CVE-2026-4532: carmelo simple_food_order_system Forced Browsing
Vulnerability summary
CVE-2026-4532 is a high (CVSS 7.5) Forced Browsing vulnerability in carmelo simple_food_order_system. EPSS estimates a 0.70% chance of exploitation in the next 30 days, higher than 52.2% of scored vulnerabilities. 1 public exploit is recorded.
Timeline
- 22-03-2026PublishedVulnerability first disclosed.
- 23-03-2026Last modifiedVulnerability information updated.
Description
A security vulnerability has been detected in code-projects Simple Food Ordering System up to 1.0. Affected by this vulnerability is an unknown functionality of the file /food/sql/food.sql of the component Database Backup Handler. The manipulation leads to files or directories accessible. It is possible to initiate the attack remotely. The exploit has been disclosed publicly and may be used. It is recommended to change the configuration settings.
CVSS metrics
7 scores · 2 sources · 4 versions- NVDNIST5.5MediumCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:XDiffers
- CVE.orgCNA5.3MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N/E:P/RL:W/RC:RDiffers
- NVDNIST5.0MediumAV:N/AC:L/Au:N/C:P/I:N/A:N
EPSS trend
Probability
0.70%
Chance of exploitation in the next 30 days
Percentile
52%
Versus all other CVEs
30-day change
+0.24 pp
From 0.45% on 20-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
1 foundCvesmarz
Maturity: poc
Weaknesses
CWE · root cause- CWE-425Direct Request ('Forced Browsing')The web application does not adequately enforce appropriate authorization on all restricted URLs, scripts, or files.
- CWE-552Files or Directories Accessible to External PartiesThe product makes files or directories accessible to unauthorized actors, even though they should not be.
Affected systems
Carmelo1 product
Code-projects1 product
2 vendors · 2 products
References
5 links- code-projects.orgProduct