Tag

Code-Projects

2 briefs RSS

CVE-2026-14756: SQL Injection in code-projects Hotel and Tourism Reservation

A remote SQL injection vulnerability (CVE-2026-14756) exists in code-projects Hotel and Tourism Reservation version 1.0, allowing unauthenticated attackers to exploit improper input sanitization in the `delete_image` parameter of `/admin/add_tour.php` to bypass authentication, extract sensitive data, or manipulate database records, with a public exploit available.

exploited Hotel and Tourism Reservation 1.0 sql-injection web-application cve code-projects

1r 3t 1c 6i 1d ago

high advisory

CVE-2026-14754: SQL Injection in code-projects Hotel and Tourism Reservation

1 rule 1 TTP 1 CVE

A critical SQL injection vulnerability (CVE-2026-14754) in code-projects Hotel and Tourism Reservation 1.0's `/admin/add_room.php` file allows a remote, unauthenticated attacker to manipulate arguments such as `delete_image`, `edit`, `description`, `number`, `price`, `rooms`, or `type` to execute arbitrary SQL commands, leading to sensitive data exposure and potential database compromise.

Hotel and Tourism Reservation 1.0 sql-injection web-application cve code-projects remote-code-execution

1r 1t 1c 1d ago