Is CVE-2026-105232 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-105232 being exploited in the wild.

How severe is CVE-2026-105232?

High severity, with a CVSS score of 7.3, published 5 October 2026.

Which products and versions are affected?

Kishor-23 Food-Waste-Management-System commit b3a70b2c492dc9904de5be1ad9389bd79b87f82c and earlier.

How is CVE-2026-105232 attacked?

It is attacked over the network, in a web application.

Am I affected by CVE-2026-105232?

Check whether you run Kishor-23 Food-Waste-Management-System at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-105232: food-waste-management-system SQL injection in registration page

CVE-2026-105232 · Severity: high · CVSS 7.3 · Published 2026-10-05

A food donation web application contains a SQL injection vulnerability in its delivery registration form that allows unauthenticated attackers to extract sensitive data from the database, including user passwords and personal information. The vulnerability can also be exploited to insert malicious records into the system. An attacker can remotely exploit this flaw without any authentication or user interaction.

Technologies: Kishor-23 Food-Waste-Management-System. Vendors: Kishor-23.

Quick answers

Is CVE-2026-105232 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-105232 being exploited in the wild.
How severe is CVE-2026-105232?: High severity, with a CVSS score of 7.3, published 5 October 2026.
Which products and versions are affected?: Kishor-23 Food-Waste-Management-System commit b3a70b2c492dc9904de5be1ad9389bd79b87f82c and earlier.
Is there a fix for CVE-2026-105232?: No fixed version is recorded yet. Apply prepared statements to all SQL queries and implement allowlist validation for district/location parameters; configure the database account with least-privilege permissions to limit the scope of data an attacker can access. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-105232 attacked?: It is attacked over the network, in a web application.
Am I affected by CVE-2026-105232?: Check whether you run Kishor-23 Food-Waste-Management-System at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Apply prepared statements to all SQL queries and implement allowlist validation for district/location parameters; configure the database account with least-privilege permissions to limit the scope of data an attacker can access.

Technical details

Unauthenticated boolean-based blind SQL injection exists in delivery/deliverysignup.php where POST parameters (username, email, location) are directly interpolated into SQL queries without sanitization. The vulnerability manifests in both a SELECT query that checks for duplicate emails and an INSERT query for registration; observable TRUE/FALSE responses to different SQL payloads enable character-by-character database extraction. An attacker can extract arbitrary database contents including password hashes and personal data, and inject arbitrary records into the delivery_persons table.

Affected products

kishor-23 food-waste-management-system commit b3a70b2c492dc9904de5be1ad9389bd79b87f82c and earlier

Timeline

2026-09-11: disclosed: Vulnerability reported as GitHub issue #14
2026-10-05: advisory: CVE-2026-105232 published

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.