# CVE-2026-94041: AdithyaYelloju Restaurant-Management-System SQL injection in add_menu.php

Source: https://junglewise.ai/threats/cve-2026-94041-a-vulnerability-has-been-found-in-adithyayelloju-restaurant  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-20. Updated: 2026-09-26  
License: CC BY 4.0 with a link back

CVE-2026-94041 · Severity: medium · CVSS 6.3 · Published 2026-09-20

The Restaurant Management System is a web application that manages restaurant operations, including menu items and orders. An authenticated user can inject malicious SQL code through the admin menu addition form, allowing them to insert unauthorized menu items, modify the database, or potentially execute arbitrary code on the server.

Technologies: [AdithyaYelloju Restaurant Management System](https://junglewise.ai/threats/technologies/restaurant-management-system). Vendors: [AdithyaYelloju](https://junglewise.ai/threats/vendors/adithyayelloju).

## Quick answers

**Is CVE-2026-94041 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-94041 being exploited in the wild.

**How severe is CVE-2026-94041?** Medium severity, with a CVSS score of 6.3, published 20 September 2026.

**Which products and versions are affected?** AdithyaYelloju Restaurant Management System up to commit 7f0e7e84255e8fcfd488e83f8f91451bbbff6b9c.

**Is there a fix for CVE-2026-94041?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-94041 attacked?** It is attacked over the network.

**Am I affected by CVE-2026-94041?** Check whether you run AdithyaYelloju Restaurant Management System at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The admin/add_menu.php file concatenates user-supplied POST parameters (item, price, image, type) directly into an SQL INSERT statement without escaping or parameterization. An authenticated attacker can close the VALUES clause and inject additional SQL statements, including arbitrary INSERTs or, if stacked queries are enabled, schema modifications or file writes. The vulnerability requires authentication but affects any logged-in user, including ordinary registered users not just administrators.

## Affected products

- AdithyaYelloju Restaurant-Management-System up to commit 7f0e7e84255e8fcfd488e83f8f91451bbbff6b9c

## Timeline

- 2026-08-26: disclosed: Issue reported on GitHub
- 2026-09-20: advisory: CVE-2026-94041 published

## References

- [https://github.com/AdithyaYelloju/Restaurant-Management-System/](https://github.com/AdithyaYelloju/Restaurant-Management-System/)
- [https://github.com/AdithyaYelloju/Restaurant-Management-System/issues/2](https://github.com/AdithyaYelloju/Restaurant-Management-System/issues/2)

## Related threats

- [AdithyaYelloju Restaurant Management System authorization bypass in Order Management](https://junglewise.ai/threats/cve-2026-109116-a-vulnerability-was-determined-in-adithyayelloju-restaurant)
- [AdithyaYelloju Restaurant-Management-System account takeover in password reset](https://junglewise.ai/threats/cve-2026-109115-a-vulnerability-was-found-in-adithyayelloju-restaurant)
- [AdithyaYelloju Restaurant-Management-System authentication bypass in login form](https://junglewise.ai/threats/cve-2026-109114-a-vulnerability-has-been-found-in-adithyayelloju-restaurant)
- [AdithyaYelloju Restaurant-Management-System authorization bypass in admin panel](https://junglewise.ai/threats/cve-2026-103233-a-security-vulnerability-has-been-detected-in-adithyayelloju)
- [AdithyaYelloju Restaurant-Management-System SQL injection in table_booking.php](https://junglewise.ai/threats/cve-2026-103232-a-weakness-has-been-identified-in-adithyayelloju-restaurant)