Live › vulnerability › CVE-2026-114577
Go to dashboardThe php-travel-agency-system admin/insert.php script builds SQL queries from several request parameters without proper escaping. A remote attacker can inject SQL to read, change or delete data in the application's database.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Teams running the oretnom23 php-travel-agency-system project, especially if the admin area is reachable from the internet. Deployments that do not run this project or that block the admin directory from outside access are less exposed.
No product ranges from the sources yet.
admin/insert.php in the php-travel-agency-system code.admin/insert.php.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
A vulnerability was found in oretnom23 php-travel-agency-system. This vulnerability affects unknown code of the file admin/insert.php of the component Insertion Handler. The manipulation of the argument costomer_id/payment_type/amount/description/user/uploadimage/full_name/visa_no results in sql injection. The attack may be launched remotely. The exploit has been made public and could be used. The project was informed of the problem early through an issue report but has not responded yet.
This page as .md · .json · in your agent: get_signal("CVE-2026-114577")
NVD data is provided by NIST and is public domain · EPSS scores by FIRST, used with attribution. Posts quoted belong to their authors.