CVE-2026-109116 is an authorization bypass vulnerability in the AdithyaYelloju Restaurant-Management-System affecting the Order Management component. The flaw arises from manipulation of the ID argument in the mysqli_query function, allowing remote attackers to bypass authorization controls. The product does not use versioning, so affected versions cannot be precisely identified. The vulnerability has a medium severity with a CVSS score of 6.9. The issue was reported early to the project, but no response or patch has been provided yet. Exploit details have been publicly disclosed, though no active exploitation in the wild is currently known.
CVE-2026-109115 is a SQL injection vulnerability in the AdithyaYelloju Restaurant-Management-System affecting the Password Reset component (User/forgot3.php). It allows remote attackers to manipulate the email/password argument to perform SQL injection. The vulnerability has a medium severity with a CVSS score of 6.9. No specific affected versions or patches are available due to the product's continuous delivery model. The vendor has been informed but has not responded yet.
A vulnerability has been found in AdithyaYelloju Restaurant-Management-System up to 7f0e7e84255e8fcfd488e83f8f91451bbbff6b9c. This vulnerability affects unknown code of the file User/login.php of the component Login Form. Such manipulation of the argument email/passwd leads to improper authentication. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. This product takes the approach of rolling releases to provide continious delivery. Therefore, version details for affected and updated releases are not available. The project was informed of the problem early through an issue report but has not responded yet.
CVE-2026-103233 is an authorization bypass vulnerability in the Admin Area of the AdithyaYelloju Restaurant-Management-System. It affects versions up to commit 7f0e7e84255e8fcfd488e83f8f91451bbbff6b9c. The flaw involves manipulation of the ID argument in the /admin/ component, allowing remote attackers to bypass authorization controls. The vulnerability has been publicly disclosed, but no patch or vendor response has been reported yet.
A weakness has been identified in AdithyaYelloju Restaurant-Management-System up to 7f0e7e84255e8fcfd488e83f8f91451bbbff6b9c. This affects the function mysqli_query of the file admin/table_booking.php. This manipulation of the argument Name causes sql injection. Remote exploitation of the attack is possible. The exploit has been made available to the public and could be used for attacks. The project was informed of the problem early through an issue report but has not responded yet.
CVE-2026-103231 is a medium severity SQL injection vulnerability in the AdithyaYelloju Restaurant-Management-System affecting the Order Cancellation component. The flaw exists in the mysqli_query function within User/cancel.php, where manipulation of the ID argument can lead to SQL injection. The vulnerability can be exploited remotely without authentication. Although the issue was reported early to the project, no response or fix has been provided yet. Public exploit code is available, but no known active exploitation has been reported.
CVE-2026-103230 is a SQL injection vulnerability in the AdithyaYelloju Restaurant-Management-System affecting the Order Placement component. The flaw exists in the mysqli_query function within User/ord.php and can be exploited remotely by manipulating the id or name arguments. The vulnerability has a medium severity score of 6.9 and has been publicly disclosed. No patch or remediation has been provided by the vendor as of the publication date.
A vulnerability was found in AdithyaYelloju Restaurant-Management-System up to 7f0e7e84255e8fcfd488e83f8f91451bbbff6b9c. This issue affects the function mysqli_query of the file admin/delete1.php of the component Unauthenticated Action Script. Performing a manipulation of the argument ID results in sql injection. The attack can be initiated remotely. The exploit has been made public and could be used. Continious delivery with rolling releases is used by this product. Therefore, no version details of affected nor updated releases are available. The project was informed of the problem early through an issue report but has not responded yet.
A weakness has been identified in AdithyaYelloju Restaurant-Management-System up to 7f0e7e84255e8fcfd488e83f8f91451bbbff6b9c. Affected by this issue is the function mysqli_query of the file admin/display_menu.php of the component Search Form. This manipulation of the argument s1 causes sql injection. The attack can be initiated remotely. The exploit has been made available to the public and could be used for attacks. Continious delivery with rolling releases is used by this product. Therefore, no version details of affected nor updated releases are available. The project was informed of the problem early through an issue report but has not responded yet.
A vulnerability was found in AdithyaYelloju Restaurant Management System up to 7f0e7e84255e8fcfd488e83f8f91451bbbff6b9c. This affects the function mysqli_query of the file admin/add_table.php. The manipulation of the argument table/members/price results in sql injection. It is possible to launch the attack remotely. The exploit has been made public and could be used. This product takes the approach of rolling releases to provide continious delivery. Therefore, version details for affected and updated releases are not available. The project was informed of the problem early through an issue report but has not responded yet.
CVE-2026-94041 is a medium-severity SQL injection vulnerability in the AdithyaYelloju Restaurant-Management-System. The flaw exists in the admin/add_menu.php file where manipulation of the item, price, image, or type parameters can lead to SQL injection. The vulnerability can be exploited remotely without user interaction. The project uses a rolling release model, so no specific affected or fixed versions are identified. The issue was reported early to the project but no response or patch has been provided yet. Public exploit details are available, but no known active exploitation in the wild has been confirmed.