CVE-2026-13499 is a medium severity cross-site scripting vulnerability in the yashpokharna2555 restaurent-management-system. It affects an unspecified function in login_register.php related to user registration. An attacker can remotely exploit this by manipulating the Username parameter, leading to XSS. The product's rolling release model means no discrete affected versions are known. The vendor has not issued a patch or official remediation guidance as of the publication date.

Successful exploitation allows an attacker to execute arbitrary scripts in the context of the affected web application via the Username parameter. This can lead to user session hijacking, defacement, or other client-side attacks. The vulnerability requires user interaction (UI:P) and has low complexity (AC:L), with no privileges or authentication required (PR:N, AT:N).

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the vendor has not responded or provided a fix, users should monitor for updates from the vendor. Until a fix is available, consider applying input validation or output encoding on the Username parameter as a temporary mitigation if possible.