CVE-2026-4014 is a SQL injection flaw in itsourcecode Cafe Reservation System 1.0, scored CVSS 7.3. The Username field on the signup page is not handled safely. The record cites no vendor fix, so remove the application or isolate it and fix the query yourself.
What's affected
- Affected: Cafe Reservation System 1.0 from itsourcecode, file /curvus2/signup.php, the Registration component
- Fixed version: none is named in the record or the references I checked
The record states that remote exploitation is possible and that details have been published. The references are a public issue report and VulDB entries. I did not find a vendor advisory, so do not assume a patch exists.
How to check if you're exposed
Check whether this software is in use. Look for the install path in your web roots:
find /var/www -type d -name curvus2 2>/dev/null
If it is present, look at signup.php and see whether the Username value is placed straight into a SQL string. Review web logs for odd requests to the signup page.
What to do now
- Decide whether you still need the application. Sample project code is a common source of this issue.
- If you must keep it, change the signup query to use prepared statements with bound parameters.
- Place it behind authentication or take it off the internet.
- Review the database for accounts or rows you did not create.
- Run a scan of the code with your usual tooling to find other queries built from request values.
Why it matters
The weakness is CWE-89, SQL injection, with the broader CWE-74. When user input becomes part of a query string, it can change what the query does. Prepared statements keep data and query structure apart.
Small applications distributed as source projects rarely get maintainer fixes, so ownership of the fix falls to whoever deploys them. The record does not flag this CVE as exploited in the wild, though it says a public proof exists.
Quick check
Is there an official patch?
None is named in the record or its references. Check the vendor site, and plan on fixing the code or retiring the app.
Sources
Last reviewed: 19 October 2026.
