Menulux Software Inc. vulnerabilities

Products

• Menulux Portal 4
• Mobile App 2

Latest Menulux Software Inc. CVEs

Newest publication first

1. CVE-2026-19080 Username Enumeration in Menulux Software's Menulux Portal

   Published 2026-09-04

   High·CVSS 7.5 EPSS 0.42%

   Observable response discrepancy vulnerability in Menulux Software Inc. Menulux Portal allows Account Footprinting. This issue affects Menulux Portal: before 20260903211448.

2. CVE-2026-19051 Plaintext Storage of User Credentials in Menulux Software's Menulux Portal

   Published 2026-09-04

   High·CVSS 7.1 EPSS 0.29%

   Plaintext storage of a password vulnerability in Menulux Software Inc. Menulux Portal allows Retrieve Embedded Sensitive Data. This issue affects Menulux Portal: before 20260903211448.

3. CVE-2026-19043 Authorization Bypass Critical POS Management Functions in Menulux Software's Menulux Portal

   Published 2026-09-04

   Medium·CVSS 4.3 EPSS 0.27%

   Missing Authorization vulnerability in Menulux Software Inc. Menulux Portal allows Accessing Functionality Not Properly Constrained by ACLs. This issue affects Menulux Portal: before 20260903211448.

4. CVE-2026-18957 Stored XSS in Menulux Software's Menulux Portal

   Published 2026-09-04

   Medium·CVSS 5.4 EPSS 0.23%

   Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Menulux Software Inc. Menulux Portal allows Stored XSS. This issue affects Menulux Portal: before 20260903211448.

5. CVE-2026-2346 IDOR in Menulux Software's Mobile App

   Published 2026-08-03

   Critical·CVSS 9.8 EPSS 0.51%

   Authorization bypass through User-Controlled key vulnerability in Menulux Software Inc. Mobile App allows Software Integrity Attack. This issue affects Mobile App: through 12.05.2026.

6. CVE-2025-13474 IDOR in Menulux Software's Mobile App

   Published 2025-12-16

   High·CVSS 7.5 EPSS 0.30%

   Authorization Bypass Through User-Controlled Key vulnerability in Menulux Software Inc. Mobile App allows Exploitation of Trusted Identifiers. This issue affects Mobile App: before 9.5.8.

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.