CafeManagement CVE-2026-96514

Exploitation requires only network reachability to the CafeManagement application's CafePortalLogin.php Login Handler endpoint; the injectable uname parameter is exposed pre-authentication on the login page, so no credentials, user interaction, or non-default configuration are needed (AV:N/AC:L/PR:N/UI:N). The primary limiting factor is exposure: the product is a niche hobby PHP app that is rarely internet-facing in production, and because it is rolling-release with no vendor response there is no patched version to deploy - mitigation depends on WAF/parameterized-query fixes or removing exposure.

Signals conflict on severity. The CVSS 4.0 base vector (AV:N/AC:L/AT:N/PR:N/UI:N) confirms remote, unauthenticated, low-complexity exploitation with no user interaction - the ideal profile for attacker use. VulDB rates impact conservatively at VC:L/VI:L/VA:L (score 5.5), but this is inconsistent with the referenced public exploit, whose title states the flaw yields authentication bypass: a login-handler SQL injection that both reads database contents and defeats access control warrants C:H/I:H, not Low. The E:P (Proof-of-Concept) exploit-maturity flag is corroborated by a public write-up. Countervailing signals lowering real-world priority: no EPSS score is provided to gauge exploitation likelihood, the CVE is NOT in CISA KEV (no confirmed active exploitation), and the product itself is an obscure hobby PHP application with negligible enterprise footprint. Net: technically a high-impact, trivially exploitable unauthenticated SQLi with public exploit code, but the tiny deployment base means it is a targeted/opportunistic risk rather than a widespread threat. The VulDB Low impact rating appears understated versus the auth-bypass claim in the exploit reference - treat the effective impact as higher than the 5.5 score suggests.

An unauthenticated attacker sends a crafted username value to CafePortalLogin.php, injecting SQL into the login query via the uname parameter to bypass authentication and/or extract database contents such as credentials. A public proof-of-concept (Medium write-up by mr.yk404) documents the unauthenticated SQLi-to-authentication-bypass technique, and no interaction from any legitimate user is required (AV:N/AC:L/PR:N/UI:N).