Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.

CVE-2026-105229: Food Waste Management System signup.php allows database command injection

CVE-2026-105229 · published 1 month ago

Summary

The signup.php page used for new user registration in the Food Waste Management System can be tricked into running unintended database commands when specially crafted email, name or gender values are submitted. This could let an attacker view, change, or delete data stored by the system. Apply the latest update from the project or modify the code to properly sanitize all input fields.

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software

Vendor	Product	Affected versions
kishor-23	food-waste-management-system	411989e3ecb82895e53dca7865f72145f03d7d93

Original advisory text

kishor-23 food-waste-management-system User Registration Endpoint signup.php sql injection

A weakness has been identified in kishor-23 food-waste-management-system 411989e3ecb82895e53dca7865f72145f03d7d93/b3a70b2c492dc9904de5be1ad9389bd79b87f82c. This issue affects some unknown processing of the file signup.php of the component User Registration Endpoint. Executing a manipulation of the argument email/name/gender can lead to sql injection. The attack may be performed from remote. The exploit has been made available to the public and could be used for attacks. This product utilizes a rolling release system for continuous delivery, and as such, version information for affected or updated releases is not disclosed. The project was informed of the problem early through an issue report but has not responded yet.

References

https://github.com/kishor-23/food-waste-management-system/ URL
https://github.com/kishor-23/food-waste-management-system/issues/5 Third Party Advisory
https://vuldb.com/vuln/413429 Vendor Advisory
https://vuldb.com/cve/CVE-2026-105229 Vendor Advisory
https://vuldb.com/submit/970269 Vendor Advisory
https://vuldb.com/vuln/413429/cti Third Party Advisory
https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/105xxx/CVE-2026-1052... Vendor Advisory
https://nvd.nist.gov/vuln/detail/CVE-2026-105229 Vendor Advisory

Fix within

Internet-facing 14 days

Internal 60 days

Not known to be exploited
Can be exploited automatically
Gives an attacker partial control

Severity

8.4 High

Exploitation

<1% chance of attack within 30 days

Type

CWE-74Injection

CWE-89SQL Injection

Timeline

Published5 Oct 2026

Updated4 Nov 2026

First seen5 Oct 2026

Sources

CVE-2026-105229 · NVD

CVE-2026-105229 · MITRE

CVE-2026-105229 · OSV

Track software like this

Free during beta