# CVE-2026-113741: itsourcecode Online Cake Ordering System reflected XSS in /404.php

Source: https://junglewise.ai/threats/cve-2026-113741-a-vulnerability-has-been-found-in-itsourcecode-online-cake  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-21. Updated: 2026-10-21  
License: CC BY 4.0 with a link back

CVE-2026-113741 · Severity: medium · CVSS 4.3 · Published 2026-10-21

The Online Cake Ordering System is a web-based ordering platform vulnerable to reflected cross-site scripting (XSS) via an unsanitized URL parameter. An attacker can trick users into clicking a malicious link that executes arbitrary JavaScript in their browser, enabling session hijacking, cookie theft, or malware distribution without requiring authentication.

Technologies: [Itsourcecode Online Cake Ordering System](https://junglewise.ai/threats/technologies/itsourcecode-online-cake-ordering-system). Vendors: [Itsourcecode](https://junglewise.ai/threats/vendors/itsourcecode).

## Quick answers

**Is CVE-2026-113741 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-113741 being exploited in the wild.

**How severe is CVE-2026-113741?** Medium severity, with a CVSS score of 4.3, published 21 October 2026.

**Which products and versions are affected?** Itsourcecode Online Cake Ordering System 1.0.

**Is there a fix for CVE-2026-113741?** No fixed version is recorded yet. Sanitize user input using allow-list validation and reject special characters; encode all output with htmlspecialchars() or htmlentities(); implement Content-Security-Policy and X-XSS-Protection HTTP security headers; conduct regular security testing.</anigation>
<parameter name="timeline">[{"kind": "disclosed", "at": "2026-10-07", "note": "Vulnerability report published on GitHub"}, {"kind": "advisory", "at": "2026-10-21", "note": "CVE-2026-113741 published"}] If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-113741 attacked?** It is attacked over the network.

**Am I affected by CVE-2026-113741?** Check whether you run Itsourcecode Online Cake Ordering System at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix


Sanitize user input using allow-list validation and reject special characters; encode all output with htmlspecialchars() or htmlentities(); implement Content-Security-Policy and X-XSS-Protection HTTP security headers; conduct regular security testing.</anigation>
<parameter name="timeline">[{"kind": "disclosed", "at": "2026-10-07", "note": "Vulnerability report published on GitHub"}, {"kind": "advisory", "at": "2026-10-21", "note": "CVE-2026-113741 published"}]

## Technical details

Reflected XSS vulnerability in /404.php where the 'useruid' parameter is directly reflected in page output without sanitization or encoding. Attack requires user interaction (visiting a crafted URL) but no authentication; attacker gains ability to execute JavaScript in victim's session context, potentially stealing credentials, session tokens, or performing unauthorized actions.

## Affected products

- itsourcecode Online Cake Ordering System 1.0

## References

- [https://github.com/milo417/submit/issues/2](https://github.com/milo417/submit/issues/2)
- [https://itsourcecode.com/](https://itsourcecode.com/)

## Related threats

- [itsourcecode Online Cake Ordering System SQL injection in /deletetransac.php](https://junglewise.ai/threats/cve-2026-116101-a-vulnerability-was-found-in-itsourcecode-online-cake-ordering)
- [itsourcecode Online Cake Ordering System SQL injection in transactionsave.php](https://junglewise.ai/threats/cve-2026-114384-a-security-vulnerability-has-been-detected-in-itsourcecode)
- [itsourcecode Online Cake Ordering System SQL injection in orderdetail.php](https://junglewise.ai/threats/cve-2026-114381-a-vulnerability-was-determined-in-itsourcecode-online-cake)
- [itsourcecode Online Cake Ordering System SQL injection in /inserttrans.php](https://junglewise.ai/threats/cve-2026-114380-a-vulnerability-was-found-in-itsourcecode-online-cake-ordering)
- [itsourcecode Online Cake Ordering System SQL injection in deleteproduct.php](https://junglewise.ai/threats/cve-2026-114378-a-vulnerability-was-detected-in-itsourcecode-online-cake)