Is CVE-2026-105229 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-105229 being exploited in the wild.

How severe is CVE-2026-105229?

High severity, with a CVSS score of 7.3, published 5 October 2026.

How is CVE-2026-105229 attacked?

It is attacked over the network, in a web application.

Am I affected by CVE-2026-105229?

Check whether you run Kishor-23 Food-Waste-Management-System. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-105229: kishor-23 food-waste-management-system SQL injection in signup.php

CVE-2026-105229 · Severity: high · CVSS 7.3 · Published 2026-10-05

A web application for managing food donations contains a critical SQL injection vulnerability in its user registration endpoint. An unauthenticated attacker can manipulate email, name, or gender fields to extract the entire database including user credentials and personal information, or modify records. The underlying database runs as the root user with no password, allowing an attacker to compromise the entire MySQL server.

Technologies: Kishor-23 Food-Waste-Management-System. Vendors: Kishor-23.

Quick answers

Is CVE-2026-105229 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-105229 being exploited in the wild.
How severe is CVE-2026-105229?: High severity, with a CVSS score of 7.3, published 5 October 2026.
Which products and versions are affected?: kishor-23 food-waste-management-system.
Is there a fix for CVE-2026-105229?: No fixed version is recorded yet. Use prepared statements (mysqli_stmt_* or PDO) for all database queries; validate email format server-side; connect to the database as a non-root user with minimal privileges; display generic error messages and disable display_errors in production.</anigation> <parameter name="timeline">[{"kind": "disclosed", "at": "2026-09-09"}, {"kind": "advisory", "at": "2026-10-05"}] If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-105229 attacked?: It is attacked over the network, in a web application.
Am I affected by CVE-2026-105229?: Check whether you run Kishor-23 Food-Waste-Management-System. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Use prepared statements (mysqli_stmt_* or PDO) for all database queries; validate email format server-side; connect to the database as a non-root user with minimal privileges; display generic error messages and disable display_errors in production.</anigation> <parameter name="timeline">[{"kind": "disclosed", "at": "2026-09-09"}, {"kind": "advisory", "at": "2026-10-05"}]

Technical details

The signup.php endpoint concatenates unsanitized POST parameters directly into SQL queries without prepared statements or escaping, creating a boolean-based blind SQL injection vulnerability exploitable by any anonymous visitor. The vulnerable code inserts values from $_POST['email'], $_POST['name'], and $_POST['gender'] directly into SELECT and INSERT statements. An attacker can dump the entire database through a time-independent oracle or modify arbitrary records; the escalation to MySQL root privileges enables further compromise of other databases on the server.

Affected products

kishor-23 food-waste-management-system

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.