CVE-2026-10288
HighCVSS 7.3Exploitation Probability (EPSS)
Low risk40th percentile - higher than 40% of all known CVEs
Summary
In code-projects Hotel and Tourism Reservation System 1.0, the password_verify function in /admin/login.php improperly authenticates the Password argument, leading to improper authentication. The attack is remotely exploitable. The exploit is public.
Risk Assessment
An attacker can bypass admin authentication and gain full access to the reservation system's admin panel, potentially leading to data theft or sabotage.
Recommendation
Upgrade to the latest version or apply a vendor patch. Temporarily restrict access to /admin/login.php.
Other vulnerabilities in Hotel and Tourism Reservation System
See all- CVE-2026-10290High
In code-projects Hotel and Tourism Reservation System 1.0, SQL injection vulnerability exists in tour.php. A remote attacker can manipulate the GET parameter 'tour', leading to SQL injection. The exploit is publicly available.
- CVE-2026-10289Medium
A security flaw in code-projects Hotel and Tourism Reservation System 1.0 in file /ht/tour.php allows cross site scripting via manipulation of arguments name, email, people, number. Remote attack is possible and exploit is public.
Original NVD description (English source)
A vulnerability was identified in code-projects Hotel and Tourism Reservation System 1.0. This issue affects the function password_verify of the file /admin/login.php of the component Admin Login. Such manipulation of the argument Password leads to improper authentication. It is possible to launch the attack remotely. The exploit is publicly available and might be used.