CVE-2026-114441
HighCVSS 7.3Exploitation Probability (EPSS)
Low risk27th percentile - higher than 27% of all known CVEs
Summary
php-travel-agency-system (oretnom23) in admin/update.php contains an SQL injection vulnerability via manipulation of the action, full_name, visa_no, hiden, title, description, page_id, and user arguments. The attack can be launched remotely and the exploit is publicly available.
Risk Assessment
An attacker can execute arbitrary SQL queries, potentially leading to data disclosure, modification, or deletion. The project has not responded to the report, and version details are unavailable due to the rolling release model.
Recommendation
Implement input validation and parameterized SQL queries in admin/update.php. Until fixed, consider restricting access to the administrative panel.
Other vulnerabilities in php-travel-agency-system
See all- CVE-2026-114577High
In oretom23 php-travel-agency-system, admin/insert.php in the Insertion Handler is vulnerable to SQL injection via manipulation of the costomer_id, payment_type, amount, description, user, uploadimage, full_name, and visa_no arguments. The attack can be launched remotely, a public exploit is available, and the project has not responded to the report.
- CVE-2026-114440High
php-travel-agency-system (oretnom23) in admin/delete.php contains an SQL injection vulnerability via manipulation of the costomer_id, ticket_id, payment_id, id, document_id, salary_id, emp_id, and user_id arguments. The attack can be launched remotely and the exploit is publicly available.
- CVE-2026-114439High
A vulnerability was determined in oretnom23 php-travel-agency-system. Affected is some unknown functionality of the file admin/session.php of the Session Handler component. Manipulation of the user_id argument can lead to missing authentication. The attack can be launched remotely, and the exploit has been publicly disclosed.
Original NVD description (English source)
A weakness has been identified in oretnom23 php-travel-agency-system. This issue affects some unknown processing of the file admin/update.php. This manipulation of the argument action/full_name/visa_no/hiden/title/description/page_id/user causes sql injection. The attack may be initiated remotely. The exploit has been made available to the public and could be used for attacks. This product uses a rolling release model to deliver continuous updates. As a result, specific version information for affected or updated releases is not available. The project was informed of the problem early through an issue report but has not responded yet.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS