CVE-2026-10290
HighCVSS 7.3Exploitation Probability (EPSS)
Low risk24th percentile - higher than 24% of all known CVEs
Summary
In code-projects Hotel and Tourism Reservation System 1.0, SQL injection vulnerability exists in tour.php. A remote attacker can manipulate the GET parameter 'tour', leading to SQL injection. The exploit is publicly available.
Risk Assessment
An attacker can gain unauthorized access to the database, steal or modify data, compromising system integrity.
Recommendation
Apply parameterized SQL queries or prepared statements in tour.php. Immediately update the system to a secure version.
Other vulnerabilities in Hotel and Tourism Reservation System
See all- CVE-2026-10289Medium
A security flaw in code-projects Hotel and Tourism Reservation System 1.0 in file /ht/tour.php allows cross site scripting via manipulation of arguments name, email, people, number. Remote attack is possible and exploit is public.
- CVE-2026-10288High
In code-projects Hotel and Tourism Reservation System 1.0, the password_verify function in /admin/login.php improperly authenticates the Password argument, leading to improper authentication. The attack is remotely exploitable. The exploit is public.
Original NVD description (English source)
A weakness has been identified in code-projects Hotel and Tourism Reservation System 1.0. The affected element is an unknown function of the file tour.php of the component GET Parameter Handler. Executing a manipulation of the argument tour can lead to sql injection. The attack can be launched remotely. The exploit has been made available to the public and could be used for attacks.