Is there a public PoC exploit available for CVE-2026-14688?

Yes, a public proof-of-concept exploit is available for CVE-2026-14688. Prioritise patching immediately. EPSS: 0.3%.

Online Hotel Management System CVE-2026-14688

Q: What is the CVSS score of CVE-2026-14688?

CVE-2026-14688 has a CVSS 4.0 base score of 5.5 (Medium). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.3%.

EUVD-2026-41710 MEDIUM

SQL Injection (CWE-89)

2026-07-05 VulDB

GHSA-w4jw-95f5-j2x5

PHP SQLi Online Hotel Management System Itsourcecode

5.5

CVSS 4.0 · Vendor: VulDB

Severity by source

Vendor (VulDB) PRIMARY

5.5 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

6.5 MEDIUM

Unauthenticated network access to a login form; SQLi enables partial data read and auth bypass but no demonstrated availability impact or scope change.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (VulDB).

CVSS VectorVendor: VulDB

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Jul 05, 2026 - 02:09 vuln.today

CVSS changed

Jul 05, 2026 - 01:22 NVD

6.9 (MEDIUM) 5.5 (MEDIUM)

DescriptionCVE.org

A vulnerability was identified in itsourcecode Online Hotel Management System 1.0. The affected element is an unknown function of the file /admin/login.php. The manipulation of the argument email leads to sql injection. The attack may be initiated remotely. The exploit is publicly available and might be used.

AnalysisAI

SQL injection in itsourcecode Online Hotel Management System 1.0 exposes the admin login endpoint to remote unauthenticated exploitation via an unsanitized email parameter in /admin/login.php. A public proof-of-concept is available on GitHub (reflected in the CVSS 4.0 E:P metric), meaning exploitation requires minimal technical skill and is accessible to opportunistic attackers. No CISA KEV listing has been identified, but the zero-authentication barrier combined with available exploit code makes this a practical risk for any internet-exposed deployment.

Technical ContextAI

The affected product is a PHP-based hotel management web application developed by itsourcecode (CPE: cpe:2.3:a:itsourcecode:online_hotel_management_system:*:*:*:*:*:*:*:*), consistent with the educational/demo PHP scripts distributed on itsourcecode.com. The root cause is CWE-89 (Improper Neutralization of Special Elements Used in an SQL Command), where the email POST parameter in /admin/login.php is concatenated directly into a SQL query without parameterization or prepared statements - a pattern endemic to legacy PHP/MySQL stacks. This class of flaw enables classic attacks including authentication bypass via tautology injection (' OR '1'='1) and UNION-based or error-based data extraction from the underlying database.

RemediationAI

No vendor-released patch has been identified at time of analysis; the itsourcecode vendor page (https://itsourcecode.com/) and VulDB entry (https://vuldb.com/cve/CVE-2026-14688) should be monitored for updates. The definitive fix requires refactoring /admin/login.php to use PDO or MySQLi prepared statements with bound parameters for the email field, eliminating the injection surface entirely. As an immediate compensating control, restrict network access to the /admin/login.php endpoint via IP allowlist or firewall rule - note this may impact legitimate remote admin access. Deploying a WAF rule targeting SQL injection patterns on the email parameter provides an additional detection and blocking layer, though WAF rules carry false-positive risk on certain email address formats. If the application cannot be patched or access-restricted promptly, consider taking the admin interface offline until remediation is complete.