CVE-2026-109116
AdithyaYelloju Restaurant-Management-System Order Management mysqli_query authorization
- State
- Published
- Severity
- 6.9 Medium
- Published
- Oct 13, 2026
- Updated
- Oct 14, 2026
- Reserved
- Oct 12, 2026
Description
A vulnerability was determined in AdithyaYelloju Restaurant-Management-System up to 7f0e7e84255e8fcfd488e83f8f91451bbbff6b9c. Impacted is the function mysqli_query of the component Order Management. Executing a manipulation of the argument ID can lead to authorization bypass. The attack can be launched remotely. The exploit has been publicly disclosed and may be utilized. This product does not use versioning. This is why information about affected and unaffected releases are unavailable. The project was informed of the problem early through an issue report but has not responded yet.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 4.0 | 6.9 Medium | CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P | VulDB |
| 3.1 | 7.3 High | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:C | VulDB |
| 3.0 | 7.3 High | CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:C | VulDB |
| 2.0 | 7.5 High | AV:N/AC:L/Au:N/C:P/I:P/A:P/E:POC/RL:ND/RC:C | VulDB |
Weaknesses
Affected Products
| Product | Versions |
|---|---|
Restaurant-Management-SystemAdithyaYelloju |
|
References
- VDB-416873 | AdithyaYelloju Restaurant-Management-System Order Management mysqli_query authorizationvdb-entrytechnical-description
- VDB-416873 | CTI Indicators (IOB, IOC, IOA)signaturepermissions-required
- CVE-2026-109116 | CVE Analysis and Reportthird-party-advisory
- Submit #955125 | AdithyaYelloju Restaurant-Management-System 7f0e7e84255e8fcfd488e83f8f91451bbbff6b9c Authorization Bypass Through User-Controlled SQL Primary Keythird-party-advisory
- https://github.com/AdithyaYelloju/Restaurant-Management-System/issues/13exploitissue-tracking
- https://github.com/AdithyaYelloju/Restaurant-Management-System/product
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.