Is there a public PoC exploit available for CVE-2026-14764?

Yes, a public proof-of-concept exploit is available for CVE-2026-14764. Prioritise patching immediately. EPSS: 0.3%.

Hotel and Tourism Reservation CVE-2026-14764

Q: What is the CVSS score of CVE-2026-14764?

CVE-2026-14764 has a CVSS 4.0 base score of 5.5 (Medium). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.3%.

EUVD-2026-41774 MEDIUM

SQL Injection (CWE-89)

2026-07-05 VulDB

GHSA-3xw3-x263-4cr4

PHP SQLi Hotel And Tourism Reservation Code Projects

5.5

CVSS 4.0 · Vendor: VulDB

Severity by source

Vendor (VulDB) PRIMARY

5.5 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

7.3 HIGH

Network-reachable SQLi with no authentication per CVSS 4.0 PR:N; limited C/I/A impact consistent with partial database access.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N

Primary rating from Vendor (VulDB).

CVSS VectorVendor: VulDB

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

CVSS changed

Jul 05, 2026 - 17:22 NVD

6.9 (MEDIUM) 5.5 (MEDIUM)

Analysis Generated

Jul 05, 2026 - 17:20 vuln.today

DescriptionCVE.org

A vulnerability has been found in code-projects Hotel and Tourism Reservation 1.0. This impacts an unknown function of the file /admin/add_event.php of the component Event Management Page. Such manipulation of the argument fdetails leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used.

AnalysisAI

SQL injection in code-projects Hotel and Tourism Reservation 1.0 allows remote attackers to manipulate the backend database via the fdetails parameter in /admin/add_event.php. The flaw is reachable over the network with no authentication required per the CVSS 4.0 vector, enabling data extraction, modification, or disruption against the application's database. A public exploit has been disclosed on GitHub; no patch has been identified at time of analysis.

Technical ContextAI

The affected product is a PHP-based web application developed by code-projects, a platform distributing academic and demonstration-grade project code. The vulnerable endpoint is /admin/add_event.php within the Event Management Page component, where the fdetails argument is incorporated into a SQL query without adequate sanitization or parameterization. The root cause is CWE-89 (Improper Neutralization of Special Elements used in an SQL Command), a classic unsanitized input reaching a database query. The CPE string cpe:2.3:a:code-projects:hotel_and_tourism_reservation:*:*:*:*:*:*:*:* covers all versions of the product with no version constraint, suggesting the flaw is present across the entire release history of version 1.0.

RemediationAI

No vendor-released patch has been identified at time of analysis. As an immediate compensating control, access to /admin/add_event.php and the broader /admin/ directory should be restricted via web server configuration (e.g., IP allowlisting or HTTP basic authentication at the server layer) to trusted administrative networks only - this reduces the attack surface if the application itself lacks authentication. Input validation and parameterized queries (prepared statements) should be implemented in the PHP source code for the fdetails parameter and all other user-supplied inputs before redeployment. Deploying a Web Application Firewall (WAF) with SQLi rule sets can provide interim detection and blocking, though WAF bypass is possible for motivated attackers. Organizations are advised to monitor the VulDB entry at https://vuldb.com/cve/CVE-2026-14764 and the code-projects.org project page for any patch releases.