise 13.0.1.0 through 13.0.8.2 could allow a remote attacker to obtain sensitive information due to binding to an unrestricted IP address.9.8