Description
A vulnerability has been found in code-projects Hotel and Tourism Reservation 1.0. Affected by this vulnerability is an unknown functionality of the file /admin/reservations.php of the component Reservations Management Page. The manipulation of the argument delete leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used.
Published: 2026-07-05
Score: 6.9 Medium
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

A flaw exists in the /admin/reservations.php page of Code‑Projects Hotel and Tourism Reservation 1.0 that allows a malicious actor to inject arbitrary SQL through the delete parameter. The injection could give an attacker the ability to read, modify, or delete reservation records, potentially compromising data integrity and confidentiality.

Affected Systems

The vulnerability affects deployments of Code‑Projects Hotel and Tourism Reservation version 1.0 that expose the /admin/reservations.php endpoint and provide a delete functionality for reservation records. No other versions or products are listed as affected.

Risk and Exploitability

The CVSS score of 6.9 indicates medium severity, and the EPSS score of less than 1 % suggests a low probability of exploitation under current conditions. The vulnerability is not listed in the CISA KEV catalog. It can be triggered remotely via the delete parameter on the reservations.php page. The description does not state whether authentication is required, so it is unclear if the flaw can be exploited by unauthenticated or only authenticated users.

Generated by OpenCVE AI on July 31, 2026 at 14:33 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Apply any vendor‑supplied patch that sanitizes the delete parameter in reservations.php.
  • Restrict the /admin/reservations.php endpoint to authenticated administrators and enforce role‑based access control.
  • Implement input validation and use parameterized queries for all user‑supplied values to prevent SQL injection.

Generated by OpenCVE AI on July 31, 2026 at 14:33 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Wed, 29 Jul 2026 15:30:00 +0000

Type Values Removed Values Added
First Time appeared Code-projects hotel And Tourism Reservation System
Vendors & Products Code-projects hotel And Tourism Reservation System

Mon, 06 Jul 2026 19:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Sun, 05 Jul 2026 14:45:00 +0000

Type Values Removed Values Added
Description A vulnerability has been found in code-projects Hotel and Tourism Reservation 1.0. Affected by this vulnerability is an unknown functionality of the file /admin/reservations.php of the component Reservations Management Page. The manipulation of the argument delete leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used.
Title code-projects Hotel and Tourism Reservation Reservations Management reservations.php sql injection
First Time appeared Code-projects
Code-projects hotel And Tourism Reservation
Weaknesses CWE-74
CWE-89
CPEs cpe:2.3:a:code-projects:hotel_and_tourism_reservation:*:*:*:*:*:*:*:*
Vendors & Products Code-projects
Code-projects hotel And Tourism Reservation
References
Metrics cvssV2_0

{'score': 7.5, 'vector': 'AV:N/AC:L/Au:N/C:P/I:P/A:P/E:POC/RL:ND/RC:UR'}

cvssV3_0

{'score': 7.3, 'vector': 'CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R'}

cvssV3_1

{'score': 7.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R'}

cvssV4_0

{'score': 6.9, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P'}

Subscriptions

Code-projects Hotel And Tourism Reservation Hotel And Tourism Reservation System
cve-icon MITRE

Status: PUBLISHED

Assigner: VulDB

Published:

Updated: 2026-07-06T18:45:39.501Z

Reserved: 2026-07-04T15:56:15.739Z

Link: CVE-2026-14755

cve-icon Vulnrichment

Updated: 2026-07-06T18:45:35.347Z

cve-icon NVD

Status : Deferred

Published: 2026-07-05T15:16:56.500

Modified: 2026-07-06T19:16:59.110

Link: CVE-2026-14755

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-07-31T14:45:03Z

Weaknesses
  • CWE-74

    Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')

  • CWE-89

    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')