Food Waste Management System CVE-2026-105166

Requires a reachable instance of the Food Waste Management System exposing the Food Donation Form (fooddonateform.php); the attacker manipulates the 'image-choice' argument passed to the insert routine. Per the CVSS vector (PR:N/UI:N), no authentication or user interaction is needed, so any publicly exposed donation form is directly exploitable. The primary limiting factor is deployment: this is a niche hobby project with negligible production exposure, and exploitation presupposes an operator has actually stood up and internet-exposed the application; there is no non-default configuration or special platform requirement beyond a working database-backed deployment.

Signals are mixed and point to a LOW real-world priority despite a medium CVSS. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) describes a remotely reachable, unauthenticated, low-complexity SQL injection, which normally warrants attention - but all three impact metrics are only Low (VC:L/VI:L/VA:L), yielding a modest 6.9. The exploit maturity is E:P (proof-of-concept), consistent with the reported public POC, and there is NO CISA KEV listing, so this is 'publicly available exploit code exists' rather than confirmed active exploitation. No EPSS score was provided in the input, so probabilistic exploitation likelihood cannot be quantified here. The decisive mitigating factor is the target: kishor-23/food-waste-management-system is a small open-source GitHub project with no measurable enterprise footprint, so the attack surface across real production environments is minimal. The vendor has not responded to the issue report, so no patched release is confirmed. Net: a genuine, easily-exploitable SQLi, but low real-world risk driven almost entirely by near-zero deployment prevalence rather than by weak technical exploitability.

An unauthenticated attacker locates an internet-exposed instance of the Food Waste Management System and submits the Food Donation Form, tampering with the 'image-choice' parameter to inject SQL into the insert routine of fooddonateform.php. A public proof-of-concept exists (referenced in the project's GitHub issue tracker), lowering the skill needed; because no authentication or user interaction is required, the request can be sent directly to the form endpoint to read or manipulate database contents.