Is CVE-2026-105233 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-105233 being exploited in the wild.

How severe is CVE-2026-105233?

Medium severity, with a CVSS score of 6.3, published 5 October 2026.

Which products and versions are affected?

Kishor-23 Food-Waste-Management-System all (no versioning).

Is there a fix for CVE-2026-105233?

No fixed version is recorded yet. Call session_regenerate_id(true) immediately after successful credential verification in all login handlers before storing role data. Enable session.use_strict_mode=1 in PHP configuration to reject unrecognized session IDs. [{"kind": "disclosed", "at": "2026-09-11", "note": "Security researcher ThanatosXingYu opened issue #16 on GitHub"}, {"kind": "advisory", "at": "2026-10-05"}] If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-105233 attacked?

It is attacked over the network.

Am I affected by CVE-2026-105233?

Check whether you run Kishor-23 Food-Waste-Management-System at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-105233: kishor-23 food-waste-management-system session fixation in login

CVE-2026-105233 · Severity: medium · CVSS 6.3 · Published 2026-10-05

The food-waste-management-system is a web application that manages food donations. A session fixation vulnerability in the login functionality allows an attacker to pre-set a victim's session ID, log in as that victim, and maintain full account access without knowing their password. An attacker could gain unauthorized access to user, admin, or delivery accounts and steal sensitive data or manipulate food donation records.

Technologies: Kishor-23 Food-Waste-Management-System. Vendors: Kishor-23.

Quick answers

Is CVE-2026-105233 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-105233 being exploited in the wild.
How severe is CVE-2026-105233?: Medium severity, with a CVSS score of 6.3, published 5 October 2026.
Which products and versions are affected?: Kishor-23 Food-Waste-Management-System all (no versioning).
Is there a fix for CVE-2026-105233?: No fixed version is recorded yet. Call session_regenerate_id(true) immediately after successful credential verification in all login handlers before storing role data. Enable session.use_strict_mode=1 in PHP configuration to reject unrecognized session IDs.</anigation> <parameter name="timeline">[{"kind": "disclosed", "at": "2026-09-11", "note": "Security researcher ThanatosXingYu opened issue #16 on GitHub"}, {"kind": "advisory", "at": "2026-10-05"}] If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-105233 attacked?: It is attacked over the network.
Am I affected by CVE-2026-105233?: Check whether you run Kishor-23 Food-Waste-Management-System at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Call session_regenerate_id(true) immediately after successful credential verification in all login handlers before storing role data. Enable session.use_strict_mode=1 in PHP configuration to reject unrecognized session IDs.</anigation> <parameter name="timeline">[{"kind": "disclosed", "at": "2026-09-11", "note": "Security researcher ThanatosXingYu opened issue #16 on GitHub"}, {"kind": "advisory", "at": "2026-10-05"}]

Technical details

The login handlers (signin.php, admin/signin.php, delivery/deliverylogin.php) call session_start() and authenticate within the same session without regenerating the session ID via session_regenerate_id(). Combined with PHP's default acceptance of externally supplied session IDs (session.use_strict_mode=0), an attacker can preset the PHPSESSID cookie, trick a victim into logging in, and then reuse the same session ID to assume the victim's authenticated identity. The attack requires user interaction (victim login) and network access to deliver the crafted link, but grants complete account takeover.

Affected products

kishor-23 food-waste-management-system all (no versioning)

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.