Is there a public PoC exploit available for CVE-2026-14755?

Yes, a public proof-of-concept exploit is available for CVE-2026-14755. Prioritise patching immediately. EPSS: 0.3%.

Hotel Tourism Reservation CVE-2026-14755

Q: What is the CVSS score of CVE-2026-14755?

CVE-2026-14755 has a CVSS 4.0 base score of 5.5 (Medium). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.3%.

EUVD-2026-41761 MEDIUM

SQL Injection (CWE-89)

2026-07-05 VulDB

GHSA-mp5c-5v4v-c624

PHP SQLi Hotel And Tourism Reservation Code Projects

5.5

CVSS 4.0 · Vendor: VulDB

Severity by source

Vendor (VulDB) PRIMARY

5.5 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

8.3 HIGH

Admin endpoint implies some credential barrier (PR:L); SQL injection enables full DB read/write so C:H and I:H; availability impact is partial at most.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N

Primary rating from Vendor (VulDB).

CVSS VectorVendor: VulDB

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Jul 05, 2026 - 15:25 vuln.today

CVSS changed

Jul 05, 2026 - 15:22 NVD

6.9 (MEDIUM) 5.5 (MEDIUM)

DescriptionCVE.org

A vulnerability has been found in code-projects Hotel and Tourism Reservation 1.0. Affected by this vulnerability is an unknown functionality of the file /admin/reservations.php of the component Reservations Management Page. The manipulation of the argument delete leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used.

AnalysisAI

SQL injection in code-projects Hotel and Tourism Reservation 1.0 exposes the /admin/reservations.php endpoint to database manipulation via the unsanitized delete parameter. The vulnerability is reachable over the network with no confirmed complexity barriers, and a public proof-of-concept exploit has been disclosed. No vendor patch has been identified, leaving all deployments of version 1.0 exposed to database read, write, and potential full compromise of hosted reservation data.

Technical ContextAI

The affected product is a PHP-based hotel and tourism reservation management application distributed by code-projects (cpe:2.3:a:code-projects:hotel_and_tourism_reservation:*:*:*:*:*:*:*:*). The root cause is CWE-89 (Improper Neutralization of Special Elements used in an SQL Command), a classic failure to use parameterized queries or prepared statements when constructing SQL from user-supplied input. The delete argument passed to /admin/reservations.php is interpolated directly into a backend SQL query without sanitization, enabling an attacker to append or modify the query logic. The tag set (PHP, SQLi) is consistent with a typical LAMP-stack hobby project where input handling is manual rather than ORM-mediated.

RemediationAI

No vendor-released patch has been identified at time of analysis for code-projects Hotel and Tourism Reservation 1.0. The primary remediation is to replace direct string interpolation of the delete parameter with parameterized prepared statements (e.g., PHP PDO or MySQLi prepared statements), which eliminates the SQL injection root cause. As an immediate compensating control, restrict access to /admin/reservations.php at the web server or network layer (e.g., IP allowlist, HTTP authentication via nginx/Apache) to prevent unauthenticated or unauthorized network access; note this does not fix the underlying flaw and creates a maintenance burden. If the application is used only internally or for demonstration, taking it offline until the code is patched is the safest option. Reference the public advisory at https://raw.githubusercontent.com/anubhavv106/Security-Advisories/refs/heads/main/Hotel-Tourism-Reservation-add_event.php-SQLi.md for proof-of-concept detail to validate remediation effectiveness.