CVE-2026-0591
MediumCVSS 6.3Exploitation Probability (EPSS)
Low risk30th percentile - higher than 30% of all known CVEs
Summary
A SQL injection vulnerability was identified in code-projects Online Product Reservation System 1.0 in the file /app/checkout/update.php. Manipulation of the id/qty arguments allows remote exploitation, and a public exploit may be used.
Risk Assessment
An attacker could execute arbitrary SQL queries, potentially leading to disclosure or modification of order and customer data.
Recommendation
Update the application to a patched version or enforce parameterized queries; until then, restrict access to the cart functionality.
Other vulnerabilities in Online Product Reservation System
See all- CVE-2026-0590Medium
A SQL injection vulnerability was determined in code-projects Online Product Reservation System 1.0 in the file /app/checkout/delete.php. Manipulation of the ID argument allows remote exploitation, and a public exploit may be used.
- CVE-2026-0586Medium
A cross-site scripting (XSS) vulnerability was detected in code-projects Online Product Reservation System 1.0 in the file handgunner-administrator/prod.php. Manipulation of the cat argument allows remote exploitation, and a public exploit may be used.
Original NVD description (English source)
A vulnerability was identified in code-projects Online Product Reservation System 1.0. The impacted element is an unknown function of the file /app/checkout/update.php of the component Cart Update Handler. Such manipulation of the argument id/qty leads to sql injection. It is possible to launch the attack remotely. The exploit is publicly available and might be used.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS