CVE-2026-105231: SQL Injection in kishor-23 food-waste-management-system

This vulnerability in kishor-23 food-waste-management-system allows remote attackers to perform SQL injection via manipulated input parameters (email, username, location) in the admin/signup.php file's Admin Registration component. The vulnerability enables injection of malicious SQL commands due to insufficient input sanitization or parameterization. The product uses rolling releases, so no explicit versioning information is provided. The vendor has been informed but has not issued a response or patch. Exploit code is publicly available, increasing risk.

Successful exploitation can lead to unauthorized SQL queries on the backend database, potentially exposing or modifying sensitive data. The vulnerability requires no privileges or user interaction and can be exploited remotely. The CVSS 4.0 score of 6.9 reflects a medium severity with network attack vector, low complexity, and no required privileges or user interaction. The impact includes limited confidentiality, integrity, and availability impacts.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the vendor has not responded or issued a fix, users should monitor the vendor's communications for updates. In the meantime, restricting access to the admin/signup.php endpoint and employing web application firewalls with SQL injection detection rules may help mitigate exploitation risk.