Restaurant Management System
Monthly
Authorization bypass in the AdithyaYelloju Restaurant-Management-System lets remote attackers manipulate the user-controlled 'ID' argument processed by mysqli_query in the Order Management component to reach order records that belong to other users (CWE-639 / IDOR). No authentication or user interaction is required (CVSS PR:N/UI:N), and the impact is bounded to individual order records with Low confidentiality, integrity, and availability effects and no scope change. Publicly available exploit code exists (the CVSS 4.0 vector carries E:P and a public GitHub issue details the flaw), though there is no confirmed active exploitation (not in CISA KEV); real-world exposure is limited primarily by the project's negligible deployment footprint rather than by any technical barrier.
Unauthenticated SQL injection in the AdithyaYelloju Restaurant-Management-System password-reset endpoint (User/forgot3.php) allows remote attackers to manipulate the email and password parameters and inject arbitrary SQL into backend queries. The flaw sits in the pre-authentication Password Reset component, so no valid account or prior login is required (CVSS:4.0 PR:N, UI:N), and the assessed impact is limited to partial confidentiality, integrity, and availability loss (C:L/I:L/A:L). Publicly available exploit code exists and has been described in the vendor's own issue tracker, but there is no indication of confirmed active exploitation and no vendor-released patch, since the project uses rolling releases and has not responded to the report.
Improper authentication in AdithyaYelloju Restaurant-Management-System (pinned to commit 7f0e7e84255e8fcfd488e83f8f91451bbbff6b9c) allows unauthenticated remote attackers to bypass the login form via crafted email and passwd parameters in User/login.php. Publicly available exploit code exists (referenced in GitHub issue #11), but no confirmed active exploitation (CISA KEV) has been observed. Despite a CVSS 4.0 score of 6.9, real-world risk is moderate-to-low because the project has no versioned releases and essentially no production installations; a successful bypass yields only low confidentiality, integrity, and availability impact.
Authorization bypass in AdithyaYelloju Restaurant-Management-System (commit 7f0e7e8) allows an authenticated low-privileged attacker to manipulate the ID argument in requests to the /admin/ Admin Area endpoint, thereby accessing or altering records belonging to other users. Publicly available exploit code exists, but no active exploitation in the wild has been confirmed. The impact is limited to Low-severity confidentiality and integrity effects, and exploitation requires a deployed instance and valid credentials.
SQL injection in the admin/table_booking.php script of AdithyaYelloju Restaurant Management System (commit 7f0e7e84255e8fcfd488e83f8f91451bbbff6b9c) enables unauthenticated remote attackers to execute arbitrary SQL commands via the 'Name' parameter, potentially compromising data confidentiality and integrity (CVSS 4.0 score 6.9; assessed CVSS 3.1 C:H/I:H/A:L). Publicly available exploit code exists, but the affected codebase is unreleased and pinned to a single commit with no packaged versions and an unresponsive maintainer, making active exploitation unlikely in production environments.
SQL injection in AdithyaYelloju Restaurant-Management-System through commit 7f0e7e84255e8fcfd488e83f8f91451bbbff6b9c allows unauthenticated remote attackers to manipulate the ID argument in User/cancel.php and potentially read or alter order-related database records. Publicly available exploit code exists, and the upstream project has not responded to the issue report, but there is no CISA KEV listing or confirmed active exploitation. The independent assessment rates this as a low-priority, low-impact issue constrained mainly by the scarcity of deployed instances of this unmaintained single-developer project.
Unauthenticated SQL injection in the Order Placement component (User/ord.php) of AdithyaYelloju Restaurant-Management-System lets remote attackers manipulate the id and name arguments passed to mysqli_query, giving them arbitrary read and partial write access to the underlying database. Publicly available exploit code exists (the issue thread linked from the CVE record), and no vendor patch is available because the maintainer has not responded to the report; the vulnerability is not confirmed as actively exploited (no CISA KEV entry). Real-world risk is driven almost entirely by product obscurity rather than defect quality - this is an unversioned, single-commit GitHub project with essentially no production deployments, so any exposed instance running the vulnerable commit is exploitable by default but few such instances are expected to exist.
SQL injection in the AdithyaYelloju Restaurant-Management-System allows remote, unauthenticated attackers to manipulate database queries through the ID parameter of admin/delete1.php, a script the description treats as an unauthenticated action endpoint despite its location under the admin/ directory. Successful exploitation grants low-level confidentiality, integrity, and availability impact on the application's database, and publicly available exploit code exists, raising the likelihood of opportunistic scanning and abuse. The project is distributed via rolling releases with no versioned builds, the maintainer has not responded to the early issue report, so no vendor-released patch is available and every running instance should be considered affected; the practical risk is narrowed by the product's very low deployment footprint and the need for the endpoint to be reachable over the network.
SQL injection in the AdithyaYelloju Restaurant-Management-System allows attackers to manipulate the underlying database through the `s1` search parameter processed by mysqli_query in admin/display_menu.php. Exploitation is gated by the CVSS vector's PR:L rating, meaning an attacker needs at least low-privilege authenticated access to the application's admin area rather than acting as an anonymous internet user. Publicly available exploit code exists (referenced via the project's GitHub issue tracker), but there is no confirmed active exploitation (not in CISA KEV), and the niche, hobby-oriented nature of the software limits real-world exposure. Overall this is a genuine CWE-89 injection but a low-priority finding across every signal.
SQL injection in the admin/add_table.php endpoint of AdithyaYelloju Restaurant Management System allows authenticated attackers to inject arbitrary SQL through the table, members, and price parameters. The vulnerability requires a valid admin session (CVSS PR:L) and has publicly available exploit code, but its low severity score (5.3) and the product's rarity make it a genuine yet low-priority issue; no fixed build exists because the project uses rolling releases and has not responded to the report.
SQL injection in AdithyaYelloju Restaurant Management System allows an authenticated attacker with low-privilege admin panel access to execute arbitrary SQL commands via the item, price, image, or type parameters in admin/add_menu.php, leading to potential data theft or modification. Publicly available exploit code exists, but there is no confirmed active exploitation (CISA KEV); the independent assessment rates confidentiality and integrity impact as high and availability as low. Exploitation requires obtaining an authenticated session on the admin interface, and because the product is a niche self-hosted project with no version pinning, real-world exposure depends on the rare deployment being internet-reachable, making this a low-real-world-priority finding.
A vulnerability was found in itsourcecode Restaurant Management System 1.0. Rated medium severity (CVSS 6.9), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
A vulnerability was found in itsourcecode Restaurant Management System 1.0. Rated medium severity (CVSS 6.9), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
A vulnerability was found in itsourcecode Restaurant Management System 1.0 and classified as critical. Rated medium severity (CVSS 6.9), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
A vulnerability classified as critical was found in itsourcecode Restaurant Management System 1.0. Rated medium severity (CVSS 6.9), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
A vulnerability classified as critical has been found in itsourcecode Restaurant Management System 1.0. Rated medium severity (CVSS 6.9), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
A vulnerability was found in itsourcecode Restaurant Management System 1.0 and classified as critical.php. Rated medium severity (CVSS 6.9), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
A vulnerability has been found in itsourcecode Restaurant Management System 1.0 and classified as critical. Rated medium severity (CVSS 6.9), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
A vulnerability was found in itsourcecode Restaurant Management System 1.0 and classified as critical. Rated medium severity (CVSS 6.9), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
A vulnerability was found in itsourcecode Restaurant Management System 1.0. Rated medium severity (CVSS 6.9), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
itsourcecode Alton Management System 1.0 is vulnerable to SQL Injection in /noncombo_save.php via the "menu" parameter. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
A vulnerability was found in itsourcecode Alton Management System 1.0. Rated medium severity (CVSS 5.1), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
A vulnerability was found in itsourcecode Alton Management System 1.0 and classified as critical. Rated medium severity (CVSS 5.1), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
A vulnerability has been found in itsourcecode Alton Management System 1.0 and classified as critical. Rated medium severity (CVSS 5.1), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
A vulnerability, which was classified as critical, was found in itsourcecode Alton Management System 1.0. Rated medium severity (CVSS 5.1), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
A vulnerability, which was classified as critical, has been found in itsourcecode Alton Management System 1.0.php. Rated medium severity (CVSS 5.1), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
A vulnerability classified as critical was found in itsourcecode Alton Management System 1.0. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
Sourcecodester Restaurant Management System 1.0 allows an authenticated attacker to upload arbitrary files that can result in code execution. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
Sourcecodester Restaurant Management System 1.0 allows XSS via the Last Name field of a member. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
Sourcecodester Restaurant Management System 1.0 allows XSS via the "send a message" screen. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
Sourcecodester Restaurant Management System 1.0 is affected by an admin/staff-exec.php Cross Site Request Forgery vulnerability due to a lack of CSRF protection. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
Authorization bypass in the AdithyaYelloju Restaurant-Management-System lets remote attackers manipulate the user-controlled 'ID' argument processed by mysqli_query in the Order Management component to reach order records that belong to other users (CWE-639 / IDOR). No authentication or user interaction is required (CVSS PR:N/UI:N), and the impact is bounded to individual order records with Low confidentiality, integrity, and availability effects and no scope change. Publicly available exploit code exists (the CVSS 4.0 vector carries E:P and a public GitHub issue details the flaw), though there is no confirmed active exploitation (not in CISA KEV); real-world exposure is limited primarily by the project's negligible deployment footprint rather than by any technical barrier.
Unauthenticated SQL injection in the AdithyaYelloju Restaurant-Management-System password-reset endpoint (User/forgot3.php) allows remote attackers to manipulate the email and password parameters and inject arbitrary SQL into backend queries. The flaw sits in the pre-authentication Password Reset component, so no valid account or prior login is required (CVSS:4.0 PR:N, UI:N), and the assessed impact is limited to partial confidentiality, integrity, and availability loss (C:L/I:L/A:L). Publicly available exploit code exists and has been described in the vendor's own issue tracker, but there is no indication of confirmed active exploitation and no vendor-released patch, since the project uses rolling releases and has not responded to the report.
Improper authentication in AdithyaYelloju Restaurant-Management-System (pinned to commit 7f0e7e84255e8fcfd488e83f8f91451bbbff6b9c) allows unauthenticated remote attackers to bypass the login form via crafted email and passwd parameters in User/login.php. Publicly available exploit code exists (referenced in GitHub issue #11), but no confirmed active exploitation (CISA KEV) has been observed. Despite a CVSS 4.0 score of 6.9, real-world risk is moderate-to-low because the project has no versioned releases and essentially no production installations; a successful bypass yields only low confidentiality, integrity, and availability impact.
Authorization bypass in AdithyaYelloju Restaurant-Management-System (commit 7f0e7e8) allows an authenticated low-privileged attacker to manipulate the ID argument in requests to the /admin/ Admin Area endpoint, thereby accessing or altering records belonging to other users. Publicly available exploit code exists, but no active exploitation in the wild has been confirmed. The impact is limited to Low-severity confidentiality and integrity effects, and exploitation requires a deployed instance and valid credentials.
SQL injection in the admin/table_booking.php script of AdithyaYelloju Restaurant Management System (commit 7f0e7e84255e8fcfd488e83f8f91451bbbff6b9c) enables unauthenticated remote attackers to execute arbitrary SQL commands via the 'Name' parameter, potentially compromising data confidentiality and integrity (CVSS 4.0 score 6.9; assessed CVSS 3.1 C:H/I:H/A:L). Publicly available exploit code exists, but the affected codebase is unreleased and pinned to a single commit with no packaged versions and an unresponsive maintainer, making active exploitation unlikely in production environments.
SQL injection in AdithyaYelloju Restaurant-Management-System through commit 7f0e7e84255e8fcfd488e83f8f91451bbbff6b9c allows unauthenticated remote attackers to manipulate the ID argument in User/cancel.php and potentially read or alter order-related database records. Publicly available exploit code exists, and the upstream project has not responded to the issue report, but there is no CISA KEV listing or confirmed active exploitation. The independent assessment rates this as a low-priority, low-impact issue constrained mainly by the scarcity of deployed instances of this unmaintained single-developer project.
Unauthenticated SQL injection in the Order Placement component (User/ord.php) of AdithyaYelloju Restaurant-Management-System lets remote attackers manipulate the id and name arguments passed to mysqli_query, giving them arbitrary read and partial write access to the underlying database. Publicly available exploit code exists (the issue thread linked from the CVE record), and no vendor patch is available because the maintainer has not responded to the report; the vulnerability is not confirmed as actively exploited (no CISA KEV entry). Real-world risk is driven almost entirely by product obscurity rather than defect quality - this is an unversioned, single-commit GitHub project with essentially no production deployments, so any exposed instance running the vulnerable commit is exploitable by default but few such instances are expected to exist.
SQL injection in the AdithyaYelloju Restaurant-Management-System allows remote, unauthenticated attackers to manipulate database queries through the ID parameter of admin/delete1.php, a script the description treats as an unauthenticated action endpoint despite its location under the admin/ directory. Successful exploitation grants low-level confidentiality, integrity, and availability impact on the application's database, and publicly available exploit code exists, raising the likelihood of opportunistic scanning and abuse. The project is distributed via rolling releases with no versioned builds, the maintainer has not responded to the early issue report, so no vendor-released patch is available and every running instance should be considered affected; the practical risk is narrowed by the product's very low deployment footprint and the need for the endpoint to be reachable over the network.
SQL injection in the AdithyaYelloju Restaurant-Management-System allows attackers to manipulate the underlying database through the `s1` search parameter processed by mysqli_query in admin/display_menu.php. Exploitation is gated by the CVSS vector's PR:L rating, meaning an attacker needs at least low-privilege authenticated access to the application's admin area rather than acting as an anonymous internet user. Publicly available exploit code exists (referenced via the project's GitHub issue tracker), but there is no confirmed active exploitation (not in CISA KEV), and the niche, hobby-oriented nature of the software limits real-world exposure. Overall this is a genuine CWE-89 injection but a low-priority finding across every signal.
SQL injection in the admin/add_table.php endpoint of AdithyaYelloju Restaurant Management System allows authenticated attackers to inject arbitrary SQL through the table, members, and price parameters. The vulnerability requires a valid admin session (CVSS PR:L) and has publicly available exploit code, but its low severity score (5.3) and the product's rarity make it a genuine yet low-priority issue; no fixed build exists because the project uses rolling releases and has not responded to the report.
SQL injection in AdithyaYelloju Restaurant Management System allows an authenticated attacker with low-privilege admin panel access to execute arbitrary SQL commands via the item, price, image, or type parameters in admin/add_menu.php, leading to potential data theft or modification. Publicly available exploit code exists, but there is no confirmed active exploitation (CISA KEV); the independent assessment rates confidentiality and integrity impact as high and availability as low. Exploitation requires obtaining an authenticated session on the admin interface, and because the product is a niche self-hosted project with no version pinning, real-world exposure depends on the rare deployment being internet-reachable, making this a low-real-world-priority finding.
A vulnerability was found in itsourcecode Restaurant Management System 1.0. Rated medium severity (CVSS 6.9), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
A vulnerability was found in itsourcecode Restaurant Management System 1.0. Rated medium severity (CVSS 6.9), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
A vulnerability was found in itsourcecode Restaurant Management System 1.0 and classified as critical. Rated medium severity (CVSS 6.9), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
A vulnerability classified as critical was found in itsourcecode Restaurant Management System 1.0. Rated medium severity (CVSS 6.9), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
A vulnerability classified as critical has been found in itsourcecode Restaurant Management System 1.0. Rated medium severity (CVSS 6.9), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
A vulnerability was found in itsourcecode Restaurant Management System 1.0 and classified as critical.php. Rated medium severity (CVSS 6.9), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
A vulnerability has been found in itsourcecode Restaurant Management System 1.0 and classified as critical. Rated medium severity (CVSS 6.9), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
A vulnerability was found in itsourcecode Restaurant Management System 1.0 and classified as critical. Rated medium severity (CVSS 6.9), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
A vulnerability was found in itsourcecode Restaurant Management System 1.0. Rated medium severity (CVSS 6.9), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
itsourcecode Alton Management System 1.0 is vulnerable to SQL Injection in /noncombo_save.php via the "menu" parameter. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
A vulnerability was found in itsourcecode Alton Management System 1.0. Rated medium severity (CVSS 5.1), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
A vulnerability was found in itsourcecode Alton Management System 1.0 and classified as critical. Rated medium severity (CVSS 5.1), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
A vulnerability has been found in itsourcecode Alton Management System 1.0 and classified as critical. Rated medium severity (CVSS 5.1), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
A vulnerability, which was classified as critical, was found in itsourcecode Alton Management System 1.0. Rated medium severity (CVSS 5.1), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
A vulnerability, which was classified as critical, has been found in itsourcecode Alton Management System 1.0.php. Rated medium severity (CVSS 5.1), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
A vulnerability classified as critical was found in itsourcecode Alton Management System 1.0. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
Sourcecodester Restaurant Management System 1.0 allows an authenticated attacker to upload arbitrary files that can result in code execution. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
Sourcecodester Restaurant Management System 1.0 allows XSS via the Last Name field of a member. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
Sourcecodester Restaurant Management System 1.0 allows XSS via the "send a message" screen. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
Sourcecodester Restaurant Management System 1.0 is affected by an admin/staff-exec.php Cross Site Request Forgery vulnerability due to a lack of CSRF protection. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.