What is the CVSS score of CVE-2026-4966?

CVE-2026-4966 has a CVSS 4.0 base score of 2.1 (Low). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P. EPSS exploitation probability: 0.0%.

Is there a public PoC exploit available for CVE-2026-4966?

Yes, a public proof-of-concept exploit is available for CVE-2026-4966. Prioritise patching immediately. EPSS: 0.0%.

How to fix or mitigate CVE-2026-4966?

Within 30 days: Identify affected systems and apply vendor patches as part of regular patch cycle. Validate input sanitization for user-controlled parameters.

Free Hotel Reservation System CVE-2026-4966

EUVD-2026-16738 LOW

SQL Injection (CWE-89)

2026-03-27 VulDB

PHP SQLi Free Hotel Reservation System Itsourcecode

2.1

CVSS 4.0 · Vendor: VulDB

View

Vulnerability Assessment

Weakness	CWE CWE-89 OWASP Top 10:2025 A05:2025 - Injection ASVS 5.0 V1 - Encoding and Sanitization Parameterized queries, prepared statements MITRE ATT&CK 2 techniques across 2 tactics: Initial Access, Persistence The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. Sign in to read
Impact	While the CVSS 5.3 base score indicates moderate severity, contextual risk signals suggest this poses a targeted but real threat to deployed instances. The CVSS vector PR:L confirms authentication is required (admin login necessary), which significantly limits the attack surface compared to unauthenticated SQL injection. However, the presence of publicly available exploit code (referenced via GitHub) elevates practical exploitability beyond the base score. EPSS data is not provided, but the combination of published POC code, low attack complexity (AC:L), and network accessibility (AV:N) indicates moderate exploitation likelihood. This is a priority for organizations running this software in production, but lower priority than unauthenticated remote code execution vulnerabilities. The limited scope (SC:N) and impact envelope (VC:L/VI:L/VA:L) suggest an attacker with admin credentials can extract or modify database contents but cannot escalate privileges or achieve system compromise.
Exploit ScenarioDerived	An authenticated administrator or a user who has compromised valid admin credentials can navigate to the admin room management panel and inject SQL commands via the ID parameter in the URL (e.g., /admin/mod_room/index.php?view=edit&id=1' OR '1'='1). Because authentication is required and attack complexity is low, an insider threat or an attacker who has obtained admin credentials through phishing or credential reuse can extract sensitive guest data, room information, or pricing details from the database. Publicly available exploit code documented in the referenced GitHub issue (github.com/bybinyu/Vulnerability-Practice/issues/8) demonstrates the exact injection technique, reducing the barrier to exploitation.

Monitor Track and reassess. Why: LOW severity (CVSS 0.1-3.9).

No patch listed yet 0.0% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – Mar 27, 2026

SQL injection in itsourcecode Free Hotel Reservation System 1.0 allows authenticated remote attackers to manipulate the ID parameter in /admin/mod_room/index.php?view=edit, leading to unauthorized database query execution. The vulnerability requires valid admin credentials (CVSS PR:L) but has publicly available exploit code and represents a moderate information disclosure and integrity risk (CVSS 5.3 with limited confidentiality, integrity, and availability impact). Active exploitation status is not confirmed via CISA KEV, but proof-of-concept code is documented in public repositories.

RemediationAI

Contact itsourcecode directly via https://itsourcecode.com/ to obtain any available security patches or updated versions for the Free Hotel Reservation System. Until a patch is available, restrict administrative access to the application through network segmentation, limit admin panel exposure to trusted IP ranges via firewall or reverse proxy rules, and enforce strong authentication mechanisms on admin accounts. Implement Web Application Firewall (WAF) rules to detect and block SQL injection patterns in the ID parameter of requests to /admin/mod_room/index.php. Consider disabling the room management feature if not actively required. Review access logs for suspicious database queries and monitor for unauthorized data extraction.

Affected VersionsENISA

Free Hotel Reservation System 1.0

Affected Packages

euvd free_hotel_reservation_system no fix

Source: OSV (Open Source Vulnerabilities)

Affects your stack

Affects 1 package in euvd

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Technical ContextAI · show details

The vulnerability stems from improper input validation in a PHP-based hotel reservation management application. The root cause is CWE-89 (SQL Injection), specifically insufficient sanitization of the ID parameter before incorporation into SQL queries within the admin room management module. The affected product cpe:2.3:a:itsourcecode:free_hotel_reservation_system:*:*:*:*:*:*:*:* indicates all versions of the Free Hotel Reservation System are potentially vulnerable. The flaw exists in server-side PHP code that processes HTTP GET or POST requests to the administrative interface without adequate parameterized query protection or input validation.

Know when Free Hotel Reservation System gets its next vulnerability

Watch products and get an email when something new is published
Check this CVE against your own stack and servers
Exploit and PoC references, threat intelligence from 22 sources

Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

Vendor (VulDB) PRIMARY 2.1 LOW

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P

Primary rating from Vendor (VulDB) · only source for this CVE.

CVSS VectorVendor: VulDB

Attack Vector

Network

Attack Complexity

Low

Attack Requirements

None

Privileges Required

Low

User Interaction

None

Vulnerable system: Confidentiality

Low

Vulnerable system: Integrity

Low

Vulnerable system: Availability

Low

Subsequent system: Confidentiality

None

Subsequent system: Integrity

None

Subsequent system: Availability

None

Lifecycle Timeline

Severity Changed

Apr 29, 2026 - 01:11 NVD

MEDIUM LOW

CVSS changed

Apr 29, 2026 - 01:11 NVD

5.3 (MEDIUM) 2.1 (LOW)

PoC Detected

Mar 30, 2026 - 13:26 vuln.today

Public exploit code

CVE Published

Mar 27, 2026 - 17:41 nvd

MEDIUM 5.3

DescriptionCVE.org

A flaw has been found in itsourcecode Free Hotel Reservation System 1.0. Impacted is an unknown function of the file /admin/mod_room/index.php?view=edit. Executing a manipulation of the argument ID can lead to sql injection. The attack can be launched remotely. The exploit has been published and may be used. If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Executive ViewAI

Why It Matters

Organizations using A flaw should be aware of moderate risk from CVE-2026-4966, a SQL injection vulnerability rated CVSS 5.3. Exploitation could allow attackers to execute code or inject malicious input. Proof-of-concept code is publicly available. Organizations should apply vendor updates when available and monitor for exploitation.

Business Impact: Low

Compensating Controls

Apply vendor patch. If patching is delayed: deploy WAF rules, restrict network access, enable logging.

Threat Intelligence Overview

EPSS Score

0.0%

Top 92% exploitable

Exploit

POC

Public exploit code exists

Data Quality

7 sources

Confidence: High

EUVD

NVD

CVE.org

EPSS

Vulnrichment

GitHub

VulDB

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue

Severity LOW

CISA KEV No

Public POC Yes

EPSS 0.0%

Patch available No

Active threat No

Deciding rule

LOW severity (CVSS 0.1-3.9)

What every action level means

Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.

Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.

This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.

This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.

Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.