Is CVE-2026-109115 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-109115 being exploited in the wild.

How severe is CVE-2026-109115?

High severity, with a CVSS score of 7.3, published 13 October 2026.

Which products and versions are affected?

AdithyaYelloju Restaurant Management System up to commit 7f0e7e84255e8fcfd488e83f8f91451bbbff6b9c.

Is there a fix for CVE-2026-109115?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-109115 attacked?

It is attacked over the network, in a web application.

Am I affected by CVE-2026-109115?

Check whether you run AdithyaYelloju Restaurant Management System at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-109115: AdithyaYelloju Restaurant-Management-System account takeover in password reset

CVE-2026-109115 · Severity: high · CVSS 7.3 · Published 2026-10-13

The Restaurant Management System, a PHP-based web application for managing restaurant operations, contains a critical account takeover vulnerability in its password reset feature. An unauthenticated attacker can change any user's password without verification and immediately log in as that user, gaining full control of their account and potentially accessing admin functions. This allows attackers to take over legitimate user and administrator accounts with a single request.

Technologies: AdithyaYelloju Restaurant Management System. Vendors: AdithyaYelloju.

Quick answers

Is CVE-2026-109115 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-109115 being exploited in the wild.
How severe is CVE-2026-109115?: High severity, with a CVSS score of 7.3, published 13 October 2026.
Which products and versions are affected?: AdithyaYelloju Restaurant Management System up to commit 7f0e7e84255e8fcfd488e83f8f91451bbbff6b9c.
Is there a fix for CVE-2026-109115?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-109115 attacked?: It is attacked over the network, in a web application.
Am I affected by CVE-2026-109115?: Check whether you run AdithyaYelloju Restaurant Management System at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The vulnerability is an unverified password change in User/forgot3.php that accepts email and password parameters directly from POST data without authentication, CSRF tokens, or email verification. The vulnerable code performs a SQL UPDATE directly on user-supplied email without confirming the requester's identity. Since passwords are stored in plaintext, a remote unauthenticated attacker can reset any user's password and achieve account takeover.

Affected products

AdithyaYelloju Restaurant-Management-System up to commit 7f0e7e84255e8fcfd488e83f8f91451bbbff6b9c

Timeline

2026-09-01: disclosed: Issue reported on GitHub
2026-10-13: advisory

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.