Which versions of Hotel and Tourism Reservation System are affected by CVE-2026-10290?

The Hotel and Tourism Reservation System 1.0 from code-projects contains a critical SQL injection vulnerability that allows unauthenticated attackers to directly access and modify the reservation…

Is there a public PoC exploit available for CVE-2026-10290?

Yes, a public proof-of-concept exploit is available for CVE-2026-10290. Prioritise patching immediately. EPSS: 0.0%.

How to fix or mitigate CVE-2026-10290?

Within 24 hours: Identify all instances of code-projects Hotel and Tourism Reservation System v1.0 in production and assess scope; evaluate isolating the system from internet-facing access if feasible. Within 7 days: Deploy Web Application Firewall rules to block SQL injection patterns in the tour parameter; implement prepared statements/parameterized queries in tour.php; restrict database user account privileges to minimum required access. Within 30 days: Contact code-projects vendor for a security update; if unavailable, evaluate and plan migration to an actively maintained reservation system; apply any released patch immediately.

Hotel and Tourism Reservation System CVE-2026-10290

Q: What is the CVSS score of CVE-2026-10290?

CVE-2026-10290 has a CVSS 4.0 base score of 5.5 (Medium). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2026-33819 MEDIUM

SQL Injection (CWE-89)

2026-06-01 VulDB

GHSA-pw3w-29rh-cr4f

PHP SQLi Hotel And Tourism Reservation System Code Projects

5.5

CVSS 4.0 · Vendor: VulDB

Severity by source

Vendor (VulDB) PRIMARY

5.5 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from Vendor (VulDB) · only source for this CVE.

CVSS VectorVendor: VulDB

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Severity Changed

Jun 01, 2026 - 22:22 NVD

HIGH MEDIUM

CVSS changed

Jun 01, 2026 - 22:22 NVD

7.3 (HIGH) 5.5 (MEDIUM)

Analysis Generated

Jun 01, 2026 - 22:16 vuln.today

DescriptionCVE.org

A weakness has been identified in code-projects Hotel and Tourism Reservation System 1.0. The affected element is an unknown function of the file tour.php of the component GET Parameter Handler. Executing a manipulation of the argument tour can lead to sql injection. The attack can be launched remotely. The exploit has been made available to the public and could be used for attacks.

AnalysisAI

SQL injection in code-projects Hotel and Tourism Reservation System 1.0 allows remote unauthenticated attackers to manipulate the tour GET parameter in tour.php to inject arbitrary SQL into backend database queries. Publicly available exploit code exists (hosted on GitHub), enabling low-skilled attackers to extract or modify database contents, though no CISA KEV listing or EPSS signal indicates widespread active exploitation at this time.

Technical ContextAI

The affected application is a PHP-based web application (code-projects Hotel and Tourism Reservation System 1.0) per CPE cpe:2.3:a:code-projects:hotel_and_tourism_reservation_system. The root cause is CWE-89 (Improper Neutralization of Special Elements used in an SQL Command), meaning the tour GET parameter passed to tour.php is concatenated into a SQL query without parameterization or input sanitization. code-projects applications are typically small PHP/MySQL learning-grade projects distributed via code-projects.org, often deployed on shared hosting or as internal demo systems, and rely on direct mysqli/mysql_query calls that are highly susceptible to classic injection.

RemediationAI

No vendor-released patch identified at time of analysis - code-projects.org has not published a fixed version per the supplied references. Operators should immediately apply compensating controls: rewrite the tour.php query to use prepared statements with parameter binding (PDO or mysqli_prepare with bound tour value), or as a stopgap cast the tour argument to an integer if it is numeric (trade-off: breaks any non-numeric tour identifiers). Deploy a Web Application Firewall rule blocking SQL metacharacters in the tour query string on requests to tour.php (trade-off: may break legitimate URL-encoded payloads). Restrict the database account used by the application to read-only on required tables and remove FILE/INTO OUTFILE privileges to limit post-exploitation impact. Monitor VulDB at https://vuldb.com/cve/CVE-2026-10290 for an upstream fix and consider taking the application offline if exposed to the public Internet until remediated.