Live › vulnerability › CVE-2026-115999
Go to dashboardThe Restaurant_IMS project by mansi-k has an SQL injection flaw in the lsmodal.php file, where the login_id and epsw arguments are not sanitized before reaching a mysqli query. A remote attacker can send crafted input to read or change data in the application's database.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-25 04:02 UTC. All times on this page are UTC.
Teams that run the mansi-k Restaurant_IMS application from this commit or a similar snapshot, where lsmodal.php is reachable over the web. The sources say the product uses a rolling release and the vendor did not respond, so no patched version is known. Teams that do not run this project can skip it.
| Product | Ecosystem | Affected | Fixed in |
|---|---|---|---|
| Restaurant_IMS | other | commit d7ad49f61ab7cc1ec6eb359ac2b5378bdbde0694 (rolling release, other commits unknown) | – |
git rev-parse HEAD in the checkout: commit d7ad49f61ab7cc1ec6eb359ac2b5378bdbde0694 is the one named in the CVEEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
A vulnerability has been found in mansi-k Restaurant_IMS d7ad49f61ab7cc1ec6eb359ac2b5378bdbde0694. Affected is the function mysqli_connect of the file lsmodal.php. The manipulation of the argument login_id/epsw leads to sql injection. Remote exploitation of the attack is possible. This product follows a rolling release approach for continuous delivery, so version details for affected or updated releases are not provided. The vendor was contacted early about this disclosure but did not respond in any way.
This page as .md · .json · in your agent: get_signal("CVE-2026-115999")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.