{"id":"CVE-2026-114441","summary":"oretnom23 php-travel-agency-system update.php sql injection","details":"A weakness has been identified in oretnom23 php-travel-agency-system. This issue affects some unknown processing of the file admin/update.php. This manipulation of the argument action/full_name/visa_no/hiden/title/description/page_id/user causes sql injection. The attack may be initiated remotely. The exploit has been made available to the public and could be used for attacks. This product uses a rolling release model to deliver continuous updates. As a result, specific version information for affected or updated releases is not available. The project was informed of the problem early through an issue report but has not responded yet.","modified":"2026-10-22T10:45:53.702049441Z","published":"2026-10-21T22:45:18.510Z","database_specific":{"cna_assigner":"VulDB","cwe_ids":["CWE-74","CWE-89"],"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/114xxx/CVE-2026-114441.json"},"references":[{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/114xxx/CVE-2026-114441.json"},{"type":"WEB","url":"https://github.com/oretnom23/php-travel-agency-system/"},{"type":"REPORT","url":"https://github.com/oretnom23/php-travel-agency-system/issues/4"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-114441"},{"type":"ADVISORY","url":"https://vuldb.com/cve/CVE-2026-114441"},{"type":"ADVISORY","url":"https://vuldb.com/submit/1020180"},{"type":"ADVISORY","url":"https://vuldb.com/vuln/424814"},{"type":"REPORT","url":"https://vuldb.com/vuln/424814/cti"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/oretnom23/php-travel-agency-system","events":[{"introduced":"4e28b8f84d72420373dd15c3ae32900beb7e0635"},{"last_affected":"b58513f8371d098650fac656001bf8f59f795d25"}],"database_specific":{"extracted_events":[{"source":"AFFECTED_FIELD","strategy":"StandaloneSingleVersion","range":[{"introduced":"4e28b8f84d72420373dd15c3ae32900beb7e0635"},{"last_affected":"4e28b8f84d72420373dd15c3ae32900beb7e0635"}]},{"source":"AFFECTED_FIELD","strategy":"StandaloneSingleVersion","range":[{"introduced":"2592d60d8f2c6e199f02c828c6d6fbc7b5298c96"},{"last_affected":"2592d60d8f2c6e199f02c828c6d6fbc7b5298c96"}]},{"strategy":"StandaloneSingleVersion","range":[{"introduced":"b58513f8371d098650fac656001bf8f59f795d25"},{"last_affected":"b58513f8371d098650fac656001bf8f59f795d25"}],"source":"AFFECTED_FIELD"}]}}],"versions":["2592d60d8f2c6e199f02c828c6d6fbc7b5298c96","4e28b8f84d72420373dd15c3ae32900beb7e0635","b58513f8371d098650fac656001bf8f59f795d25"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-114441.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P"}]}