Executive Summary
CVE-2026-115999 is a SQL injection vulnerability in mansi-k Restaurant_IMS at commit d7ad49f61ab7cc1ec6eb359ac2b5378bdbde0694. The flaw is in lsmodal.php, where manipulation of the login_id and epsw arguments leads to SQL injection. It can be exploited remotely.
CVSS Score: 7.3 (High)
Vulnerability Details
| Field | Value |
|---|---|
| CVE ID | CVE-2026-115999 |
| CVSS Score | 7.3 (High) |
| Weakness Class | SQL Injection |
| Attack Vector | Network (Remote) |
| Published | 2026-10-25 |
Impact
Because the injectable parameters belong to the login flow, an attacker may be able to bypass authentication or read and modify data in the application database.
Remediation
- The project appears to follow a rolling-release model; check the repository for a fix and update.
- Replace string-built queries with prepared statements and parameterized queries.
- Restrict access to the application to trusted networks.
- Do not run the database connection with more privileges than the application needs.