CVE-2026-105168

MediumCVSS 6.3

Published: 05/10/2026(UTC)Updated: 06/10/2026(UTC)Translated: 05/10/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.20%

9th percentile - higher than 9% of all known CVEs

Summary

A SQL injection vulnerability was identified in kishor-23 food-waste-management-system (commit 411989e3ecb82895e53dca7865f72145f03d7d93/b3a70b2c492dc9904de5be1ad9389bd79b87f82c) in an unknown function of admin/admin.php (Order Assignment Block component). Manipulating the order_id/delivery_person_id arguments leads to SQL injection. The attack can be initiated remotely and the exploit is publicly available. The product uses a rolling release, so no version details are available. The project was informed but has not responded.

Risk Assessment

This vulnerability allows remote execution of arbitrary SQL queries, potentially leading to data leakage or modification. The lack of response from the project increases the risk of no patches.

Recommendation

Manually fix the code in admin/admin.php by using parameterized queries and input validation. Until fixed, restrict access to the administrative panel.

Other vulnerabilities in kishor-23 food-waste-management-system

CVE-2026-105171Medium
A vulnerability was detected in kishor-23 food-waste-management-system (commit 411989e3ecb82895e53dca7865f72145f03d7d93/b3a70b2c492dc9904de5be1ad9389bd79b87f82c) in an unknown functionality of admin/admin.php (Role Attribute Handler component). Manipulating the Name argument leads to authorization bypass. The attack can be launched remotely and the exploit has been publicly disclosed. The product does not use versioning, so affected and unaffected releases are unavailable. Multiple endpoints are affected. The project was informed but has not responded.

Original NVD description (English source)

A vulnerability was identified in kishor-23 food-waste-management-system 411989e3ecb82895e53dca7865f72145f03d7d93/b3a70b2c492dc9904de5be1ad9389bd79b87f82c. This affects an unknown function of the file admin/admin.php of the component Order Assignment Block. The manipulation of the argument order_id/delivery_person_id leads to sql injection. It is possible to initiate the attack remotely. The exploit is publicly available and might be used. This product is using a rolling release to provide continious delivery. Therefore, no version details for affected nor updated releases are available. The project was informed of the problem early through an issue report but has not responded yet.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS