Which versions of Travel Agency Management System are affected by CVE-2026-19425?

Win Men International's Travel Agency Management System contains a critical SQL injection vulnerability enabling unauthenticated attackers to access and modify customer booking data and backend…

How to fix or mitigate CVE-2026-19425?

Within 24 hours: isolate affected Win Men International Travel Agency Management System instances from direct internet exposure or deploy Web Application Firewall rules targeting SQL injection patterns; identify all external-facing deployments in your infrastructure. Within 7 days: audit database transaction logs for unauthorized queries or anomalous access; conduct forensic analysis to determine if exploitation has occurred; inventory all customer personally identifiable information accessible through the vulnerable system. Within 30 days: contact Win Men International directly for patch timeline and interim guidance; if no patch becomes available within 30 days, initiate migration planning to alternative travel management solutions or implement persistent compensating controls with 24/7 security monitoring.

Travel Agency Management System CVE-2026-19425

Q: What is the CVSS score of CVE-2026-19425?

CVE-2026-19425 has a CVSS 4.0 base score of 9.3 (Critical). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.5%.

EUVD-2026-55933 CRITICAL

SQL Injection (CWE-89)

2026-08-11 twcert

GHSA-mh55-5vhx-83cg

SQLi Travel Agency Management System

9.3

CVSS 4.0 · Vendor: twcert

Severity by source

Vendor (twcert) PRIMARY

9.3 CRITICAL

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

9.8 CRITICAL

Unauthenticated network SQL injection (AV:N/AC:L/PR:N/UI:N) grants full read, modify, and delete access to the database, yielding C:H/I:H/A:H with no scope change.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (twcert).

CVSS VectorVendor: twcert

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Analysis Updated

Aug 11, 2026 - 05:28 vuln.today

v2 (cvss_changed)

Re-analysis Queued

Aug 11, 2026 - 05:22 vuln.today

cvss_changed

CVSS changed

Aug 11, 2026 - 05:22 NVD

9.8 (CRITICAL) 9.3 (CRITICAL)

Analysis Generated

Aug 11, 2026 - 05:20 vuln.today

CVE Published

Aug 11, 2026 - 04:17 cve.org

CRITICAL 9.8

DescriptionCVE.org

Travel Agency Management System developed by Win Men Intermational has a SQL Injection vulnerability. Unauthenticated remote attackers can inject arbitrary SQL commands to read, modify, and delete database contents.

AnalysisAI

SQL injection in Win Men Intermational's Travel Agency Management System lets unauthenticated remote attackers inject arbitrary SQL to read, modify, and delete backend database contents. Rated CVSS 4.0 9.3 (Critical) with a fully network-exploitable, no-privilege, no-interaction vector, it was disclosed via Taiwan's TWCERT/CC. There is no public exploit identified at time of analysis and it is not listed in CISA KEV.

Technical ContextAI

This is a classic CWE-89 (Improper Neutralization of Special Elements used in an SQL Command) flaw in a web-based travel agency booking/management application. The affected component (CPE cpe:2.3:a:win_men_intermational:travel_agency_management_system) fails to parameterize or sanitize user-supplied input before concatenating it into SQL queries, allowing attacker-controlled input to alter query structure. Because the injection is reachable pre-authentication, the vulnerable input reaches a database-backed request handler exposed on a public endpoint, giving direct access to the underlying relational database.

RemediationAI

Apply the vendor's fixed release as directed in the TWCERT/CC advisories at https://www.twcert.org.tw/en/cp-139-11099-56aa8-2.html and https://www.twcert.org.tw/tw/cp-132-11098-0fb4a-1.html; no vendor-released patch version was provided in this data, so the specific fixed build should be confirmed directly with Win Men Intermational. Until patched, restrict network exposure by placing the application behind a VPN or IP allowlist and blocking untrusted internet access to it, and deploy a WAF with SQL-injection signatures in front of the affected endpoints as a compensating control - noting that WAF rules can be bypassed and may block legitimate booking traffic, so they reduce but do not eliminate risk. Where feasible, tighten the application's database account to least privilege (remove write/delete rights not strictly needed) to limit the impact of a successful injection, accepting that this does not stop data-read exposure.