CVE-2026-1600 | Bdtask Bhojon All-In-One Restaurant Management System up to 20260116 Add-to-Cart Submission Endpoint /hungry/addtocart price/allprice logic error

A vulnerability marked as problematic has been reported in Bdtask Bhojon All-In-One Restaurant Management System up to 20260116. The impacted element is an unknown function of the file /hungry/addtocart of the component Add-to-Cart Submission Endpoint. The manipulation of the argument price/allprice leads to business logic errors.

This vulnerability is documented as CVE-2026-1600. The attack can be initiated remotely. Additionally, an exploit exists.

The vendor was contacted early about this disclosure but did not respond in any way.