CVE-2026-122191 · Other
NO FIX YET
The itsourcecode Airline Reservation System 1.0 admin page /admin/manage_booked.php does not properly handle the ID parameter, allowing SQL injection. An attacker can read or change database contents by sending crafted requests remotely, and a public exploit has been disclosed.
first public Nov 5, 2026 · 1 source
Check it with your coding agent
It checks your repository and tells you if you’re affected, with the fix.
Teams running the itsourcecode Airline Reservation System 1.0 web application with the admin area reachable over the network are exposed. The sources do not say whether authentication is required to reach the admin page, so treat any internet-reachable instance as at risk until checked.
Not affected if admin-not-exposed
Who cares airline-reservation-system, itsourcecode, php
Unknown from the sources.
No fix yet, per the sources.
A vulnerability was determined in itsourcecode Airline Reservation System 1.0. This affects an unknown function of the file /admin/manage_booked.php. Executing a manipulation of the argument ID can lead to sql injection. The attack may be launched remotely. The exploit has been publicly disclosed and may be utilized.
This page as .md · .json · CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.