CVE-2026-105171

MediumCVSS 6.3

Published: 05/10/2026(UTC)Updated: 06/10/2026(UTC)Translated: 05/10/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.22%

11th percentile - higher than 11% of all known CVEs

Summary

A vulnerability was detected in kishor-23 food-waste-management-system (commit 411989e3ecb82895e53dca7865f72145f03d7d93/b3a70b2c492dc9904de5be1ad9389bd79b87f82c) in an unknown functionality of admin/admin.php (Role Attribute Handler component). Manipulating the Name argument leads to authorization bypass. The attack can be launched remotely and the exploit has been publicly disclosed. The product does not use versioning, so affected and unaffected releases are unavailable. Multiple endpoints are affected. The project was informed but has not responded.

Risk Assessment

This vulnerability allows remote authorization bypass, potentially leading to unauthorized access to administrative functions. The lack of response from the project increases the risk of no patches.

Recommendation

Manually review and fix the code in admin/admin.php by implementing role-based access control. Until fixed, restrict access to the administrative panel.

Other vulnerabilities in kishor-23 food-waste-management-system

CVE-2026-105168Medium
A SQL injection vulnerability was identified in kishor-23 food-waste-management-system (commit 411989e3ecb82895e53dca7865f72145f03d7d93/b3a70b2c492dc9904de5be1ad9389bd79b87f82c) in an unknown function of admin/admin.php (Order Assignment Block component). Manipulating the order_id/delivery_person_id arguments leads to SQL injection. The attack can be initiated remotely and the exploit is publicly available. The product uses a rolling release, so no version details are available. The project was informed but has not responded.

Original NVD description (English source)

A security vulnerability has been detected in kishor-23 food-waste-management-system 411989e3ecb82895e53dca7865f72145f03d7d93/b3a70b2c492dc9904de5be1ad9389bd79b87f82c. Affected by this vulnerability is an unknown functionality of the file admin/admin.php of the component Role Attribute Handler. Such manipulation of the argument Name leads to authorization bypass. The attack can be launched remotely. The exploit has been disclosed publicly and may be used. This product does not use versioning. This is why information about affected and unaffected releases are unavailable. Multiple endpoints are affected. The project was informed of the problem early through an issue report but has not responded yet.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS