CVE-2026-90523
HighCVSS 7.3Summary
A vulnerability was identified in jaychouchannel Tourism-Management-System in the User Register Endpoint component (UsersController.java). Manipulation of the UsersEntity argument leads to improper privilege management, allowing remote attacks. The exploit is publicly available and a patch exists.
Risk Assessment
An attacker can remotely register an account with elevated privileges, leading to privilege escalation and unauthorized access. The risk is high due to the public exploit.
Recommendation
Apply the patch named 84d8ec384f669df3985293dab293bb7b477efa64. Also verify privileges during user registration.
Other vulnerabilities in Tourism-Management-System
See all- CVE-2026-90524High
A security flaw has been discovered in jaychouchannel Tourism-Management-System in the Update Endpoint component. Manipulation leads to missing authentication, allowing remote attacks. The exploit has been released and a patch is available.
- CVE-2026-90522High
A vulnerability was determined in jaychouchannel Tourism-Management-System in the resetPass function of UsersController.java (Password Recovery component). Manipulation causes weak password recovery, allowing remote attacks. The exploit has been publicly disclosed and a patch is available.
- CVE-2026-90521Medium
A vulnerability was found in jaychouchannel Tourism-Management-System up to 8122bf020d91199eddfff3ee02d1632a70a9a132. This issue affects some unknown processing of the file MenpiaodingdanController.java of the component CRUD. The manipulation of the argument ID results in authorization bypass. It is possible to launch the attack remotely. The exploit has been made public and could be used. This product takes the approach of rolling releases to provide continious delivery. Therefore, version details for affected and updated releases are not available. The patch is identified as d44ec3aa0bd2a72c8800e3befb0a9a96a6491b86. It is best practice to apply a patch to resolve this issue.
- CVE-2026-90520Medium
A vulnerability was found in jaychouchannel Tourism-Management-System in AuthorizationInterceptor.java of the Authorization Interceptor component. Manipulation leads to improper authorization and the attack can be launched remotely. The exploit has been publicly disclosed and may be used.
- CVE-2026-86284Medium
A security vulnerability has been detected in jaychouchannel Tourism-Management-System up to 8122bf020d91199eddfff3ee02d1632a70a9a132. Affected by this vulnerability is the function getOption of the file travel/src/main/java/com/controller/CommonController.java. The manipulation of the argument tableName/columnName leads to information disclosure. The attack may be initiated remotely. The exploit has been disclosed publicly and may be used. The identifier of the patch is d44ec3aa0bd2a72c8800e3befb0a9a96a6491b86.
- CVE-2026-86282High
A weakness has been identified in jaychouchannel Tourism-Management-System up to commit 8122bf020d91199eddfff3ee02d1632a70a9a132. An unknown function in file travel/src/main/java/com/controller/CommonController.java of component CommonDao is affected. Manipulating arguments table/column/xColumn/yColumn can lead to SQL injection. The attack can be launched remotely and the exploit has been made public. The product does not use versioning, but a patch d44ec3aa0bd2a72c8800e3befb0a9a96a6491b86 is available.
Original NVD description (English source)
A vulnerability was identified in jaychouchannel Tourism-Management-System up to 229956e20dbd4a80eeff14535e44d3099502af09. The affected element is an unknown function of the file travel/src/main/java/com/controller/UsersController.java of the component User Register Endpoint. Such manipulation of the argument UsersEntity leads to improper privilege management. The attack can be launched remotely. The exploit is publicly available and might be used. This product does not use versioning. This is why information about affected and unaffected releases are unavailable. The name of the patch is 84d8ec384f669df3985293dab293bb7b477efa64. Applying a patch is advised to resolve this issue.