CVE-2026-90524
HighCVSS 7.3Summary
A security flaw has been discovered in jaychouchannel Tourism-Management-System in the Update Endpoint component. Manipulation leads to missing authentication, allowing remote attacks. The exploit has been released and a patch is available.
Risk Assessment
An attacker can remotely modify data without authentication, compromising system integrity. Missing authentication increases the risk of unauthorized changes.
Recommendation
Immediately install the patch named 84d8ec384f669df3985293dab293bb7b477efa64. Also implement authentication for the Update endpoint.
Other vulnerabilities in Tourism-Management-System
See all- CVE-2026-90523High
A vulnerability was identified in jaychouchannel Tourism-Management-System in the User Register Endpoint component (UsersController.java). Manipulation of the UsersEntity argument leads to improper privilege management, allowing remote attacks. The exploit is publicly available and a patch exists.
- CVE-2026-90522High
A vulnerability was determined in jaychouchannel Tourism-Management-System in the resetPass function of UsersController.java (Password Recovery component). Manipulation causes weak password recovery, allowing remote attacks. The exploit has been publicly disclosed and a patch is available.
- CVE-2026-90521Medium
A vulnerability was found in jaychouchannel Tourism-Management-System up to 8122bf020d91199eddfff3ee02d1632a70a9a132. This issue affects some unknown processing of the file MenpiaodingdanController.java of the component CRUD. The manipulation of the argument ID results in authorization bypass. It is possible to launch the attack remotely. The exploit has been made public and could be used. This product takes the approach of rolling releases to provide continious delivery. Therefore, version details for affected and updated releases are not available. The patch is identified as d44ec3aa0bd2a72c8800e3befb0a9a96a6491b86. It is best practice to apply a patch to resolve this issue.
- CVE-2026-90520Medium
A vulnerability was found in jaychouchannel Tourism-Management-System in AuthorizationInterceptor.java of the Authorization Interceptor component. Manipulation leads to improper authorization and the attack can be launched remotely. The exploit has been publicly disclosed and may be used.
- CVE-2026-86284Medium
A security vulnerability has been detected in jaychouchannel Tourism-Management-System up to 8122bf020d91199eddfff3ee02d1632a70a9a132. Affected by this vulnerability is the function getOption of the file travel/src/main/java/com/controller/CommonController.java. The manipulation of the argument tableName/columnName leads to information disclosure. The attack may be initiated remotely. The exploit has been disclosed publicly and may be used. The identifier of the patch is d44ec3aa0bd2a72c8800e3befb0a9a96a6491b86.
- CVE-2026-86282High
A weakness has been identified in jaychouchannel Tourism-Management-System up to commit 8122bf020d91199eddfff3ee02d1632a70a9a132. An unknown function in file travel/src/main/java/com/controller/CommonController.java of component CommonDao is affected. Manipulating arguments table/column/xColumn/yColumn can lead to SQL injection. The attack can be launched remotely and the exploit has been made public. The product does not use versioning, but a patch d44ec3aa0bd2a72c8800e3befb0a9a96a6491b86 is available.
Original NVD description (English source)
A security flaw has been discovered in jaychouchannel Tourism-Management-System up to 229956e20dbd4a80eeff14535e44d3099502af09. The impacted element is an unknown function of the component Update Endpoint. Performing a manipulation results in missing authentication. The attack may be initiated remotely. The exploit has been released to the public and may be used for attacks. This product uses a rolling release model to deliver continuous updates. As a result, specific version information for affected or updated releases is not available. The patch is named 84d8ec384f669df3985293dab293bb7b477efa64. It is suggested to install a patch to address this issue.