CVE-2026-4966

MediumCVSS 6.3

Published: 27/03/2026(UTC)Updated: 26/10/2026(UTC)Translated: 27/10/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.26%

18th percentile - higher than 18% of all known CVEs

Summary

A flaw has been found in itsourcecode Free Hotel Reservation System 1.0 in /admin/mod_room/index.php?view=edit, where manipulation of the ID argument leads to SQL injection. The attack can be launched remotely and the exploit has been published.

Risk Assessment

Unauthorized SQL queries could be executed, potentially leading to data leakage or modification.

Recommendation

Update the software to a patched version or implement input validation and parameterized queries.

Other vulnerabilities in Free Hotel Reservation System

CVE-2026-5551High
A SQL injection vulnerability was found in Free Hotel Reservation System 1.0 in the file /hotel/admin/login.php via the email parameter. The attack can be performed remotely and the exploit is publicly available.

Original NVD description (English source)

A flaw has been found in itsourcecode Free Hotel Reservation System 1.0. Impacted is an unknown function of the file /admin/mod_room/index.php?view=edit. Executing a manipulation of the argument ID can lead to sql injection. The attack can be launched remotely. The exploit has been published and may be used.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS