PT-2026-45553 · Code Projects · Hotel/Tourism Reservation System

Imad Alvi · CVE-2026-10288 · Published 2026-06-01 · Updated 2026-07-22

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions code-projects Hotel and Tourism Reservation System version 1.0

Description An issue in the Admin Login component allows remote attackers to achieve improper authentication. This occurs through the manipulation of the Password argument within the password verify() function located in the '/admin/login.php' endpoint.

Recommendations As a temporary workaround, restrict access to the '/admin/login.php' endpoint to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Improper Authentication

Weakness Enumeration

CWE-287

Related Identifiers

CVE-2026-10288

Affected Products

Hotel/Tourism Reservation System

References · 8

• 🔥❌ https://github.com/Xmyronn/Hotel-and-Tourism-Reservation-System---Authentication-Bypass.git · Exploit, Deleted
• https://nvd.nist.gov/vuln/detail/CVE-2026-10288 · Security Note
• https://vuldb.com/vuln/367581/cti · Note
• https://vuldb.com/cve/CVE-2026-10288 · Note
• https://vuldb.com/vuln/367581 · Note
• https://t.me/cveNotify/211641 · Telegram Post
• https://code-projects.org · Note
• https://vuldb.com/submit/825786 · Note