CVE-2026-103231

Name of the Vulnerable Software and Affected Versions AdithyaYelloju Restaurant-Management-System versions prior to 7f0e7e84255e8fcfd488e83f8f91451bbbff6b9c

Description An issue exists in the Order Cancellation component where the mysqli query() function in the User/cancel.php file is susceptible to SQL injection. This occurs when the ID argument is manipulated, allowing a remote attacker to execute unauthorized database queries.

Recommendations As a temporary workaround, restrict access to the User/cancel.php file or avoid using the ID parameter in the Order Cancellation component until a patch is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.