Description
A vulnerability was identified in itsourcecode Online Hotel Management System 1.0. The affected element is an unknown function of the file /admin/login.php. The manipulation of the argument email leads to sql injection. The attack may be initiated remotely. The exploit is publicly available and might be used.
Published: 2026-07-05
Score: 6.9 Medium
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

A vulnerability exists in the admin login component of itsourcecode Online Hotel Management System 1.0. An attacker who supplies a crafted email value to /admin/login.php can inject arbitrary SQL sentences, potentially reading, modifying, or deleting database data. The flaw is manifested through CWE-74 and CWE-89 weaknesses.

Affected Systems

The vulnerability affects itsourcecode Online Hotel Management System version 1 affected in the CVE data.

Risk and Exploitability

The CVSS score of 6.9 denotes medium severity, while the EPSS score of <1 chance at present. The vulnerability is not listed in CISA KEV, but public exploit code is available and the attack can be launched over the network. Operators should treat the exposure as a concern, particularly if the application is accessible from the internet.

Generated by OpenCVE AI on July 26, 2026 at 21:38 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Apply a vendor‑issued patch or upgrade to a newer release of Online Hotel Management System that protects the email field with input validation and parameterized SQL queries.
  • Add server‑side sanitization and validation of the email supplied to /admin/login.php, ensuring no SQL fragments reach the database and that prepared statements are used for all queries.
  • Restrict the database account used by the application to the minimum privileges necessary for normal operation.

Generated by OpenCVE AI on July 26, 2026 at 21:38 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Mon, 06 Jul 2026 18:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Sun, 05 Jul 2026 01:15:00 +0000

Type Values Removed Values Added
Description A vulnerability was identified in itsourcecode Online Hotel Management System 1.0. The affected element is an unknown function of the file /admin/login.php. The manipulation of the argument email leads to sql injection. The attack may be initiated remotely. The exploit is publicly available and might be used.
Title itsourcecode Online Hotel Management System login.php sql injection
First Time appeared Itsourcecode
Itsourcecode online Hotel Management System
Weaknesses CWE-74
CWE-89
CPEs cpe:2.3:a:itsourcecode:online_hotel_management_system:*:*:*:*:*:*:*:*
Vendors & Products Itsourcecode
Itsourcecode online Hotel Management System
References
Metrics cvssV2_0

{'score': 7.5, 'vector': 'AV:N/AC:L/Au:N/C:P/I:P/A:P/E:POC/RL:ND/RC:UR'}

cvssV3_0

{'score': 7.3, 'vector': 'CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R'}

cvssV3_1

{'score': 7.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R'}

cvssV4_0

{'score': 6.9, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P'}

Subscriptions

Itsourcecode Online Hotel Management System
cve-icon MITRE

Status: PUBLISHED

Assigner: VulDB

Published:

Updated: 2026-07-06T17:46:57.337Z

Reserved: 2026-07-04T04:48:31.734Z

Link: CVE-2026-14688

cve-icon Vulnrichment

Updated: 2026-07-06T17:43:23.803Z

cve-icon NVD

No data.

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-07-26T21:45:05Z

Weaknesses
  • CWE-74

    Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')

  • CWE-89

    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')