Which versions of PHP are affected by CVE-2026-3730?

A high-severity vulnerability in the Free Hotel Reservation System 1.0 allows unauthorized modification of amenities data through an unprotected admin interface, potentially enabling attackers to…

Is there a public PoC exploit available for CVE-2026-3730?

Yes, a public proof-of-concept exploit is available for CVE-2026-3730. Prioritise patching immediately. EPSS: 0.0%.

How to fix or mitigate CVE-2026-3730?

Within 24 hours: Identify all systems running Free Hotel Reservation System 1.0 and restrict network access to the /hotel/admin/ path to authorized personnel only; document current amenities configurations as backup. Within 7 days: Implement WAF rules to block suspicious POST/GET requests to index.php?view=edit and enable detailed logging of all admin access; assess whether the system is customer-facing or internal. Within 30 days: Evaluate migration to a patched version or alternative hotel management platform; conduct security audit of all admin functions.

PHP CVE-2026-3730

Q: What is the CVSS score of CVE-2026-3730?

CVE-2026-3730 has a CVSS 4.0 base score of 5.5 (Medium). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

MEDIUM

Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') (CWE-74)

2026-03-08 cna@vuldb.com

PHP SQLi Free Hotel Reservation System Itsourcecode

5.5

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

5.5 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Severity Changed

Apr 29, 2026 - 01:11 NVD

HIGH MEDIUM

CVSS changed

Apr 29, 2026 - 01:11 NVD

7.3 (HIGH) 5.5 (MEDIUM)

Analysis Generated

Mar 12, 2026 - 21:55 vuln.today

PoC Detected

Mar 09, 2026 - 15:24 vuln.today

Public exploit code

CVE Published

Mar 08, 2026 - 11:15 nvd

HIGH 7.3

DescriptionCVE.org

A security flaw has been discovered in itsourcecode Free Hotel Reservation System 1.0. The affected element is an unknown function of the file /hotel/admin/mod_amenities/index.php?view=edit. Performing a manipulation of the argument amen_id/rmtype_id results in sql injection. The attack is possible to be carried out remotely. The exploit has been released to the public and may be used for attacks.

AnalysisAI

SQL injection in Free Hotel Reservation System 1.0 allows remote attackers to manipulate the amen_id and rmtype_id parameters in the amenities management interface, enabling unauthorized database access and potential data modification. Public exploit code exists for this vulnerability, and no patch is currently available. The flaw affects PHP-based installations and requires no authentication or user interaction to exploit.

Technical ContextAI

Affects Free Hotel Reservation System. A security flaw has been discovered in itsourcecode Free Hotel Reservation System 1.0. The affected element is an unknown function of the file /hotel/admin/mod_amenities/index.php?view=edit. Performing a manipulation of the argument amen_id/rmtype_id results in sql injection. The attack is possible to be carried out remotely. The exploit has been released to the public and may be used for attacks.

RemediationAI

Monitor vendor advisories for a patch. Use parameterized queries. Implement input validation. Restrict network access to the affected service where possible.