Restaurant_IMS: SQL injection in lsmodal.php (CVE-2026-115999)
A SQL injection vulnerability exists in the Restaurant_IMS application, where manipulation of the login_id or epsw arguments in the lsmodal.php file leads to SQL injection.
CVE search metadata
CVE search record: CVE-2026-115999. Severity: high. CVSS: 7.3. KEV: no. Product: Restaurant_IMS (commit d7ad49f61ab7cc1ec6eb359ac2b5378bdbde0694). Brief: Restaurant_IMS: SQL injection in lsmodal.php (CVE-2026-115999). Brief link: https://feed.craftedsignal.io/briefs/2026-10-restaurant-ims-sqli/
Triage facts
Revision 1- Applicability
- Restaurant_IMS (commit d7ad49f61ab7cc1ec6eb359ac2b5378bdbde0694)
- Evidence
- Unknown
- Severity
- High
- Sources
- 1 public source
- Freshness
- Revision 1Oct 25, 04:25 UTC
- Vulnerabilities
- 1 CVE
- Source quality
- A2Roughly even chance
A vulnerability has been found in mansi-k Restaurant_IMS commit d7ad49f61ab7cc1ec6eb359ac2b5378bdbde0694. The function mysqli_connect in lsmodal.php is affected. Manipulation of the login_id or epsw arguments allows for SQL injection. Remote exploitation is possible. The vendor was contacted but did not respond. No version details are provided due to the project's rolling release approach.