Restaurant Management System EUVD-2026-83760

Requires an authenticated session on the AdithyaYelloju Restaurant-Management-System admin interface (PR:L) - the vulnerable code path admin/add_menu.php is an administrative menu-creation page, not a public endpoint. Exploitation is remote over the network with low complexity and no user interaction, achieved by injecting SQL through the item, price, image, or type parameters. Limiting factors: attacker must first obtain low-privilege admin panel access, and the product is a niche self-hosted project with no version pinning (rolling release), so exposure depends entirely on the rare deployment being internet-reachable.

This is a classic low-real-world-priority finding despite being a genuine SQL injection. The vendor CVSS 4.0 vector (CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L, base 5.3) with E:P (proof-of-concept exploit maturity) is internally consistent with the description: remotely reachable, low complexity, but requiring low-privilege authentication (PR:L) since admin/add_menu.php is an authenticated administrative page. No EPSS score is provided and the CVE is NOT in CISA KEV, so there is no signal of active exploitation - only publicly available POC code (the GitHub issue report). The one metric I would dispute is the confidentiality/integrity impact: a working SQL injection typically permits full database dump and record tampering, so VC:H/VI:H would be more defensible than the vendor's VC:L/VI:L, which understates technical impact - however, this is offset by the requirement to already hold an admin-panel session. The dominant risk-reducer here is prevalence, not the vector: this is a hobbyist GitHub project (rolling release, vendor unresponsive to the issue report), so exploitation would be opportunistic against the rare individual deployment rather than a fleet target. Net: real bug, low real-world priority.

An attacker with access to the restaurant admin panel (or having obtained low-privilege admin credentials) submits a crafted item, price, image, or type parameter to admin/add_menu.php, injecting SQL that the backend concatenates unsanitized into a query. Publicly available POC exists via the vendor's GitHub issue #2, lowering the skill barrier. The attacker dumps or tampers with the backend database (menu, user, or credential tables).