CVE-2026-14764
HighCVSS 7.3Exploitation Probability (EPSS)
Low risk18th percentile - higher than 18% of all known CVEs
Summary
A SQL injection vulnerability has been found in the Hotel and Tourism Reservation 1.0 system in the /admin/add_event.php file. An attacker can remotely manipulate the fdetails argument, leading to SQL injection.
Risk Assessment
The risk includes unauthorized database access, data leakage, and potential takeover of the reservation system.
Recommendation
Immediately update the system to the latest version or apply a security patch to prevent SQL injection, e.g., by using parameterized queries.
Other vulnerabilities in Hotel and Tourism Reservation
See all- CVE-2026-14763High
A SQL injection vulnerability has been found in the Hotel and Tourism Reservation 1.0 system in the /admin/tour_reserves.php file. An attacker can remotely manipulate the tour argument, leading to SQL code injection. The exploit has been published and may be used.
- CVE-2026-14762High
A SQL Injection vulnerability was found in Hotel and Tourism Reservation 1.0 in the /admin/rooms.php file. An attacker can remotely manipulate the delete argument, leading to SQL injection. The exploit is publicly available.
- CVE-2026-14756High
A SQL injection vulnerability was found in the Hotel and Tourism Reservation 1.0 system in the file /admin/add_tour.php. Manipulation of the delete_image argument allows SQL injection. The attack can be launched remotely and the exploit is publicly available.
- CVE-2026-14755High
A SQL Injection vulnerability has been found in code-projects Hotel and Tourism Reservation 1.0 in the file /admin/reservations.php. The unknown functionality of the Reservations Management Page allows manipulation of the delete argument, enabling remote SQL injection. The exploit has been publicly disclosed.
- CVE-2026-14754High
A SQL injection vulnerability has been found in Hotel and Tourism Reservation 1.0 in the file /admin/add_room.php. An attacker can remotely manipulate arguments delete_image, edit, description, number, price, rooms, or type, leading to unauthorized database access. The exploit has been published and may be used.
Original NVD description (English source)
A vulnerability has been found in code-projects Hotel and Tourism Reservation 1.0. This impacts an unknown function of the file /admin/add_event.php of the component Event Management Page. Such manipulation of the argument fdetails leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used.