CVE-2026-105232: SQL Injection in kishor-23 food-waste-management-system

This vulnerability involves SQL injection in an unknown function within delivery/deliverysignup.php of the kishor-23 food-waste-management-system. Manipulating input parameters such as username, email, or location can lead to unauthorized SQL commands being executed. The product uses continuous delivery with rolling releases, so no fixed or affected versions are specified. The vulnerability is remotely exploitable without authentication and has a CVSS 4.0 base score of 6.9 (medium severity). An exploit is publicly available, but there is no evidence of active exploitation in the wild. The vendor has been notified but has not issued a patch or response.

Successful exploitation can allow an unauthenticated remote attacker to perform SQL injection attacks, potentially leading to unauthorized data access or modification. The vulnerability impacts the Registration Page component and could compromise the integrity and confidentiality of the backend database. The medium CVSS score reflects the moderate risk posed by this vulnerability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the vendor has not responded and no patches are available, users should monitor official channels for updates. Until a fix is provided, restricting access to the vulnerable endpoint or implementing web application firewall (WAF) rules to detect and block SQL injection attempts may help mitigate risk.