Wecodex Restaurant CMS version 1.0 contains a flaw where the username input in the login page is used directly in a MySQL query without sanitization, creating a classic SQL injection vulnerability. An unauthenticated attacker can send crafted POST requests to the login endpoint and extract arbitrary data from the database, including business-sensitive information. The primary consequence is the disclosure of confidential data, compromising the privacy of the system’s information.

The vulnerable product is Wecodex Restaurant CMS version 1.0. No newer versions are documented in the supplied data, so all installations of this release are potentially affected.

The vulnerability has a CVSS base score of 8.8, indicating high severity. The EPSS score is less than 1 %, and it is not listed in the CISA KEV catalogue. The advisory explicitly states that the flaw can be exploited remotely by sending crafted POST requests to the public login endpoint; no special privileges or additional conditions are required beyond internet access to the affected server.