Vendor
Food-Ordering 1.0 contains a Local File Inclusion (LFI) vulnerability in update_category.php allowing authenticated users to upload and execute arbitrary files via the update_image parameter.