Is CVE-2026-113741 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-113741 being exploited in the wild.

How severe is CVE-2026-113741?

Medium severity, with a CVSS score of 4.3, published 21 October 2026.

Which products and versions are affected?

Itsourcecode Online Cake Ordering System 1.0.

Is there a fix for CVE-2026-113741?

No fixed version is recorded yet. Sanitize user input using allow-list validation and reject special characters; encode all output with htmlspecialchars() or htmlentities(); implement Content-Security-Policy and X-XSS-Protection HTTP security headers; conduct regular security testing. [{"kind": "disclosed", "at": "2026-10-07", "note": "Vulnerability report published on GitHub"}, {"kind": "advisory", "at": "2026-10-21", "note": "CVE-2026-113741 published"}] If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-113741 attacked?

It is attacked over the network.

Am I affected by CVE-2026-113741?

Check whether you run Itsourcecode Online Cake Ordering System at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-113741: itsourcecode Online Cake Ordering System reflected XSS in /404.php

CVE-2026-113741 · Severity: medium · CVSS 4.3 · Published 2026-10-21

The Online Cake Ordering System is a web-based ordering platform vulnerable to reflected cross-site scripting (XSS) via an unsanitized URL parameter. An attacker can trick users into clicking a malicious link that executes arbitrary JavaScript in their browser, enabling session hijacking, cookie theft, or malware distribution without requiring authentication.

Technologies: Itsourcecode Online Cake Ordering System. Vendors: Itsourcecode.

Quick answers

Is CVE-2026-113741 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-113741 being exploited in the wild.
How severe is CVE-2026-113741?: Medium severity, with a CVSS score of 4.3, published 21 October 2026.
Which products and versions are affected?: Itsourcecode Online Cake Ordering System 1.0.
Is there a fix for CVE-2026-113741?: No fixed version is recorded yet. Sanitize user input using allow-list validation and reject special characters; encode all output with htmlspecialchars() or htmlentities(); implement Content-Security-Policy and X-XSS-Protection HTTP security headers; conduct regular security testing.</anigation> <parameter name="timeline">[{"kind": "disclosed", "at": "2026-10-07", "note": "Vulnerability report published on GitHub"}, {"kind": "advisory", "at": "2026-10-21", "note": "CVE-2026-113741 published"}] If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-113741 attacked?: It is attacked over the network.
Am I affected by CVE-2026-113741?: Check whether you run Itsourcecode Online Cake Ordering System at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Sanitize user input using allow-list validation and reject special characters; encode all output with htmlspecialchars() or htmlentities(); implement Content-Security-Policy and X-XSS-Protection HTTP security headers; conduct regular security testing.</anigation> <parameter name="timeline">[{"kind": "disclosed", "at": "2026-10-07", "note": "Vulnerability report published on GitHub"}, {"kind": "advisory", "at": "2026-10-21", "note": "CVE-2026-113741 published"}]

Technical details

Reflected XSS vulnerability in /404.php where the 'useruid' parameter is directly reflected in page output without sanitization or encoding. Attack requires user interaction (visiting a crafted URL) but no authentication; attacker gains ability to execute JavaScript in victim's session context, potentially stealing credentials, session tokens, or performing unauthorized actions.

Affected products

itsourcecode Online Cake Ordering System 1.0

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.