Hotel Tourism Reservation EUVD-2026-41760

Q: What is the CVSS score of EUVD-2026-41760?

EUVD-2026-41760 has a CVSS 4.0 base score of 5.5 (Medium). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.3%.

| CVE-2026-14754 MEDIUM

Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') (CWE-74)

2026-07-05 cna@vuldb.com

GHSA-6rqx-fwrh-2hr3

PHP SQLi

5.5

CVSS 4.0 · Vendor: vuldb

Severity by source

Vendor (vuldb) PRIMARY

5.5 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

6.3 MEDIUM

Admin-panel endpoint implies at least low-privilege access; L/L/L impact consistent with SQL injection of limited scope in a demo application.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N

Primary rating from Vendor (vuldb).

CVSS VectorVendor: vuldb

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Jul 05, 2026 - 14:36 vuln.today

DescriptionCVE.org

A flaw has been found in code-projects Hotel and Tourism Reservation 1.0. Affected is an unknown function of the file /admin/add_room.php. Executing a manipulation of the argument delete_image/edit/description/number/price/rooms/type can lead to sql injection. The attack can be launched remotely. The exploit has been published and may be used.

AnalysisAI

SQL injection in code-projects Hotel and Tourism Reservation 1.0 exposes the admin panel endpoint /admin/add_room.php to database manipulation via multiple unsanitized parameters. A proof-of-concept exploit has been publicly documented in a Medium article, lowering the barrier for opportunistic exploitation. The CVSS 4.0 vector rates this as network-reachable with no authentication required (PR:N), though this conflicts with the admin-panel location of the endpoint - a discrepancy that should be verified, as exploitation scope depends entirely on whether the admin interface enforces access controls.

Technical ContextAI

The affected product is a PHP-based hotel and tourism reservation management system distributed by code-projects.org, a repository primarily serving student and demo-grade applications. The vulnerability resides in /admin/add_room.php, a room management handler that passes user-supplied input from multiple parameters - delete_image, edit, description, number, price, rooms, and type - directly into SQL queries without sanitization or parameterization. CWE-74 (Injection) identifies the root cause as failure to properly neutralize special elements before they are interpreted by a downstream SQL interpreter. This is a classic unsanitized input-to-query flaw common in student PHP codebases lacking prepared statements or ORM abstraction.

RemediationAI

No vendor-released patch identified at time of analysis. The product originates from code-projects.org, a student/demo repository that does not maintain a formal security response process, making an official patch unlikely. The primary fix is to refactor all database interactions in /admin/add_room.php to use PHP PDO or MySQLi prepared statements with bound parameters, eliminating the injection surface entirely. If the application must remain accessible, restrict the /admin/ directory to trusted IP ranges via web server configuration (Apache .htaccess or nginx allow/deny directives) - this limits exposure but does not fix the underlying flaw. For production environments, replacing or decommissioning this application is strongly recommended given its student-grade provenance. Reference: https://medium.com/@avdzav10/sql-injection-in-hotel-and-tourism-reservation-system-php-1-0-admin-add-room-php-25149909c16a and https://vuldb.com/vuln/376343.