Food Waste Management CVE-2026-105229

No special conditions beyond having a reachable, internet-facing instance: the vulnerable signup.php User Registration Endpoint is a public, pre-authentication form, and the email, name, and gender request parameters are passed into a SQL query without proper sanitization, matching AV:N/AC:L/PR:N/UI:N. Limiting factors are purely practical - the application must actually be deployed and network-accessible, and realistic impact is bounded to the Low-rated confidentiality/integrity/availability of a single application database; the product's rolling-release model means no patched version is published, and the project has not responded to the reporting GitHub issue.

This is a SQL injection flaw (CWE-74) in the signup.php user-registration endpoint of the kishor-23 food-waste-management-system, an open-source GitHub hobby project. The supplied CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N, VC:L/VI:L/VA:L) scores 5.5 (Medium) and models remote, unauthenticated, low-complexity exploitation with only Low confidentiality/integrity/availability impact to the vulnerable system and no subsequent-system impact - the E:P flag confirms a proof-of-concept exploit, not active exploitation. Signals are mostly consistent: easy network reach and a public POC push risk upward, while the Low impact ratings and the product's near-zero deployment footprint pull real-world priority sharply down. No EPSS score and no CISA KEV entry were provided, so there is no evidence of widespread or targeted exploitation; the public POC (VulDB) raises opportunistic scanning risk but does not equal in-the-wild use. Note a mild tension: SQL injection in an authentication/registration table often enables full database read/write, which would typically justify higher than VC:L/VI:L - the CNA (VulDB) likely rated impact conservatively, so verify actual database exposure against the specific code. Overall this is a genuine but low-priority issue dominated by the product's rarity rather than by severity.

A remote, unauthenticated attacker submits the public registration form at signup.php and injects SQL metacharacters into the email, name, or gender parameters, which are concatenated into a backend query without sanitization. A public proof-of-concept exploit exists (VulDB), lowering the skill needed to extract or manipulate database contents such as stored user records.