Is CVE-2026-96514 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-96514 being exploited in the wild.

How severe is CVE-2026-96514?

High severity, with a CVSS score of 7.3, published 23 September 2026.

Which products and versions are affected?

Neethuharii CafeManagement rolling release.

Is there a fix for CVE-2026-96514?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-96514 attacked?

It is attacked over the network, in a web application.

Am I affected by CVE-2026-96514?

Check whether you run Neethuharii CafeManagement at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-96514: Neethuharii CafeManagement SQL injection in login handler

CVE-2026-96514 · Severity: high · CVSS 7.3 · Published 2026-09-23

Neethuharii CafeManagement is a web-based café management system that handles customer login and account access. An attacker can bypass authentication and gain unauthorized access to user accounts by injecting malicious SQL code into the login form, without requiring any prior credentials.

Technologies: Neethuharii CafeManagement. Vendors: Neethuharii.

Quick answers

Is CVE-2026-96514 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-96514 being exploited in the wild.
How severe is CVE-2026-96514?: High severity, with a CVSS score of 7.3, published 23 September 2026.
Which products and versions are affected?: Neethuharii CafeManagement rolling release.
Is there a fix for CVE-2026-96514?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-96514 attacked?: It is attacked over the network, in a web application.
Am I affected by CVE-2026-96514?: Check whether you run Neethuharii CafeManagement at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

SQL injection vulnerability in the Login Handler component, specifically in CafePortalLogin.php where the uname parameter is not properly sanitized. The vulnerability is unauthenticated and exploitable over the network; a remote attacker can craft a malicious SQL query to bypass authentication. A public exploit has been released; no fix is currently available from the vendor as the product uses rolling release versioning and the vendor has not responded to disclosure.

Affected products

Neethuharii CafeManagement rolling release

Timeline

2026-09-23: disclosed
other: Exploit made public; vendor non-responsive

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.