Description
A vulnerability was found in AdithyaYelloju Restaurant-Management-System up to 7f0e7e84255e8fcfd488e83f8f91451bbbff6b9c. This issue affects some unknown processing of the file User/forgot3.php of the component Password Reset. Performing a manipulation of the argument email/password results in sql injection. The attack can be initiated remotely. The exploit has been made public and could be used. Continious delivery with rolling releases is used by this product. Therefore, no version details of affected nor updated releases are available. The project was informed of the problem early through an issue report but has not responded yet.
Published: 2026-10-13
Score: 6.9 Medium
EPSS: < 1% Very Low
KEV: No
Impact: Remote SQL Injection
Action: Immediate Patch
AI Analysis

Impact

A vulnerability in the Password Reset component (forgot3.php) allows an attacker to inject arbitrary SQL through the email or password parameters, potentially enabling data exfiltration, unauthorized data modification, or other database compromise actions.

Affected Systems

The affected software is AdithyaYelloju Restaurant-Management-System. No specific affected version range is available; the vulnerability applies to code revisions up to the commit 7f0e7e84255e8fcfd488e83f8f91451bbbff6b9c and earlier, with no official patch released yet.

Risk and Exploitability

The CVSS score of 6.9 indicates a moderate severity, and the exploitation probability is not available; it is not included in the CISA KEV catalog. The vulnerability can be triggered remotely from the public internet, and a public exploit is available, implying that attackers can readily target exposed instances of this system.

Generated by OpenCVE AI on October 13, 2026 at 11:06 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Apply the vendor patch or upgrade to a fixed release as soon as it becomes available.
  • Use prepared statements or parameterized queries in the password reset logic to eliminate unsanitized user input.
  • Restrict public access to the forgot3.php endpoint and enforce strict input validation or whitelisting to prevent injection attempts.

Generated by OpenCVE AI on October 13, 2026 at 11:06 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Fri, 16 Oct 2026 23:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Tue, 13 Oct 2026 09:00:00 +0000

Type Values Removed Values Added
Description A vulnerability was found in AdithyaYelloju Restaurant-Management-System up to 7f0e7e84255e8fcfd488e83f8f91451bbbff6b9c. This issue affects some unknown processing of the file User/forgot3.php of the component Password Reset. Performing a manipulation of the argument email/password results in sql injection. The attack can be initiated remotely. The exploit has been made public and could be used. Continious delivery with rolling releases is used by this product. Therefore, no version details of affected nor updated releases are available. The project was informed of the problem early through an issue report but has not responded yet.
Title AdithyaYelloju Restaurant-Management-System Password Reset forgot3.php sql injection
First Time appeared Adithyayelloju
Adithyayelloju restaurant-management-system
Weaknesses CWE-74
CWE-89
CPEs cpe:2.3:a:adithyayelloju:restaurant-management-system:*:*:*:*:*:*:*:*
Vendors & Products Adithyayelloju
Adithyayelloju restaurant-management-system
References
Metrics cvssV2_0

{'score': 7.5, 'vector': 'AV:N/AC:L/Au:N/C:P/I:P/A:P/E:POC/RL:ND/RC:C'}

cvssV3_0

{'score': 7.3, 'vector': 'CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:C'}

cvssV3_1

{'score': 7.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:C'}

cvssV4_0

{'score': 6.9, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P'}

Subscriptions

Adithyayelloju Restaurant-management-system
cve-icon MITRE

Status: PUBLISHED

Assigner: VulDB

Published:

Updated: 2026-10-16T21:39:37.598Z

Reserved: 2026-10-12T09:39:23.273Z

Link: CVE-2026-109115

cve-icon Vulnrichment

Updated: 2026-10-16T21:39:32.223Z

cve-icon NVD

Status : Deferred

Published: 2026-10-13T09:17:15.730

Modified: 2026-10-16T22:17:18.243

Link: CVE-2026-109115

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-13T13:00:11Z

Weaknesses
  • CWE-74

    Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')

  • CWE-89

    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')