CVE-2026-5551

HighCVSS 7.3

Published: 05/04/2026(UTC)Updated: 24/07/2026(UTC)Translated: 25/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.26%

18th percentile - higher than 18% of all known CVEs

Summary

A SQL injection vulnerability was found in Free Hotel Reservation System 1.0 in the file /hotel/admin/login.php via the email parameter. The attack can be performed remotely and the exploit is publicly available.

Risk Assessment

An attacker can remotely manipulate the database, potentially leading to data leakage or modification.

Recommendation

Immediately update the system to the latest version or apply a patch to prevent SQL injection.

Other vulnerabilities in Free Hotel Reservation System

CVE-2026-4966Medium
A flaw has been found in itsourcecode Free Hotel Reservation System 1.0 in /admin/mod_room/index.php?view=edit, where manipulation of the ID argument leads to SQL injection. The attack can be launched remotely and the exploit has been published.

Original NVD description (English source)

A security flaw has been discovered in itsourcecode Free Hotel Reservation System 1.0. This vulnerability affects unknown code of the file /hotel/admin/login.php of the component Parameter Handler. The manipulation of the argument email results in sql injection. The attack may be launched remotely. The exploit has been released to the public and may be used for attacks.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS