CVE-2026-15494
MediumCVSS 4.7Exploitation Probability (EPSS)
Low risk26th percentile - higher than 26% of all known CVEs
Summary
A SQL injection vulnerability has been found in AMTT Hotel Broadband Operation System 1.0 in the file manager/network/switch_status.php. Manipulating the ID argument allows remote exploitation. The exploit has been published and may be used.
Risk Assessment
An attacker can remotely steal, modify, or delete data from the system's database, potentially compromising the confidentiality and integrity of hotel data.
Recommendation
Immediately update the system to the latest version or apply temporary mitigations such as input filtering on the ID argument. If the vendor does not respond, consider replacing the system with a supported solution.
Other vulnerabilities in AMTT Hotel Broadband Operation System
See all- CVE-2026-7697Medium
A vulnerability was determined in AMTT Hotel Broadband Operation System 1.0 in an unknown function of the file /manager/card/cardhand_submit.php. Manipulation of the argument ID causes SQL injection, and remote exploitation is possible. The exploit has been publicly disclosed and may be utilized.
- CVE-2025-14090Medium
A security flaw was discovered in AMTT Hotel Broadband Operation System 1.0 affecting the file /manager/card/cardmake_down.php. Manipulation of the ID argument results in SQL injection, and the attack can be initiated remotely. The exploit has been released to the public and may be exploited.
Original NVD description (English source)
A flaw has been found in AMTT Hotel Broadband Operation System 1.0. Impacted is an unknown function of the file manager/network/switch_status.php. Executing a manipulation of the argument ID can lead to sql injection. It is possible to launch the attack remotely. The exploit has been published and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS