# CVE-2026-92385: SourceCodester Online Food Ordering System stored XSS in category image upload

Source: https://junglewise.ai/threats/cve-2026-92385-sourcecodester-online-food-ordering-system-stored-xss-in-category  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-16. Updated: 2026-09-26  
License: CC BY 4.0 with a link back

CVE-2026-92385 · Severity: low · CVSS 2.4 · Published 2026-09-16

SourceCodester Online Food Ordering System is a web application for managing food orders and categories. A stored cross-site scripting vulnerability in the category update feature allows authenticated administrators to upload malicious SVG images containing JavaScript code. When these images are accessed through the application, the embedded JavaScript executes in the browser, potentially allowing attackers to steal credentials, manipulate content, or perform unauthorized actions.

Technologies: [SourceCodester Online Food Ordering System](https://junglewise.ai/threats/technologies/online-food-ordering-system). Vendors: [SourceCodester](https://junglewise.ai/threats/vendors/sourcecodester).

## Quick answers

**Is CVE-2026-92385 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-92385 being exploited in the wild.

**How severe is CVE-2026-92385?** Low severity, with a CVSS score of 2.4, published 16 September 2026.

**Which products and versions are affected?** SourceCodester Online Food Ordering System 1.0.

**Is there a fix for CVE-2026-92385?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-92385 attacked?** It is attacked over the network.

**Am I affected by CVE-2026-92385?** Check whether you run SourceCodester Online Food Ordering System at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

This is a stored cross-site scripting (XSS) vulnerability in the category image upload functionality of the Online Food Ordering System v1.0. The vulnerability exists because the application accepts SVG file uploads without validating or sanitizing their XML content; SVG is an XML-based format capable of embedding JavaScript and event handlers. An authenticated administrator can upload a crafted SVG file containing malicious script tags or event handlers (e.g., <script> or onload attributes). When the uploaded SVG is directly accessed or rendered by a browser, the embedded JavaScript executes within the application's security context. The attack requires authentication but has network-level reachability; once exploited, the malicious payload persists on the server and executes for any user viewing the compromised image. No patch or official fix is mentioned in the advisory.

## Affected products

- SourceCodester Online Food Ordering System 1.0

## Timeline

- 2026-09-16: disclosed
- other: Public exploit proof-of-concept available

## References

- [https://drive.google.com/file/d/1nwr_EravSW9f62itP8sS6OpE3rqRDVkn/view?usp=sharing](https://drive.google.com/file/d/1nwr_EravSW9f62itP8sS6OpE3rqRDVkn/view?usp=sharing)
- [https://gist.github.com/MuhammadAmmar-Hacker/d0426a562fe0fa59efbfe7d45778ed27](https://gist.github.com/MuhammadAmmar-Hacker/d0426a562fe0fa59efbfe7d45778ed27)

## Related threats

- [SourceCodester Online Food Ordering System client-side price enforcement](https://junglewise.ai/threats/cve-2026-116605-a-vulnerability-was-found-in-sourcecodester-online-food-ordering)
- [SourceCodester Online Food Ordering System missing authentication in admin delete endpoints](https://junglewise.ai/threats/cve-2026-116604-a-vulnerability-has-been-found-in-sourcecodester-online-food)
- [SourceCodester Online Food Ordering System unrestricted file upload in add_food.php](https://junglewise.ai/threats/cve-2026-116603-a-flaw-has-been-found-in-sourcecodester-online-food-ordering)
- [SourceCodester Online Food Ordering System path traversal in delete.php](https://junglewise.ai/threats/cve-2026-116602-a-vulnerability-was-detected-in-sourcecodester-online-food)
- [SourceCodester Online Food Ordering System local file inclusion in index.php](https://junglewise.ai/threats/cve-2026-10694-sourcecodester-online-food-ordering-system-local-file-inclusion)