Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
2.1

Food-waste-management-system admin page can be tricked remotely

CVE-2026-105168 · published 14 days ago
Summary

The admin.php page in the Order Assignment feature of the Food-waste-management-system can be sent specially crafted data that makes the database run commands it should not. An attacker on the internet could change or view information about orders and delivery assignments. Apply the latest update from the project or remove/disable the vulnerable function until a fix is released.

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software
VendorProductAffected versions
kishor-23 food-waste-management-system 411989e3ecb82895e53dca7865f72145f03d7d93
Original advisory text
kishor-23 food-waste-management-system Order Assignment Block admin.php sql injection
A vulnerability was identified in kishor-23 food-waste-management-system 411989e3ecb82895e53dca7865f72145f03d7d93/b3a70b2c492dc9904de5be1ad9389bd79b87f82c. This affects an unknown function of the file admin/admin.php of the component Order Assignment Block. The manipulation of the argument order_id/delivery_person_id leads to sql injection. It is possible to initiate the attack remotely. The exploit is publicly available and might be used. This product is using a rolling release to provide continious delivery. Therefore, no version details for affected nor updated releases are available. The project was informed of the problem early through an issue report but has not responded yet.
References
Fix within
Internet-facing 60 days
Internal At next upgrade
  • Not known to be exploited
  • Needs hands-on effort to exploit
  • Gives an attacker partial control
Severity
2.1 Low
Exploitation
<1% chance of attack within 30 days
Type
CWE-89SQL Injection
CWE-74Injection
Timeline
Published5 Oct 2026
Updated14 Oct 2026
First seen4 Oct 2026
Sources
CVE-2026-105168 · NVD
CVE-2026-105168 · MITRE
CVE-2026-105168 · OSV
Track software like this
Free during beta