Updated 8 h ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,762exploited flaws on CISA’s list

34added in the last 30 days

343new WordPress flaws this week

390,080entries in the database

33 results

Jul 13, 2026FoodBook Lite - Online Food Ordering System: Missing AuthorizationCVE-2026-11802 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The FoodBook Lite - Online Food Ordering System plugin for WordPress is vulnerable to Missing Authorization in all versions up to, and including, 1.5.6. The registration() function, accessible via the wp_ajax_nopriv_registration_action AJAX action, lacks any nonce verification or capability check, and does not check the WordPress users_can_register option before calling wp_insert_user(). This makes it possible for unauthenticated attackers to create new user accounts with the 'customer' role and receive authentication cookies, even when the site administrator has explicitly disabled user registration.
Product
FoodBook Lite - Online Food Ordering System
Affected
up to 1.5.6
What to do
Affects up to 1.5.6. Update FoodBook Lite - Online Food Ordering System to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Oct 3, 2025RestroPress – Online Food Ordering System: Authentication BypassCVE-2025-9209 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The RestroPress – Online Food Ordering System plugin for WordPress is vulnerable to Authentication Bypass in versions 3.0.0 to 3.1.9.2. This is due to the plugin exposing user private tokens and API data via the /wp-json/wp/v2/users REST API endpoint. This makes it possible for unauthenticated attackers to forge JWT tokens for other users, including administrators, and authenticate as them.
Product
RestroPress – Online Food Ordering System
Affected
3.0.0 to 3.1.9.2
What to do
Affects 3.0.0 to 3.1.9.2. Update RestroPress – Online Food Ordering System to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wordpress.org wordfence.com
Jan 23, 2025A SQL Injection vulnerability exists in the login form of Online Food Ordering System v1.0.CVE-2024-57328 · Other software · Projectworlds · reported by MITRECritical 9.8
A SQL Injection vulnerability exists in the login form of Online Food Ordering System v1.0. The vulnerability arises because the input fields username and password are not properly sanitized, allowing attackers to inject malicious SQL queries to bypass authentication and gain unauthorized access.
Product
Online Food Ordering System
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com
Dec 31, 2024A vulnerability was found in CodeAstro Online Food Ordering System 1.0.CVE-2024-13070 · Other software · CodeAstro · reported by VulDBMedium 5.3
A vulnerability was found in CodeAstro Online Food Ordering System 1.0. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the file /admin/update_users.php of the component Update User Page. The manipulation of the argument user_upd leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used.
Product
Online Food Ordering System
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record codeastro.com github.com
Dec 31, 2024A vulnerability was found in CodeAstro Online Food Ordering System 1.0 and classified as critical.CVE-2024-13067 · Other software · CodeAstro · reported by VulDBMedium 6.9
A vulnerability was found in CodeAstro Online Food Ordering System 1.0 and classified as critical. This issue affects some unknown processing of the file /admin/all_users.php of the component All Users Page. The manipulation leads to improper access controls. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used.
Product
Online Food Ordering System
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record codeastro.com github.com
Jan 11, 2024A vulnerability was found in CodeAstro Online Food Ordering System 1.0.CVE-2024-0423 · Other software · CodeAstro · reported by VulDBLow 3.5
A vulnerability was found in CodeAstro Online Food Ordering System 1.0. It has been rated as problematic. Affected by this issue is some unknown functionality of the file dishes.php. The manipulation of the argument res_id leads to cross site scripting. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. VDB-250442 is the identifier assigned to this vulnerability.
Product
Online Food Ordering System
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record drive.google.com vuldb.com
Jan 5, 2024A vulnerability classified as critical was found in CodeAstro Online Food Ordering System 1.0.CVE-2024-0247 · Other software · CodeAstro · reported by VulDBHigh 7.3
A vulnerability classified as critical was found in CodeAstro Online Food Ordering System 1.0. This vulnerability affects unknown code of the file /admin/ of the component Admin Panel. The manipulation of the argument Username leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. VDB-249778 is the identifier assigned to this vulnerability.
Product
Online Food Ordering System
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record drive.google.com vuldb.com
Nov 2, 2023Online Food Ordering System v1.0 is vulnerable to multiple Unauthenticated SQL Injection vulnerabilities.CVE-2023-45347 · Other software · Projectworlds Pvt. Limited · reported by help@fluidattacks.comCritical 9.8
Online Food Ordering System v1.0 is vulnerable to multiple Unauthenticated SQL Injection vulnerabilities. The '*_verified' parameter of the routers/user-router.php resource does not validate the characters received and they are sent unfiltered to the database.
Product
Online Food Ordering System
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record fluidattacks.com projectworlds.in
Nov 2, 2023Online Food Ordering System v1.0 is vulnerable to multiple Unauthenticated SQL Injection vulnerabilities.CVE-2023-45346 · Other software · Projectworlds Pvt. Limited · reported by help@fluidattacks.comCritical 9.8
Online Food Ordering System v1.0 is vulnerable to multiple Unauthenticated SQL Injection vulnerabilities. The '*_role' parameter of the routers/user-router.php resource does not validate the characters received and they are sent unfiltered to the database.
Product
Online Food Ordering System
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record fluidattacks.com projectworlds.in
Nov 2, 2023Online Food Ordering System v1.0 is vulnerable to multiple Unauthenticated SQL Injection vulnerabilities.CVE-2023-45345 · Other software · Projectworlds Pvt. Limited · reported by help@fluidattacks.comCritical 9.8
Online Food Ordering System v1.0 is vulnerable to multiple Unauthenticated SQL Injection vulnerabilities. The '*_deleted' parameter of the routers/user-router.php resource does not validate the characters received and they are sent unfiltered to the database.
Product
Online Food Ordering System
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record fluidattacks.com projectworlds.in
Nov 2, 2023Online Food Ordering System v1.0 is vulnerable to multiple Unauthenticated SQL Injection vulnerabilities.CVE-2023-45338 · Other software · Projectworlds Pvt. Limited · reported by help@fluidattacks.comCritical 9.8
Online Food Ordering System v1.0 is vulnerable to multiple Unauthenticated SQL Injection vulnerabilities. The 'id' parameter of the routers/add-ticket.php resource does not validate the characters received and they are sent unfiltered to the database.
Product
Online Food Ordering System
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record fluidattacks.com projectworlds.in
Nov 2, 2023Online Food Ordering System v1.0 is vulnerable to multiple Unauthenticated SQL Injection vulnerabilities.CVE-2023-45344 · Other software · Projectworlds Pvt. Limited · reported by help@fluidattacks.comCritical 9.8
Online Food Ordering System v1.0 is vulnerable to multiple Unauthenticated SQL Injection vulnerabilities. The '*_balance' parameter of the routers/user-router.php resource does not validate the characters received and they are sent unfiltered to the database.
Product
Online Food Ordering System
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record fluidattacks.com projectworlds.in
Nov 2, 2023Online Food Ordering System v1.0 is vulnerable to multiple Unauthenticated SQL Injection vulnerabilities.CVE-2023-45343 · Other software · Projectworlds Pvt. Limited · reported by help@fluidattacks.comCritical 9.8
Online Food Ordering System v1.0 is vulnerable to multiple Unauthenticated SQL Injection vulnerabilities. The 'ticket_id' parameter of the routers/ticket-message.php resource does not validate the characters received and they are sent unfiltered to the database.
Product
Online Food Ordering System
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record fluidattacks.com projectworlds.in
Nov 2, 2023Online Food Ordering System v1.0 is vulnerable to multiple Unauthenticated SQL Injection vulnerabilities.CVE-2023-45342 · Other software · Projectworlds Pvt. Limited · reported by help@fluidattacks.comCritical 9.8
Online Food Ordering System v1.0 is vulnerable to multiple Unauthenticated SQL Injection vulnerabilities. The 'phone' parameter of the routers/register-router.php resource does not validate the characters received and they are sent unfiltered to the database.
Product
Online Food Ordering System
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record fluidattacks.com projectworlds.in
Nov 2, 2023Online Food Ordering System v1.0 is vulnerable to multiple Unauthenticated SQL Injection vulnerabilities.CVE-2023-45341 · Other software · Projectworlds Pvt. Limited · reported by help@fluidattacks.comCritical 9.8
Online Food Ordering System v1.0 is vulnerable to multiple Unauthenticated SQL Injection vulnerabilities. The '*_price' parameter of the routers/menu-router.php resource does not validate the characters received and they are sent unfiltered to the database.
Product
Online Food Ordering System
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record fluidattacks.com projectworlds.in
Nov 2, 2023Online Food Ordering System v1.0 is vulnerable to multiple Unauthenticated SQL Injection vulnerabilities.CVE-2023-45340 · Other software · Projectworlds Pvt. Limited · reported by help@fluidattacks.comCritical 9.8
Online Food Ordering System v1.0 is vulnerable to multiple Unauthenticated SQL Injection vulnerabilities. The 'phone' parameter of the routers/details-router.php resource does not validate the characters received and they are sent unfiltered to the database.
Product
Online Food Ordering System
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record fluidattacks.com projectworlds.in
Nov 2, 2023Online Food Ordering System v1.0 is vulnerable to multiple Unauthenticated SQL Injection vulnerabilities.CVE-2023-45336 · Other software · Projectworlds Pvt. Limited · reported by help@fluidattacks.comCritical 9.8
Online Food Ordering System v1.0 is vulnerable to multiple Unauthenticated SQL Injection vulnerabilities. The 'password' parameter of the routers/router.php resource does not validate the characters received and they are sent unfiltered to the database.
Product
Online Food Ordering System
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record fluidattacks.com projectworlds.in
Nov 2, 2023Online Food Ordering System v1.0 is vulnerable to multiple Unauthenticated SQL Injection vulnerabilities.CVE-2023-45334 · Other software · Projectworlds Pvt. Limited · reported by help@fluidattacks.comCritical 9.8
Online Food Ordering System v1.0 is vulnerable to multiple Unauthenticated SQL Injection vulnerabilities. The 'status' parameter of the routers/edit-orders.php resource does not validate the characters received and they are sent unfiltered to the database.
Product
Online Food Ordering System
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record fluidattacks.com projectworlds.in
Nov 2, 2023Online Food Ordering System v1.0 is vulnerable to multiple Unauthenticated SQL Injection vulnerabilities.CVE-2023-45325 · Other software · Projectworlds Pvt. Limited · reported by help@fluidattacks.comCritical 9.8
Online Food Ordering System v1.0 is vulnerable to multiple Unauthenticated SQL Injection vulnerabilities. The 'address' parameter of the routers/add-users.php resource does not validate the characters received and they are sent unfiltered to the database.
Product
Online Food Ordering System
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record fluidattacks.com projectworlds.in
Nov 2, 2023Online Food Ordering System v1.0 is vulnerable to multiple Unauthenticated SQL Injection vulnerabilities.CVE-2023-45323 · Other software · Projectworlds Pvt. Limited · reported by help@fluidattacks.comCritical 9.8
Online Food Ordering System v1.0 is vulnerable to multiple Unauthenticated SQL Injection vulnerabilities. The 'name' parameter of the routers/add-item.php resource does not validate the characters received and they are sent unfiltered to the database.
Product
Online Food Ordering System
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record fluidattacks.com projectworlds.in
May 4, 2023An arbitrary file upload vulnerability in the component /admin/ajax.php?action=save_menu of Online Food Ordering System v2.0 allows attackers to execute arbitraCVE-2023-30122 · Other software · Oretnom23 · reported by MITRECritical 9.8
An arbitrary file upload vulnerability in the component /admin/ajax.php?action=save_menu of Online Food Ordering System v2.0 allows attackers to execute arbitrary code via uploading a crafted PHP file.
Product
Online Food Ordering System
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Mar 14, 2023A Cross-Site Request Forgery (CSRF) in Online Food Ordering System v1.0 allows attackers to change user details and credentials via a crafted POST request.CVE-2023-27073 · Other software · Oretnom23 · reported by MITREMedium 6.5
A Cross-Site Request Forgery (CSRF) in Online Food Ordering System v1.0 allows attackers to change user details and credentials via a crafted POST request.
Product
Online Food Ordering System
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com projectworlds.in
Feb 13, 2023Food Ordering System v2.0 was discovered to contain a SQL injection vulnerability via the email parameter.CVE-2023-24647 · Other software · Oretnom23 · reported by MITREHigh 7.5
Food Ordering System v2.0 was discovered to contain a SQL injection vulnerability via the email parameter.
Product
Online Food Ordering System
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Feb 13, 2023An arbitrary file upload vulnerability in the component /fos/admin/ajax.php of Food Ordering System v2.0 allows attackers to execute arbitrary code via a crafteCVE-2023-24646 · Other software · Oretnom23 · reported by MITRECritical 9.8
An arbitrary file upload vulnerability in the component /fos/admin/ajax.php of Food Ordering System v2.0 allows attackers to execute arbitrary code via a crafted PHP file.
Product
Online Food Ordering System
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Feb 6, 2023Online Food Ordering System v2 was discovered to contain a SQL injection vulnerability via the id parameter at view_order.php.CVE-2023-24197 · Other software · Oretnom23 · reported by MITREMedium 6.1
Online Food Ordering System v2 was discovered to contain a SQL injection vulnerability via the id parameter at view_order.php.
Product
Online Food Ordering System
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com sourcecodester.com
Feb 6, 2023Online Food Ordering System v2 was discovered to contain a cross-site scripting (XSS) vulnerability via the page parameter in index.php.CVE-2023-24195 · Other software · Oretnom23 · reported by MITREMedium 6.1
Online Food Ordering System v2 was discovered to contain a cross-site scripting (XSS) vulnerability via the page parameter in index.php.
Product
Online Food Ordering System
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com sourcecodester.com
Feb 6, 2023Online Food Ordering System v2 was discovered to contain a cross-site scripting (XSS) vulnerability via the page parameter in navbar.php.CVE-2023-24194 · Other software · Oretnom23 · reported by MITREMedium 6.1
Online Food Ordering System v2 was discovered to contain a cross-site scripting (XSS) vulnerability via the page parameter in navbar.php.
Product
Online Food Ordering System
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com sourcecodester.com
Feb 6, 2023Online Food Ordering System v2 was discovered to contain a cross-site scripting (XSS) vulnerability via the redirect parameter in login.php.CVE-2023-24192 · Other software · Oretnom23 · reported by MITREMedium 6.1
Online Food Ordering System v2 was discovered to contain a cross-site scripting (XSS) vulnerability via the redirect parameter in login.php.
Product
Online Food Ordering System
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com sourcecodester.com
Feb 6, 2023Online Food Ordering System v2 was discovered to contain a cross-site scripting (XSS) vulnerability via the redirect parameter in signup.php.CVE-2023-24191 · Other software · Oretnom23 · reported by MITREMedium 6.1
Online Food Ordering System v2 was discovered to contain a cross-site scripting (XSS) vulnerability via the redirect parameter in signup.php.
Product
Online Food Ordering System
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com sourcecodester.com
Jan 20, 2023Multiple SQL Injection vulnerabilities in tourist5 Online-food-ordering-system 1.0.CVE-2020-29297 · Other software · Oretnom23 · reported by MITRECritical 9.8
Multiple SQL Injection vulnerabilities in tourist5 Online-food-ordering-system 1.0.
Product
Online Food Ordering System
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record gist.github.com github.com
Sep 1, 2022Online Food Ordering System v1.0 was discovered to contain a SQL injection vulnerability via the component /dishes.php?res_id=.CVE-2022-36759 · Other software · Oretnom23 · reported by MITRECritical 9.8
Online Food Ordering System v1.0 was discovered to contain a SQL injection vulnerability via the component /dishes.php?res_id=.
Product
Online Food Ordering System
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record hackmd.io hackmd.io
May 25, 2022An arbitrary file upload vulnerability in the Select Image function of Online Food Ordering System v1.0 allows attackers to execute arbitrary code via a craftedCVE-2022-29651 · Other software · Oretnom23 · reported by MITREHigh 7.2
An arbitrary file upload vulnerability in the Select Image function of Online Food Ordering System v1.0 allows attackers to execute arbitrary code via a crafted PHP file.
Product
Online Food Ordering System
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record hackmd.io hackmd.io
May 25, 2022Online Food Ordering System v1.0 was discovered to contain a SQL injection vulnerability via the Search parameter at /online-food-order/food-search.php.CVE-2022-29650 · Other software · Oretnom23 · reported by MITRECritical 9.8
Online Food Ordering System v1.0 was discovered to contain a SQL injection vulnerability via the Search parameter at /online-food-order/food-search.php.
Product
Online Food Ordering System
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record hackmd.io hackmd.io

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.