CVE-2026-86284
MediumCVSS 5.3Exploitation Probability (EPSS)
Low risk25th percentile - higher than 25% of all known CVEs
Summary
A security vulnerability has been detected in jaychouchannel Tourism-Management-System up to 8122bf020d91199eddfff3ee02d1632a70a9a132. Affected by this vulnerability is the function getOption of the file travel/src/main/java/com/controller/CommonController.java. The manipulation of the argument tableName/columnName leads to information disclosure. The attack may be initiated remotely. The exploit has been disclosed publicly and may be used. The identifier of the patch is d44ec3aa0bd2a72c8800e3befb0a9a96a6491b86.
Risk Assessment
A remote attacker could exploit the vulnerability to gain unauthorized access to database data, potentially leading to information confidentiality breaches.
Recommendation
It is recommended to deploy the patch (identifier d44ec3aa0bd2a72c8800e3befb0a9a96a6491b86) or upgrade to a version that includes it.
Other vulnerabilities in Tourism-Management-System
See all- CVE-2026-90524High
A security flaw has been discovered in jaychouchannel Tourism-Management-System in the Update Endpoint component. Manipulation leads to missing authentication, allowing remote attacks. The exploit has been released and a patch is available.
- CVE-2026-90523High
A vulnerability was identified in jaychouchannel Tourism-Management-System in the User Register Endpoint component (UsersController.java). Manipulation of the UsersEntity argument leads to improper privilege management, allowing remote attacks. The exploit is publicly available and a patch exists.
- CVE-2026-90522High
A vulnerability was determined in jaychouchannel Tourism-Management-System in the resetPass function of UsersController.java (Password Recovery component). Manipulation causes weak password recovery, allowing remote attacks. The exploit has been publicly disclosed and a patch is available.
- CVE-2026-90521Medium
A vulnerability was found in jaychouchannel Tourism-Management-System up to 8122bf020d91199eddfff3ee02d1632a70a9a132. This issue affects some unknown processing of the file MenpiaodingdanController.java of the component CRUD. The manipulation of the argument ID results in authorization bypass. It is possible to launch the attack remotely. The exploit has been made public and could be used. This product takes the approach of rolling releases to provide continious delivery. Therefore, version details for affected and updated releases are not available. The patch is identified as d44ec3aa0bd2a72c8800e3befb0a9a96a6491b86. It is best practice to apply a patch to resolve this issue.
- CVE-2026-90520Medium
A vulnerability was found in jaychouchannel Tourism-Management-System in AuthorizationInterceptor.java of the Authorization Interceptor component. Manipulation leads to improper authorization and the attack can be launched remotely. The exploit has been publicly disclosed and may be used.
- CVE-2026-86282High
A weakness has been identified in jaychouchannel Tourism-Management-System up to commit 8122bf020d91199eddfff3ee02d1632a70a9a132. An unknown function in file travel/src/main/java/com/controller/CommonController.java of component CommonDao is affected. Manipulating arguments table/column/xColumn/yColumn can lead to SQL injection. The attack can be launched remotely and the exploit has been made public. The product does not use versioning, but a patch d44ec3aa0bd2a72c8800e3befb0a9a96a6491b86 is available.
Original NVD description (English source)
A security vulnerability has been detected in jaychouchannel Tourism-Management-System up to 8122bf020d91199eddfff3ee02d1632a70a9a132. Affected by this vulnerability is the function getOption of the file travel/src/main/java/com/controller/CommonController.java. The manipulation of the argument tableName/columnName leads to information disclosure. The attack may be initiated remotely. The exploit has been disclosed publicly and may be used. This product uses a rolling release model to deliver continuous updates. As a result, specific version information for affected or updated releases is not available. The identifier of the patch is d44ec3aa0bd2a72c8800e3befb0a9a96a6491b86. To fix this issue, it is recommended to deploy a patch.