Is there a public PoC exploit available for CVE-2026-14756?

Yes, a public proof-of-concept exploit is available for CVE-2026-14756. Prioritise patching immediately. EPSS: 0.3%.

Hotel And Tourism Reservation CVE-2026-14756

Q: What is the CVSS score of CVE-2026-14756?

CVE-2026-14756 has a CVSS 4.0 base score of 5.5 (Medium). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.3%.

EUVD-2026-41763 MEDIUM

SQL Injection (CWE-89)

2026-07-05 VulDB

GHSA-qhwr-3f48-vrg7

PHP SQLi Hotel And Tourism Reservation Code Projects

5.5

CVSS 4.0 · Vendor: VulDB

Severity by source

Vendor (VulDB) PRIMARY

5.5 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

6.3 MEDIUM

Admin-path location implies at minimum low-privilege login required; PR:L chosen over the official PR:N pending authentication verification, with low partial impact across CIA.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N

Primary rating from Vendor (VulDB).

CVSS VectorVendor: VulDB

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Jul 05, 2026 - 15:24 vuln.today

CVSS changed

Jul 05, 2026 - 15:22 NVD

6.9 (MEDIUM) 5.5 (MEDIUM)

DescriptionCVE.org

A vulnerability was found in code-projects Hotel and Tourism Reservation 1.0. Affected by this issue is some unknown functionality of the file /admin/add_tour.php of the component Tour Management Page. The manipulation of the argument delete_image results in sql injection. The attack may be launched remotely. The exploit has been made public and could be used.

AnalysisAI

SQL injection in code-projects Hotel and Tourism Reservation 1.0 exposes the reservation database to remote manipulation via the delete_image parameter in the admin Tour Management Page (/admin/add_tour.php). The CVSS 4.0 vector asserts no privileges required (PR:N), yet the vulnerable endpoint sits under an /admin/ path - this conflict is unresolved in available data and defenders must verify whether the admin panel is publicly accessible without authentication. A public proof-of-concept is available on GitHub, elevating practical risk beyond the moderate base score, though no CISA KEV listing indicates confirmed widespread exploitation at time of analysis.

Technical ContextAI

The affected application is a PHP-based hotel and tourism reservation system distributed by code-projects (CPE: cpe:2.3:a:code-projects:hotel_and_tourism_reservation:*:*:*:*:*:*:*:*). The vulnerability is rooted in CWE-89 (Improper Neutralization of Special Elements in SQL Commands): the delete_image parameter accepted by /admin/add_tour.php is concatenated directly into a SQL query without parameterization or sanitization, enabling classic SQL injection. This PHP application pattern - unsanitized GET/POST parameters passed to MySQL queries - is a well-documented and trivially exploitable code pattern. The Tour Management administrative page handles image deletion for tour listings, making the parameter an attacker-controlled input that reaches the database layer. Automated tools such as sqlmap can enumerate and extract the full database schema and contents with minimal effort.

RemediationAI

No vendor-released patch has been identified at time of analysis - no patched version is confirmed in any available reference. As an immediate compensating control, restrict access to the /admin/ directory and specifically /admin/add_tour.php at the web server level using IP allowlisting (e.g., Apache .htaccess Require ip directives or nginx allow/deny blocks), limiting admin panel exposure to trusted internal networks only; this eliminates network-based exploitation but requires network architecture support. Deploy a WAF rule targeting SQL injection patterns (single quotes, SQL keywords, comment sequences) in the delete_image parameter as a secondary layer, noting that WAF bypasses are possible for skilled attackers. Long-term, the application code must be patched to replace dynamic SQL string concatenation with PDO prepared statements or MySQLi parameterized queries across all admin handlers. The exploit advisory is available at https://raw.githubusercontent.com/anubhavv106/Security-Advisories/refs/heads/main/Hotel-Tourism-Reservation-add_tour.php-SQLi.md and should be reviewed to understand the full exploitation surface.