Is CVE-2026-13498 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-13498 being exploited in the wild.

How severe is CVE-2026-13498?

High severity, with a CVSS score of 7.3, published 28 June 2026.

Which products and versions are affected?

Yashpokharna2555 Restaurent-Management-System All versions (unversioned).

Is there a fix for CVE-2026-13498?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-13498 attacked?

It is attacked over the network, in a network appliance.

Am I affected by CVE-2026-13498?

Check whether you run Yashpokharna2555 Restaurent-Management-System at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-13498: yashpokharna2555 restaurent-management-system SQL injection in forgotpassword.php

CVE-2026-13498 · Severity: high · CVSS 7.3 · Published 2026-06-28

A security vulnerability exists in the Restaurant Management System's password reset feature. This flaw allows an unauthorized person to manipulate database queries by entering specially crafted email addresses. If exploited, an attacker could gain unauthorized access to sensitive customer data or disrupt the system's operations.

Vendors: Yashpokharna2555.

Quick answers

Is CVE-2026-13498 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-13498 being exploited in the wild.
How severe is CVE-2026-13498?: High severity, with a CVSS score of 7.3, published 28 June 2026.
Which products and versions are affected?: Yashpokharna2555 Restaurent-Management-System All versions (unversioned).
Is there a fix for CVE-2026-13498?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-13498 attacked?: It is attacked over the network, in a network appliance.
Am I affected by CVE-2026-13498?: Check whether you run Yashpokharna2555 Restaurent-Management-System at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A SQL injection vulnerability exists in yashpokharna2555 restaurent-management-system due to the improper neutralization of special elements in the 'email' POST parameter within /forgotpassword.php. The application uses direct string concatenation to build SQL queries for both SELECT and UPDATE operations in the password reset flow, failing to use prepared statements or parameterized queries. A remote, unauthenticated attacker can exploit this by sending a crafted POST request to trigger boolean-based or time-based blind SQL injection. This allows for the extraction of data from the backend MySQL database and potentially broader system compromise, as similar patterns are reported in other authentication-related files like login_register.php and admin.php. No patch is currently available as the maintainer has not responded to the issue report.

Affected products

yashpokharna2555 restaurent-management-system All versions (unversioned)

Timeline

2026-05-27: disclosed: Issue reported on GitHub repository
2026-06-28: advisory: CVE published by VulDB/NVD

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.