CVE-2026-115999

HighCVSS 7.3/10Last modified Oct 25, 2026

Description

A vulnerability has been found in mansi-k Restaurant_IMS d7ad49f61ab7cc1ec6eb359ac2b5378bdbde0694. Affected is the function mysqli_connect of the file lsmodal.php. The manipulation of the argument login_id/epsw leads to sql injection. Remote exploitation of the attack is possible. This product follows a rolling release approach for continuous delivery, so version details for affected or updated releases are not provided. The vendor was contacted early about this disclosure but did not respond in any way.

Metrics

CVSS 3.1 7.3/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

Weakness enumeration

CWE-74CWE-89

Affected software

Source: the vendor's advisory (CNA). NVD analysis pending.

VendorProductVersions
mansi-kRestaurant_IMSd7ad49f61ab7cc1ec6eb359ac2b5378bdbde0694

References

Timeline

Published
Oct 25, 2026
Last modified
Oct 25, 2026
NVD status
Received

Related CVEs from 2026

CVE-2026-11609.8A security vulnerability has been detected in PHPGurukul Directory Management System 1.0. Impacted is an unknown function of the file /indexCVE-2026-116004.3The Envo's Templates & Widgets for Elementor and WooCommerce plugin for WordPress is vulnerable to unauthorized access of data due to a missCVE-2026-1160084.3DaybydayCRM through 2.2.1 contains a missing authorization vulnerability in ProjectsController::updateAssign() that allows any authenticatedCVE-2026-1160098.8Camaleon CMS before 2.9.3 contains a path traversal vulnerability that allows users with only the media permission to write arbitrary files CVE-2026-116015.3The WPCafe – Restaurant Menu, Online Food Ordering & Table Booking System plugin for WordPress is vulnerable to authorization bypass in all CVE-2026-1160104.3RosarioSIS before 12.9.1 contains a missing authorization vulnerability that allows authenticated teachers to write records for students outCVE-2026-1160117.5Crow before 1.3.4 contains an uncontrolled recursion vulnerability in crow::json::load() that allows remote unauthenticated attackers to craCVE-2026-1160123.6Ghidra before 12.2 contains a numeric truncation vulnerability in PackedDecode::skipAttribute and skipAttributeRemaining in marshal.cc that CVE-2026-1160133.7OpenResty lua-resty-dns before 0.24 contains an improper input validation vulnerability in parse_section() and _decode_name() that fails to CVE-2026-1160148.1open62541 1.5.0 before 1.5.7 contains an integer overflow in UA_DataType_fromStructureDescription() that wraps the 16-bit memSize field for CVE-2026-1160154.3yudao-cloud through 2026.09 contains an insecure direct object reference vulnerability in the mall trade module that allows authenticated meCVE-2026-1160167.1yudao-cloud through 2026.09 contains an authorization bypass vulnerability that allows authenticated users to evade row-level data scope res