CVE-2026-10288 MEDIUM

CVE-2026-10288: code-projects Hotel and Tourism Reservation System Admin Login login.php password_verify improper authentication

Vendor Code-Projects
Product Hotel and Tourism Reservation System
Weakness CWE-287 · Improper authentication
Published June 1, 2026
Last update June 2, 2026
View on NVD All CVEs

CVSS base score

6.9/10
Attack vector Network
Attack complexity Low
Privileges required None
User interaction None
Confidentiality —
Integrity —

CVSS vector

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P

What the vulnerability does

Description

A vulnerability was identified in code-projects Hotel and Tourism Reservation System 1.0. This issue affects the function password_verify of the file /admin/login.php of the component Admin Login. Such manipulation of the argument Password leads to improper authentication. It is possible to launch the attack remotely. The exploit is publicly available and might be used.

Key dates

Disclosure timeline

June 1, 2026 CVE published
June 2, 2026 Record updated