SQL Injection in Oretnom23 Php-Travel-Agency-System
CVE-2026-114441
A weakness has been identified in oretnom23 php-travel-agency-system. This issue affects some unknown processing of the file admin/update.php. This manipulation of the argument action/full_name/visa_no/hiden/title/description/page_id/user causes sql injection. The attack may be initiated remotely. The exploit has been made available to the public and could be used for attacks. This product uses a rolling release model to deliver continuous updates. As a result, specific version information for affected or updated releases is not available. The project was informed of the problem early through an issue report but has not responded yet.
Published · last modified .
CVSS v3 metric
CVSS v3 base score 7.3 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L.
EPSS exploit prediction
No EPSS score from FIRST.org yet. New CVEs usually get one within a few days; no score means no signal yet, not low risk. How EPSS works.
Affected products
- Oretnom23 Php-Travel-Agency-System — versions 2592d60d8f2c6e199f02c828c6d6fbc7b5298c96, 4e28b8f84d72420373dd15c3ae32900beb7e0635, b58513f8371d098650fac656001bf8f59f795d25
Weakness classification (CWE)
References
- vuldb.com/vuln/424814 (technical-description, vdb-entry)
- vuldb.com/vuln/424814/cti (signature, permissions-required)
- vuldb.com/cve/CVE-2026-114441 (third-party-advisory)
- vuldb.com/submit/1020180 (third-party-advisory)
- github.com/oretnom23/php-travel-agency-system/issues/4 (issue-tracking, exploit)
- github.com/oretnom23/php-travel-agency-system/ (product)
Frequently asked questions
- What is CVE-2026-114441?
- CVE-2026-114441 is a high-severity vulnerability in Oretnom23 Php-Travel-Agency-System, classified under Improper Neutralization of Special Elements in Output Used by a Downstream Component (Injection). CVSS score: 7.3/10. Published 2026-10-21.
- How severe is CVE-2026-114441?
- High severity. CVSS v3 base score is 7.3 out of 10.