CVE-2026-114440
HighCVSS 7.3Exploitation Probability (EPSS)
Low risk27th percentile - higher than 27% of all known CVEs
Summary
php-travel-agency-system (oretnom23) in admin/delete.php contains an SQL injection vulnerability via manipulation of the costomer_id, ticket_id, payment_id, id, document_id, salary_id, emp_id, and user_id arguments. The attack can be launched remotely and the exploit is publicly available.
Risk Assessment
An attacker can execute arbitrary SQL queries, potentially leading to data disclosure, modification, or deletion. The project has not responded to the report, and version details are unavailable due to the rolling release model.
Recommendation
Implement input validation and parameterized SQL queries in admin/delete.php. Until fixed, consider restricting access to the administrative panel.
Other vulnerabilities in php-travel-agency-system
See all- CVE-2026-114577High
In oretom23 php-travel-agency-system, admin/insert.php in the Insertion Handler is vulnerable to SQL injection via manipulation of the costomer_id, payment_type, amount, description, user, uploadimage, full_name, and visa_no arguments. The attack can be launched remotely, a public exploit is available, and the project has not responded to the report.
- CVE-2026-114441High
php-travel-agency-system (oretnom23) in admin/update.php contains an SQL injection vulnerability via manipulation of the action, full_name, visa_no, hiden, title, description, page_id, and user arguments. The attack can be launched remotely and the exploit is publicly available.
- CVE-2026-114439High
A vulnerability was determined in oretnom23 php-travel-agency-system. Affected is some unknown functionality of the file admin/session.php of the Session Handler component. Manipulation of the user_id argument can lead to missing authentication. The attack can be launched remotely, and the exploit has been publicly disclosed.
Original NVD description (English source)
A vulnerability was identified in oretnom23 php-travel-agency-system. This affects an unknown part of the file admin/delete.php. The manipulation of the argument costomer_id/ticket_id/payment_id/id/document_id/salary_id/emp_id/user_id leads to sql injection. The attack can be initiated remotely. The exploit is publicly available and might be used. Continious delivery with rolling releases is used by this product. Therefore, no version details of affected nor updated releases are available. The project was informed of the problem early through an issue report but has not responded yet.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS