Logo
Retour à la veille

CVE-2026-114440

Publié : 21 octobre 2026
Modifié : 21 octobre 2026
Lien officiel NVD
Score CVSS
7.3
HIGH

Description détaillée

A vulnerability was identified in oretnom23 php-travel-agency-system. This affects an unknown part of the file admin/delete.php. The manipulation of the argument costomer_id/ticket_id/payment_id/id/document_id/salary_id/emp_id/user_id leads to sql injection. The attack can be initiated remotely. The exploit is publicly available and might be used. Continious delivery with rolling releases is used by this product. Therefore, no version details of affected nor updated releases are available. The project was informed of the problem early through an issue report but has not responded yet.

Vecteur d'attaque (CVSS)

Vecteur brut :CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

Références et Patchs

https://github.com/oretnom23/php-travel-agency-system/https://github.com/oretnom23/php-travel-agency-system/issues/3https://vuldb.com/cve/CVE-2026-114440https://vuldb.com/submit/1020179https://vuldb.com/vuln/424812https://vuldb.com/vuln/424812/cti

Dernières Vulnérabilités

CVE-2026-96398

Incorrect Authorization vulnerability in Drupal Webform allows Forceful Browsing. This issue affects Webform versions: from 0.0.0 to 6.2.12, from 6.3.0 to 6.3.1.

VOIR DÉTAILS

CVE-2026-96392

Improper Neutralization of Special Elements Used in a Template Engine vulnerability in Drupal AI CKEditor allows Code Injection. This issue affects AI CKEditor versions: from 0.0.0 to 1.4.3.

VOIR DÉTAILS

CVE-2026-96391

Missing Authorization vulnerability in Drupal Webform REST allows Forceful Browsing. This issue affects Webform REST versions: from 0.0.0 to 4.2.1.

VOIR DÉTAILS