Live › vulnerability › CVE-2026-114441
Go to dashboardThe oretnom23 PHP travel agency system has an SQL injection flaw in admin/update.php, where several request parameters reach the database unsanitized. A remote attacker can read or change database contents, and the exploit is public.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Deployments of oretnom23 php-travel-agency-system that expose admin/update.php to the network are exposed. The sources do not say which configurations or versions are affected, so teams running this project should treat any internet-reachable instance as at risk.
No product ranges from the sources yet.
admin/update.php in the web rootEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
A weakness has been identified in oretnom23 php-travel-agency-system. This issue affects some unknown processing of the file admin/update.php. This manipulation of the argument action/full_name/visa_no/hiden/title/description/page_id/user causes sql injection. The attack may be initiated remotely. The exploit has been made available to the public and could be used for attacks. This product uses a rolling release model to deliver continuous updates. As a result, specific version information for affected or updated releases is not available. The project was informed of the problem early through an issue report but has not responded yet.
This page as .md · .json · in your agent: get_signal("CVE-2026-114441")
NVD data is provided by NIST and is public domain · EPSS scores by FIRST, used with attribution. Posts quoted belong to their authors.