Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
2.1
CVE-2026-95868: AdithyaYelloju Restaurant Management System search form permits remote data access
CVE-2026-95868 · published 26 days ago
Summary
The search feature in the restaurant management system does not check the information you type before sending it to the database. Because of this, a remote attacker could craft a request that runs their own commands on the database, potentially viewing or changing restaurant data. Fix the problem by adding proper checks on user input or applying an updated version from the project, and restrict access to the admin area to trusted users only.
What to do
The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.
Affected software
| Vendor | Product | Affected versions |
|---|---|---|
| adithyayelloju | restaurant-management-system | 7f0e7e84255e8fcfd488e83f8f91451bbbff6b9c |
Original advisory text
AdithyaYelloju Restaurant-Management-System Search Form display_menu.php mysqli_query sql injection
A weakness has been identified in AdithyaYelloju Restaurant-Management-System up to 7f0e7e84255e8fcfd488e83f8f91451bbbff6b9c. Affected by this issue is the function mysqli_query of the file admin/display_menu.php of the component Search Form. This manipulation of the argument s1 causes sql injection. The attack can be initiated remotely. The exploit has been made available to the public and could be used for attacks. Continious delivery with rolling releases is used by this product. Therefore, no version details of affected nor updated releases are available. The project was informed of the problem early through an issue report but has not responded yet.
References
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/95xxx/CVE-2026-95868... Vendor Advisory
- https://nvd.nist.gov/vuln/detail/CVE-2026-95868 Vendor Advisory
- https://github.com/AdithyaYelloju/Restaurant-Management-System/
- https://vuldb.com/vuln/408542
- https://vuldb.com/vuln/408542/cti
- https://vuldb.com/cve/CVE-2026-95868
- https://vuldb.com/submit/953178
- https://github.com/AdithyaYelloju/Restaurant-Management-System/issues/4
Internet-facing
60 days
Internal
At next upgrade
- Not known to be exploited
- Needs hands-on effort to exploit
- Gives an attacker partial control
Type
CWE-74Injection
CWE-89SQL Injection
Timeline
Published23 Sep 2026
Updated19 Oct 2026
First seen23 Sep 2026
Track software like this
Free during beta