CVE-2026-1599

low-risk

Published 2026-01-29

A vulnerability was determined in Bdtask Bhojon All-In-One Restaurant Management System up to 20260116. The affected element is an unknown function of the file /hungry/placeorder of the component Checkout. Executing a manipulation of the argument orggrandTotal/vat/service_charge/grandtotal can lead to business logic errors. It is possible to launch the attack remotely. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure but did not respond in any way.

Do I need to act?

0.02% chance of exploitation

EPSS score — low exploit probability

Not on CISA KEV list

No confirmed active exploitation reported to CISA

Patch status unknown

Check vendor advisories for fix availability and mitigation guidance

CVSS 4.3/10 Medium

NETWORK / LOW complexity

Affected Products (1)

Bhojon

Affected Vendors

Bdtask

References (5)

Exploit https://github.com/4m3rr0r/PoCVulDb/issues/13

Permissions Required https://vuldb.com/?ctiid.343361

Third Party Advisory https://vuldb.com/?id.343361

Third Party Advisory https://vuldb.com/?submit.740740

Exploit https://www.youtube.com/watch?v=n7xLBAOrKAU

/ 100

low-risk

Severity 18/34 · Moderate

Exploitability 0/34 · Minimal

Exposure 5/34 · Minimal