CVE-2026-14756 MEDIUM

CVE-2026-14756: code-projects Hotel and Tourism Reservation Tour Management add_tour.php sql injection

Vendor Code-Projects

Product Hotel and Tourism Reservation

Weakness CWE-89 · SQLi

Published July 5, 2026

Last update July 7, 2026

View on NVD All CVEs

CVSS base score

6.9/10

Attack vector Network

Attack complexity Low

Privileges required None

User interaction None

Confidentiality —

Integrity —

CVSS vector

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P

What the vulnerability does

01Description

A vulnerability was found in code-projects Hotel and Tourism Reservation 1.0. Affected by this issue is some unknown functionality of the file /admin/add_tour.php of the component Tour Management Page. The manipulation of the argument delete_image results in sql injection. The attack may be launched remotely. The exploit has been made public and could be used.

Key dates

02Disclosure timeline

July 5, 2026 CVE published

July 7, 2026 Record updated

External resources

03References

NVD — National Vulnerability Database https://nvd.nist.gov/vuln/detail/CVE-2026-14756 CWE — Common Weakness Enumeration https://cwe.mitre.org/data/definitions/89.html AskarLabs — CWE-89 write-up SQL Injection

Related vulnerabilities

CVE-2026-14756: code-projects Hotel and Tourism Reservation Tour Management add_tour.php sql injection

01Description

02Disclosure timeline

03References

04Related CVE