Is there a public PoC exploit available for CVE-2026-14763?

Yes, a public proof-of-concept exploit is available for CVE-2026-14763. Prioritise patching immediately. EPSS: 0.3%.

Hotel Tourism Reservation CVE-2026-14763

Q: What is the CVSS score of CVE-2026-14763?

CVE-2026-14763 has a CVSS 4.0 base score of 5.5 (Medium). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.3%.

EUVD-2026-41773 MEDIUM

SQL Injection (CWE-89)

2026-07-05 VulDB

GHSA-jc28-2w56-9m3w

PHP SQLi Hotel And Tourism Reservation Code Projects

5.5

CVSS 4.0 · Vendor: VulDB

Severity by source

Vendor (VulDB) PRIMARY

5.5 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

8.3 HIGH

Admin endpoint implies at minimum low-privilege access (PR:L); SQL injection yields full DB read/write so C:H/I:H; availability impact limited to data corruption rather than full service disruption.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N

Primary rating from Vendor (VulDB).

CVSS VectorVendor: VulDB

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

CVSS changed

Jul 05, 2026 - 17:22 NVD

6.9 (MEDIUM) 5.5 (MEDIUM)

Analysis Generated

Jul 05, 2026 - 17:21 vuln.today

DescriptionCVE.org

A flaw has been found in code-projects Hotel and Tourism Reservation 1.0. This affects an unknown function of the file /admin/tour_reserves.php of the component Tour Reservations Page. This manipulation of the argument tour causes sql injection. The attack can be initiated remotely. The exploit has been published and may be used.

AnalysisAI

SQL injection in code-projects Hotel and Tourism Reservation 1.0 allows remote attackers to manipulate the unsanitized tour parameter in /admin/tour_reserves.php, enabling arbitrary SQL query execution against the backend database. The CVSS 4.0 vector assigns PR:N (no privileges required), though the admin-panel endpoint raises questions about whether authentication is genuinely absent or misconfigured - a discrepancy worth verifying in deployments. A public proof-of-concept exploit has been published via GitHub, raising the practical risk despite the medium CVSS 4.0 score of 6.9 and absence of CISA KEV listing.

Technical ContextAI

The affected application is a PHP-based hotel and tourism reservation system distributed by code-projects.org, identified by CPE cpe:2.3:a:code-projects:hotel_and_tourism_reservation:*:*:*:*:*:*:*:*. The root cause is CWE-89 (Improper Neutralization of Special Elements used in an SQL Command), where user-supplied input in the tour GET or POST parameter is concatenated directly into a SQL query within /admin/tour_reserves.php without parameterized queries or input sanitization. This is a classic PHP-era pattern of building SQL strings from raw request data, common in demo and educational PHP projects. Because no output encoding or prepared statement is used, an attacker can append SQL logic operators, UNION clauses, or stacked queries depending on the database driver and configuration.

RemediationAI

No vendor-released patch has been identified at time of analysis. The primary remediation is to replace all raw SQL string concatenation in /admin/tour_reserves.php with PHP PDO or MySQLi prepared statements and parameterized queries, which eliminates the injection vector at its root. As an immediate compensating control, restrict access to the /admin/ directory via server-level authentication (HTTP Basic Auth or equivalent) and IP allowlisting to trusted administrative networks, reducing exposure even if the PHP code remains unpatched - note that this does not fix the underlying flaw but limits who can reach it. Input validation using PHP's filter_input with strict allowlists for the tour parameter provides a secondary defense layer. Deploying a web application firewall (WAF) with SQL injection signatures can detect and block exploit attempts but introduces false-positive risk for legitimate queries. Given this is an educational/demo project, production deployment is strongly discouraged until the codebase undergoes a full security audit. The published exploit advisory is at https://raw.githubusercontent.com/anubhavv106/Security-Advisories/refs/heads/main/Hotel-Tourism-Reservation-tour_reserves.php-SQLi.md.