Is CVE-2026-103232 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-103232 being exploited in the wild.

How severe is CVE-2026-103232?

High severity, with a CVSS score of 7.3, published 30 September 2026.

Which products and versions are affected?

AdithyaYelloju Restaurant Management System up to commit 7f0e7e84255e8fcfd488e83f8f91451bbbff6b9c.

Is there a fix for CVE-2026-103232?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-103232 attacked?

It is attacked over the network, in a web application.

Am I affected by CVE-2026-103232?

Check whether you run AdithyaYelloju Restaurant Management System at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-103232: AdithyaYelloju Restaurant-Management-System SQL injection in table_booking.php

CVE-2026-103232 · Severity: high · CVSS 7.3 · Published 2026-09-30

The Restaurant Management System is a web-based application that manages restaurant operations including orders and table bookings. An SQL injection vulnerability in the table booking function allows unauthenticated attackers to extract sensitive data such as admin credentials and user records with plaintext passwords, or potentially execute arbitrary code on the web server.

Technologies: AdithyaYelloju Restaurant Management System. Vendors: AdithyaYelloju.

Quick answers

Is CVE-2026-103232 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-103232 being exploited in the wild.
How severe is CVE-2026-103232?: High severity, with a CVSS score of 7.3, published 30 September 2026.
Which products and versions are affected?: AdithyaYelloju Restaurant Management System up to commit 7f0e7e84255e8fcfd488e83f8f91451bbbff6b9c.
Is there a fix for CVE-2026-103232?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-103232 attacked?: It is attacked over the network, in a web application.
Am I affected by CVE-2026-103232?: Check whether you run AdithyaYelloju Restaurant Management System at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The vulnerability exists in admin/table_booking.php and User/table_booking.php where the $_POST['name'] parameter is directly interpolated into a mysqli_query SQL statement without escaping or parameterized queries. No authentication is required, as the affected endpoints do not check session status. An attacker can inject arbitrary SQL via UNION-based or boolean-based payloads to extract database contents or, when combined with stacked queries or SELECT...INTO OUTFILE, achieve remote code execution.

Affected products

AdithyaYelloju Restaurant-Management-System up to commit 7f0e7e84255e8fcfd488e83f8f91451bbbff6b9c

Timeline

2026-08-26: disclosed: Issue reported on GitHub
2026-09-30: advisory: CVE-2026-103232 published

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.