CVE-2026-54419
CriticalCVSS 9.8Exploitation Probability (EPSS)
Low risk45th percentile - higher than 45% of all known CVEs
Summary
PIAF-HMS (PBX-In-A-Flash Hotel Management System) contains multiple unauthenticated SQL injection vulnerabilities. The application has no authentication mechanism and passes user-supplied HTTP parameters directly into deprecated mysql_query calls via string concatenation, without sanitization, escaping, or parameterization.
Risk Assessment
An attacker can manipulate database queries without authentication, potentially leading to data leakage, modification, or deletion, and possibly full system compromise.
Recommendation
Immediately implement authentication and authorization, and use parameterized queries or an ORM. It is also recommended to stop using the system until it is fixed.
Original NVD description (English source)
claudiopizzillo PIAF-HMS (PBX-In-A-Flash Hotel Management System; no released versions, latest commit 389d2633441b65ced1c104212cd62be2bfca21e5) contains multiple unauthenticated SQL injection vulnerabilities. The application has no authentication mechanism and passes user-supplied HTTP parameters directly into deprecated mysql_query calls via string concatenation, without sanitization, escaping, or parameterization.