PT-2026-45605 · Code Projects · Hotel/Tourism Reservation System

Imad Alvi · CVE-2026-10290 · Published 2026-06-01 · Updated 2026-06-01

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions code-projects Hotel and Tourism Reservation System version 1.0

Description A weakness in the GET Parameter Handler component within the tour.php file allows for remote SQL injection. This occurs when the tour argument is manipulated, enabling an attacker to interfere with the application's database queries.

Recommendations As a temporary workaround, restrict access to the tour parameter in the tour.php file to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Special Elements Injection

SQL injection

Weakness Enumeration

CWE-74

CWE-89

Related Identifiers

CVE-2026-10290

Affected Products

Hotel/Tourism Reservation System

References · 8

• 🔥❌ https://github.com/Xmyronn/Hotel-and-Tourism-Reservation-System---Unauthenticated-SQL-Injection.git · Exploit, Deleted
• https://nvd.nist.gov/vuln/detail/CVE-2026-10290 · Security Note
• https://vuldb.com/vuln/367583 · Note
• https://code-projects.org · Note
• https://vuldb.com/submit/825939 · Note
• https://vuldb.com/vuln/367583/cti · Note
• https://vuldb.com/cve/CVE-2026-10290 · Note
• https://t.me/CVEtracker/55528 · Telegram Post