Which versions of Hotel and Tourism Reservation System are affected by EUVD-2026-33762?

The code-projects Hotel and Tourism Reservation System 1.0 contains an authentication bypass vulnerability enabling remote attackers to gain unauthorized administrator access without valid…

Is there a public PoC exploit available for EUVD-2026-33762?

Yes, a public proof-of-concept exploit is available for EUVD-2026-33762. Prioritise patching immediately. EPSS: 0.1%.

How to fix or mitigate EUVD-2026-33762?

24 hours: Identify all deployed instances of code-projects Hotel and Tourism Reservation System 1.0; isolate or restrict network access to the admin panel from untrusted sources; review authentication logs for suspicious attempts against /admin/login.php. 7 days: Deploy Web Application Firewall rules targeting password_verify manipulation patterns; implement alerting on anomalous admin authentication events; request patch timeline and technical guidance from the vendor. 30 days: Plan system upgrade or replacement with a supported alternative; evaluate comparable booking platforms with active security maintenance; document all interim security controls applied for compliance audit.

Hotel and Tourism Reservation System EUVD-2026-33762

Q: What is the CVSS score of EUVD-2026-33762?

EUVD-2026-33762 has a CVSS 4.0 base score of 5.5 (Medium). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.1%.

| CVE-2026-10288 MEDIUM

Improper Authentication (CWE-287)

2026-06-01 VulDB

GHSA-qr63-7ppg-q2f9

PHP Authentication Bypass Hotel And Tourism Reservation System Code Projects

5.5

CVSS 4.0 · Vendor: VulDB

Severity by source

Vendor (VulDB) PRIMARY

5.5 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from Vendor (VulDB) · only source for this CVE.

CVSS VectorVendor: VulDB

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Severity Changed

Jun 01, 2026 - 21:22 NVD

HIGH MEDIUM

CVSS changed

Jun 01, 2026 - 21:22 NVD

7.3 (HIGH) 5.5 (MEDIUM)

Analysis Generated

Jun 01, 2026 - 20:52 vuln.today

DescriptionCVE.org

A vulnerability was identified in code-projects Hotel and Tourism Reservation System 1.0. This issue affects the function password_verify of the file /admin/login.php of the component Admin Login. Such manipulation of the argument Password leads to improper authentication. It is possible to launch the attack remotely. The exploit is publicly available and might be used.

AnalysisAI

Authentication bypass in code-projects Hotel and Tourism Reservation System 1.0 allows remote attackers to defeat admin login by manipulating the Password argument processed by the password_verify function in /admin/login.php. The flaw is reachable over the network without prior authentication, and publicly available exploit code exists, increasing the likelihood of opportunistic abuse against exposed deployments.

Technical ContextAI

The affected application is a PHP-based hotel and tourism reservation web application distributed by code-projects (CPE: cpe:2.3:a:code-projects:hotel_and_tourism_reservation_system). The root cause maps to CWE-287 (Improper Authentication): the admin login flow misuses or mishandles PHP's password_verify() comparison in /admin/login.php, allowing the authentication check to be bypassed via crafted input in the Password field. This pattern typically arises when developers compare hashes loosely ( vs =), accept type-juggled values, or fail to validate inputs before passing them to password_verify, enabling magic-hash style or type-confusion bypasses common to PHP authentication routines.

RemediationAI

No vendor-released patch identified at time of analysis; operators should monitor https://code-projects.org/ and the VulDB entry at https://vuldb.com/vuln/367581 for an updated release of Hotel and Tourism Reservation System beyond 1.0. As compensating controls, restrict network access to /admin/login.php via web server allowlists or VPN-only access (trade-off: legitimate remote admins must use the VPN), place the application behind a WAF with a rule blocking non-string or array-typed Password parameters and known magic-hash payloads sent to /admin/login.php (trade-off: may break legitimate logins with unusual character sets), and audit the login.php source to replace any loose-comparison () of password_verify return values with strict (=) checks and to cast/validate the Password POST parameter to string before use. Where the application is non-essential or only used in lab/training contexts, the most reliable mitigation is to take it offline until a fixed version is released.