Restaurant Management System CVE-2026-95868

Requires reaching the Search Form on admin/display_menu.php, which is part of the application's admin area, and the CVSS vector specifies PR:L - so exploitation needs at least low-privilege authenticated access to that admin functionality; it cannot be triggered by a fully anonymous internet user against the default front-end. Given that gate, the attacker manipulates the s1 search parameter to inject SQL into the underlying mysqli_query call. Limiting factors: authenticated access to the admin panel, and the niche/hobby nature of the software mean few real-world instances are exposed. No user interaction is required (UI:N).

This is a genuine SQL injection (CWE-89) but a low-priority one across every signal. The vendor CVSS 4.0 base score is only 2.1, driven by PR:L (the vulnerable admin/display_menu.php sits behind the admin panel), AT:N/AC:L, and impacts capped at VC:L/VI:L/VA:L - the assessor judged the injection to yield only limited confidentiality/integrity/availability effect rather than full database compromise (a conservative and arguably understated rating for SQLi, which frequently permits full data extraction). Publicly available exploit code exists (referenced via the project's own GitHub issue #4), and the E:P (Proof-of-Concept) temporal metric in the vector reflects that - but POC availability is not active exploitation, and there is no KEV listing and no EPSS score provided. The dominant risk-limiter is prevalence: this is an obscure individual-developer GitHub project (AdithyaYelloju/Restaurant-Management-System), not deployed enterprise software, so real-world attack surface is tiny. Net: a real, exploit-proven bug but effectively low real-world risk - no widespread-exploitation signal, low CVSS, niche footprint. Note the reporting caveat: rolling-release with no version numbers and an unresponsive maintainer, so there is no patched release to point to.

An attacker with access to the application's admin panel submits a crafted value in the s1 search-form parameter of admin/display_menu.php; because the input is concatenated into a mysqli_query call, the attacker injects SQL to read or manipulate menu/database data. A public proof-of-concept exists (linked from the project's GitHub issue tracker), lowering the skill needed to reproduce it, though exploitation requires reaching the authenticated admin search feature.