Description
A vulnerability has been found in code-projects Hotel and Tourism Reservation 1.0. Affected by this vulnerability is an unknown functionality of the file /admin/reservations.php of the component Reservations Management Page. The manipulation of the argument delete leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used.
Published: 2026-07-05
Score: 6.9 Medium
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

A flaw has been identified in the /admin/reservations.php handler of Code‑Projects Hotel and Tourism Reservation 1.0. The delete parameter, when not properly sanitized, allows a malicious actor to inject arbitrary SQL commands into the backend database. This means an attacker could read, modify or delete reservation records, potentially corrupting data integrity and exposing sensitive information. The weakness corresponds to improper neutralization of special elements (CWE‑74) and classic SQL injection (CWE‑89).

Affected Systems

The vulnerability exists in Code‑Projects Hotel and Tourism Reservation version 1.0, page. Any deployment that includes this component and exposes the delete functionality for reservation records is impacted.

Risk and Exploitability

The CVSS base score of 6.9 indicates a medium-level severity, and the EPSS value of < 1 % points to a very low probability of exploitation at this time. The vulnerability is not listed in the CISA KEV catalog. Attackers require remote access to the /admin/reservations.php end‑point and the ability to supply a crafted delete parameter; no specific authentication prerequisites are detailed, so lack of further information leaves that uncertain.

Generated by OpenCVE AI on July 23, 2026 at 15:47 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Apply the latest patch from Code‑Projects that resolves the unsanitized delete parameter in reservations.php.
  • Configure the web application to require authenticated access and enforce role‑based permissions for the /admin/reservations.php endpoint.
  • Implement input validation or rewrite the delete logic to use parameterized queries, ensuring the delete parameter only accepts valid identifiers.

Generated by OpenCVE AI on July 23, 2026 at 15:47 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Mon, 06 Jul 2026 19:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Sun, 05 Jul 2026 14:45:00 +0000

Type Values Removed Values Added
Description A vulnerability has been found in code-projects Hotel and Tourism Reservation 1.0. Affected by this vulnerability is an unknown functionality of the file /admin/reservations.php of the component Reservations Management Page. The manipulation of the argument delete leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used.
Title code-projects Hotel and Tourism Reservation Reservations Management reservations.php sql injection
First Time appeared Code-projects
Code-projects hotel And Tourism Reservation
Weaknesses CWE-74
CWE-89
CPEs cpe:2.3:a:code-projects:hotel_and_tourism_reservation:*:*:*:*:*:*:*:*
Vendors & Products Code-projects
Code-projects hotel And Tourism Reservation
References
Metrics cvssV2_0

{'score': 7.5, 'vector': 'AV:N/AC:L/Au:N/C:P/I:P/A:P/E:POC/RL:ND/RC:UR'}

cvssV3_0

{'score': 7.3, 'vector': 'CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R'}

cvssV3_1

{'score': 7.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R'}

cvssV4_0

{'score': 6.9, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P'}

Subscriptions

Code-projects Hotel And Tourism Reservation
cve-icon MITRE

Status: PUBLISHED

Assigner: VulDB

Published:

Updated: 2026-07-06T18:45:39.501Z

Reserved: 2026-07-04T15:56:15.739Z

Link: CVE-2026-14755

cve-icon Vulnrichment

Updated: 2026-07-06T18:45:35.347Z

cve-icon NVD

No data.

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-07-23T16:00:14Z

Weaknesses
  • CWE-74

    Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')

  • CWE-89

    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')