CVE-2026-14756
HighCVSS 7.3Exploitation Probability (EPSS)
Low risk18th percentile - higher than 18% of all known CVEs
Summary
A SQL injection vulnerability was found in the Hotel and Tourism Reservation 1.0 system in the file /admin/add_tour.php. Manipulation of the delete_image argument allows SQL injection. The attack can be launched remotely and the exploit is publicly available.
Risk Assessment
The risk includes unauthorized database access, data leakage, and potential takeover of the reservation system.
Recommendation
Immediately update the system to the latest version or apply a security patch. Additionally, validate and sanitize all input data in the /admin/add_tour.php file.
Other vulnerabilities in Hotel and Tourism Reservation
See all- CVE-2026-14764High
A SQL injection vulnerability has been found in the Hotel and Tourism Reservation 1.0 system in the /admin/add_event.php file. An attacker can remotely manipulate the fdetails argument, leading to SQL injection.
- CVE-2026-14763High
A SQL injection vulnerability has been found in the Hotel and Tourism Reservation 1.0 system in the /admin/tour_reserves.php file. An attacker can remotely manipulate the tour argument, leading to SQL code injection. The exploit has been published and may be used.
- CVE-2026-14762High
A SQL Injection vulnerability was found in Hotel and Tourism Reservation 1.0 in the /admin/rooms.php file. An attacker can remotely manipulate the delete argument, leading to SQL injection. The exploit is publicly available.
- CVE-2026-14755High
A SQL Injection vulnerability has been found in code-projects Hotel and Tourism Reservation 1.0 in the file /admin/reservations.php. The unknown functionality of the Reservations Management Page allows manipulation of the delete argument, enabling remote SQL injection. The exploit has been publicly disclosed.
- CVE-2026-14754High
A SQL injection vulnerability has been found in Hotel and Tourism Reservation 1.0 in the file /admin/add_room.php. An attacker can remotely manipulate arguments delete_image, edit, description, number, price, rooms, or type, leading to unauthorized database access. The exploit has been published and may be used.
Original NVD description (English source)
A vulnerability was found in code-projects Hotel and Tourism Reservation 1.0. Affected by this issue is some unknown functionality of the file /admin/add_tour.php of the component Tour Management Page. The manipulation of the argument delete_image results in sql injection. The attack may be launched remotely. The exploit has been made public and could be used.