Read the docs
TI-2026-02709 Aliases CVE-2026-3137GHSA-49pv-4fw7-7vw4

CodeAstro Food Ordering System food_ordering.exe stack-based overflow

Priority MEDIUM 55CWE-119Published · Updated

Key facts

Attack vector
Local
Privileges required
Low
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
—
Confidentiality · integrity · availability
Low · Low · Low
Fix status
No fix listed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA.

Summary

A security vulnerability has been detected in CodeAstro Food Ordering System 1.0. This affects an unknown function of the file food_ordering.exe. Such manipulation leads to stack-based buffer overflow. The attack can only be performed from a local environment. The exploit has been disclosed publicly and may be used.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00245 15th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by the CNA and NVD
Fix No fix listed No fixed version in the sources yet

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
CodeAstroFood Ordering System1.0—No fix listedCNA
  • Food Ordering System VendorCodeAstro Affected 1.0 Fixed in — No fix listed CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:codeastro:food_ordering_system:1.0:*:*:*:*:*:*:*1.0VulnerableCodeAstro
  • cpe:2.3:a:codeastro:food_ordering_system:1.0:*:*:*:*:*:*:* Versions 1.0 Vulnerable ·CodeAstro

Remediation

No fixed version listed by the sources yet.

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-3137
  2. 2026-10-03 Alias added: GHSA-49pv-4fw7-7vw4

References

Exploit 1

Other 1

  • TI-2025-05541 CodeAstro Food Ordering System POST Request Parameter edit cross site scripting CVSS 4.0MEDIUM 4.8

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences