Is there a public PoC exploit available for CVE-2026-13498?

Yes, a public proof-of-concept exploit is available for CVE-2026-13498. Prioritise patching immediately. EPSS: 0.3%.

restaurent-management-system CVE-2026-13498

Q: What is the CVSS score of CVE-2026-13498?

CVE-2026-13498 has a CVSS 4.0 base score of 5.5 (Medium). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.3%.

EUVD-2026-39996 MEDIUM

SQL Injection (CWE-89)

2026-06-28 VulDB

GHSA-w8qf-mxqg-vm2x

PHP SQLi Restaurent Management System Yashpokharna2555

5.5

CVSS 4.0 · Vendor: VulDB

Severity by source

Vendor (VulDB) PRIMARY

5.5 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

7.3 HIGH

Unauthenticated pre-auth endpoint exploitable over network with no interaction; partial CIA impact confined to application database, no scope change.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N

Primary rating from Vendor (VulDB).

CVSS VectorVendor: VulDB

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Jun 28, 2026 - 13:30 vuln.today

CVSS changed

Jun 28, 2026 - 13:22 NVD

6.9 (MEDIUM) 5.5 (MEDIUM)

DescriptionCVE.org

A vulnerability was identified in yashpokharna2555 restaurent-management-system. This affects an unknown function of the file /forgotpassword.php of the component POST Parameter Handler. Such manipulation of the argument email leads to sql injection. The attack can be launched remotely. The exploit is publicly available and might be used. This product does not use versioning. This is why information about affected and unaffected releases are unavailable. The project was informed of the problem early through an issue report but has not responded yet.

AnalysisAI

SQL injection in yashpokharna2555's restaurent-management-system exposes the /forgotpassword.php endpoint to unauthenticated remote exploitation via the POST email parameter, allowing attackers to execute arbitrary SQL against the backend database. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) confirms no authentication or preconditions are required, and a public exploit is referenced in GitHub issue #3. The project has no versioning scheme and the maintainer has not responded to the disclosure, meaning no patch is available and all deployed instances remain vulnerable.

Technical ContextAI

This is a PHP web application (tag: PHP) for restaurant management. The root cause is CWE-89 (Improper Neutralization of Special Elements used in an SQL Command), meaning user-supplied input from the POST email parameter in /forgotpassword.php is interpolated directly into a SQL query without parameterization or escaping. This is a pre-authentication code path - password reset flows typically query the user table by email before any session exists, making the injection point accessible to any remote user. The CPE cpe:2.3:a:yashpokharna2555:restaurent-management-system:*:*:*:*:*:*:*:* uses a full wildcard version, consistent with the project's stated absence of versioning - every historical and current revision is considered affected.

RemediationAI

No vendor-released patch has been identified at time of analysis - the project maintainer was notified via an issue report but has not responded. The primary fix requires modifying /forgotpassword.php to replace raw SQL string construction with parameterized prepared statements using PHP's PDO or MySQLi extensions, ensuring the email value is never interpolated directly into query text. As a compensating control, server-side input validation should restrict the email parameter to RFC 5322-compliant format before it reaches any database query, rejecting inputs containing SQL metacharacters. If the application is internet-accessible, restricting the /forgotpassword.php endpoint via WAF rule or web server ACL to trusted IP ranges is an actionable interim measure - note this disables password recovery functionality for affected users. Deployers should also audit adjacent PHP files for similar unsanitized parameter usage, as the pattern is likely systemic in a project of this maturity. References: https://vuldb.com/cve/CVE-2026-13498, https://github.com/yashpokharna2555/restaurent-management-system/issues/3.