# CVE-2026-96514: Neethuharii CafeManagement SQL injection in login handler

Source: https://junglewise.ai/threats/cve-2026-96514-a-weakness-has-been-identified-in-neethuharii-cafemanagement  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-23. Updated: 2026-09-26  
License: CC BY 4.0 with a link back

CVE-2026-96514 · Severity: high · CVSS 7.3 · Published 2026-09-23

Neethuharii CafeManagement is a web-based café management system that handles customer login and account access. An attacker can bypass authentication and gain unauthorized access to user accounts by injecting malicious SQL code into the login form, without requiring any prior credentials.

Technologies: [Neethuharii CafeManagement](https://junglewise.ai/threats/technologies/cafemanagement). Vendors: [Neethuharii](https://junglewise.ai/threats/vendors/neethuharii).

## Quick answers

**Is CVE-2026-96514 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-96514 being exploited in the wild.

**How severe is CVE-2026-96514?** High severity, with a CVSS score of 7.3, published 23 September 2026.

**Which products and versions are affected?** Neethuharii CafeManagement rolling release.

**Is there a fix for CVE-2026-96514?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-96514 attacked?** It is attacked over the network, in a web application.

**Am I affected by CVE-2026-96514?** Check whether you run Neethuharii CafeManagement at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

SQL injection vulnerability in the Login Handler component, specifically in CafePortalLogin.php where the uname parameter is not properly sanitized. The vulnerability is unauthenticated and exploitable over the network; a remote attacker can craft a malicious SQL query to bypass authentication. A public exploit has been released; no fix is currently available from the vendor as the product uses rolling release versioning and the vendor has not responded to disclosure.

## Affected products

- Neethuharii CafeManagement rolling release

## Timeline

- 2026-09-23: disclosed
- other: Exploit made public; vendor non-responsive

## References

- [https://medium.com/@mr.yk404/unauthenticated-sql-injection-leading-to-authentication-bypass-in-cafemanagement-php-e64abc2f52da](https://medium.com/@mr.yk404/unauthenticated-sql-injection-leading-to-authentication-bypass-in-cafemanagement-php-e64abc2f52da)
- [https://vuldb.com/cve/CVE-2026-96514](https://vuldb.com/cve/CVE-2026-96514)

## Related threats

- [Neethuharii CafeManagement missing authentication in account creation](https://junglewise.ai/threats/cve-2026-96556-a-flaw-has-been-found-in-neethuharii-cafemanagement-affected-by)
- [Neethuharii CafeManagement unrestricted file upload in AddProductCode.php](https://junglewise.ai/threats/cve-2026-96513-a-security-flaw-has-been-discovered-in-neethuharii-cafemanagement)