Skip to content
OpenAdvisories
High · 7.3 Public exploit CVE-2026-14762 EUVD-2026-41772GHSA-5766-68gf-h8q9

code-projects Hotel and Tourism Reservation Room Management rooms.php sql injection

Published Jul 5, 2026 · Updated Jul 7, 2026 · Assigned by VulDB

Vendor: code-projects Product: Hotel and Tourism Reservation

Description

A vulnerability was detected in code-projects Hotel and Tourism Reservation 1.0. The impacted element is an unknown function of the file /admin/rooms.php of the component Room Management Page. The manipulation of the argument delete results in sql injection. It is possible to launch the attack remotely. The exploit is now public and may be used.

Affected products

VendorProductAffectedFixed
code-projects Hotel and Tourism Reservation 1.0 —

Public exploits

Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.

Third-party code, not reviewed by us. Public PoCs are sometimes fake or contain malware. Read the code first and run it only in an isolated lab, against systems you are authorised to test.

GitHub 1 repository

  • tc4dy/CVE-2026-14762-PoC-Exploit ★ 1 · Jul 7, 2026

    CVE-2026-14762 exploit for Hotel & Tourism Reservation 1.0. Time-based blind SQL injection via /admin/rooms.php?delete. Dumps DB, tables, columns, reads files, writes webshells. Multi-threaded, proxy…

Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.

References