food-waste-management-system CVE-2026-105233

Exploitation requires the attacker to first set or predict a session identifier and then induce a legitimate user to authenticate through login.php while that fixed PHPSESSID is in effect (reflected in UI:P/UI:R). The core precondition is the application's failure to regenerate the session ID upon successful login. Limiting factors: the attack cannot succeed without victim login interaction, impacts are confined to a single user's session rather than system-wide compromise, and the affected software is a niche GitHub project unlikely to be deployed in production environments.

This is a genuinely low-priority issue despite a moderate 5.3 CVSS score. The CVSS 4.0 vector (AV:N/AC:L/PR:N/UI:P) shows network-reachable, low-complexity, unauthenticated access but requires user interaction (the victim must log in using an attacker-planted PHPSESSID), and all impacts are rated Low (VC:L/VI:L/VA:L). The vendor-supplied vector also carries E:P (Proof-of-Concept exploit maturity), consistent with the publicly disclosed exploit. No EPSS score and no SSVC decision were provided; the CVE is NOT on the CISA KEV list, so there is no evidence of active exploitation - only publicly available exploit code exists (a GitHub issue report). The affected product is an obscure, unversioned student/hobby GitHub project ('kishor-23/food-waste-management-system') with no apparent enterprise deployment, which sharply constrains real-world risk regardless of the CVSS number. Signals are consistent (POC exists, no KEV, low impacts), so there is no major conflict; the main caveat is that EPSS is missing, so widespread-exploitation probability cannot be quantified. Net: a real but minor session-fixation weakness in a low-footprint product, not an urgent patching priority for most organizations.

An attacker crafts a login URL or request that fixes a known PHPSESSID value and lures a victim to authenticate to the food-waste-management-system through it; because login.php does not regenerate the session identifier after authentication, the attacker then reuses the same PHPSESSID to ride the victim's now-authenticated session. A public proof-of-concept is referenced via the project's GitHub issue tracker, and the attack is network-remote but depends on the victim completing a login (UI:P).