CVE-2026-2553

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-2553", "assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "state": "PUBLISHED", "assignerShortName": "VulDB", "dateReserved": "2026-02-15T16:23:07.821Z", "datePublished": "2026-02-16T11:32:06.780Z", "dateUpdated": "2026-02-23T10:09:02.428Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "shortName": "VulDB", "dateUpdated": "2026-02-23T10:09:02.428Z"}, "title": "tushar-2223 Hotel-Management-System HTTP POST Request home.php sql injection", "problemTypes": [{"descriptions": [{"type": "CWE", "cweId": "CWE-89", "lang": "en", "description": "SQL Injection"}]}, {"descriptions": [{"type": "CWE", "cweId": "CWE-74", "lang": "en", "description": "Injection"}]}], "affected": [{"vendor": "tushar-2223", "product": "Hotel-Management-System", "versions": [{"version": "bb1f3b3666124b888f1e4bcf51b6fba9fbb01d15", "status": "affected"}], "modules": ["HTTP POST Request Handler"]}], "descriptions": [{"lang": "en", "value": "A security flaw has been discovered in tushar-2223 Hotel-Management-System up to bb1f3b3666124b888f1e4bcf51b6fba9fbb01d15. This affects an unknown part of the file /home.php of the component HTTP POST Request Handler. Performing a manipulation of the argument Name/Email results in sql injection. The attack can be initiated remotely. The exploit has been released to the public and may be used for attacks. Continious delivery with rolling releases is used by this product. Therefore, no version details of affected nor updated releases are available. The vendor was contacted early about this disclosure but did not respond in any way."}], "metrics": [{"cvssV4_0": {"version": "4.0", "baseScore": 5.3, "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P", "baseSeverity": "MEDIUM"}}, {"cvssV3_1": {"version": "3.1", "baseScore": 6.3, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R", "baseSeverity": "MEDIUM"}}, {"cvssV3_0": {"version": "3.0", "baseScore": 6.3, "vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R", "baseSeverity": "MEDIUM"}}, {"cvssV2_0": {"version": "2.0", "baseScore": 6.5, "vectorString": "AV:N/AC:L/Au:S/C:P/I:P/A:P/E:POC/RL:ND/RC:UR"}}], "timeline": [{"time": "2026-02-15T00:00:00.000Z", "lang": "en", "value": "Advisory disclosed"}, {"time": "2026-02-15T01:00:00.000Z", "lang": "en", "value": "VulDB entry created"}, {"time": "2026-02-20T09:54:17.000Z", "lang": "en", "value": "VulDB entry last update"}], "credits": [{"lang": "en", "value": "alexperrakis (VulDB User)", "type": "reporter"}], "references": [{"url": "https://vuldb.com/?id.346162", "name": "VDB-346162 | tushar-2223 Hotel-Management-System HTTP POST Request home.php sql injection", "tags": ["vdb-entry", "technical-description"]}, {"url": "https://vuldb.com/?ctiid.346162", "name": "VDB-346162 | CTI Indicators (IOB, IOC, TTP, IOA)", "tags": ["signature", "permissions-required"]}, {"url": "https://vuldb.com/?submit.750080", "name": "Submit #750080 | tushar-2223 Hotel Management System Up to commit (including) bb1f3b3666124b888f1e4bcf51b6fba9fbb01d15 SQL Injection", "tags": ["third-party-advisory"]}, {"url": "https://github.com/Stolichnayer/SQLi-Hotel-Management-System", "tags": ["related"]}, {"url": "https://github.com/Stolichnayer/SQLi-Hotel-Management-System?tab=readme-ov-file#%EF%B8%8F-steps-to-reproduce", "tags": ["exploit"]}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-02-17T16:37:13.604382Z", "id": "CVE-2026-2553", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-02-17T16:37:22.685Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-2553", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-02-17T16:37:13.604382Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-02-17T16:37:18.560Z"}}], "cna": {"title": "tushar-2223 Hotel-Management-System HTTP POST Request home.php sql injection", "credits": [{"lang": "en", "type": "reporter", "value": "alexperrakis (VulDB User)"}], "metrics": [{"cvssV4_0": {"version": "4.0", "baseScore": 5.3, "baseSeverity": "MEDIUM", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P"}}, {"cvssV3_1": {"version": "3.1", "baseScore": 6.3, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R"}}, {"cvssV3_0": {"version": "3.0", "baseScore": 6.3, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R"}}, {"cvssV2_0": {"version": "2.0", "baseScore": 6.5, "vectorString": "AV:N/AC:L/Au:S/C:P/I:P/A:P/E:POC/RL:ND/RC:UR"}}], "affected": [{"vendor": "tushar-2223", "modules": ["HTTP POST Request Handler"], "product": "Hotel-Management-System", "versions": [{"status": "affected", "version": "bb1f3b3666124b888f1e4bcf51b6fba9fbb01d15"}]}], "timeline": [{"lang": "en", "time": "2026-02-15T00:00:00.000Z", "value": "Advisory disclosed"}, {"lang": "en", "time": "2026-02-15T01:00:00.000Z", "value": "VulDB entry created"}, {"lang": "en", "time": "2026-02-20T09:54:17.000Z", "value": "VulDB entry last update"}], "references": [{"url": "https://vuldb.com/?id.346162", "name": "VDB-346162 | tushar-2223 Hotel-Management-System HTTP POST Request home.php sql injection", "tags": ["vdb-entry", "technical-description"]}, {"url": "https://vuldb.com/?ctiid.346162", "name": "VDB-346162 | CTI Indicators (IOB, IOC, TTP, IOA)", "tags": ["signature", "permissions-required"]}, {"url": "https://vuldb.com/?submit.750080", "name": "Submit #750080 | tushar-2223 Hotel Management System Up to commit (including) bb1f3b3666124b888f1e4bcf51b6fba9fbb01d15 SQL Injection", "tags": ["third-party-advisory"]}, {"url": "https://github.com/Stolichnayer/SQLi-Hotel-Management-System", "tags": ["related"]}, {"url": "https://github.com/Stolichnayer/SQLi-Hotel-Management-System?tab=readme-ov-file#%EF%B8%8F-steps-to-reproduce", "tags": ["exploit"]}], "descriptions": [{"lang": "en", "value": "A security flaw has been discovered in tushar-2223 Hotel-Management-System up to bb1f3b3666124b888f1e4bcf51b6fba9fbb01d15. This affects an unknown part of the file /home.php of the component HTTP POST Request Handler. Performing a manipulation of the argument Name/Email results in sql injection. The attack can be initiated remotely. The exploit has been released to the public and may be used for attacks. Continious delivery with rolling releases is used by this product. Therefore, no version details of affected nor updated releases are available. The vendor was contacted early about this disclosure but did not respond in any way."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-89", "description": "SQL Injection"}]}, {"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-74", "description": "Injection"}]}], "providerMetadata": {"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "shortName": "VulDB", "dateUpdated": "2026-02-23T10:09:02.428Z"}}}, "cveMetadata": {"cveId": "CVE-2026-2553", "state": "PUBLISHED", "dateUpdated": "2026-02-23T10:09:02.428Z", "dateReserved": "2026-02-15T16:23:07.821Z", "assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "datePublished": "2026-02-16T11:32:06.780Z", "assignerShortName": "VulDB"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"modules": ["HTTP POST Request Handler"], "product": "Hotel-Management-System", "vendor": "tushar-2223", "versions": [{"status": "affected", "version": "bb1f3b3666124b888f1e4bcf51b6fba9fbb01d15"}]}], "source": "cna@vuldb.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "A security flaw has been discovered in tushar-2223 Hotel-Management-System up to bb1f3b3666124b888f1e4bcf51b6fba9fbb01d15. This affects an unknown part of the file /home.php of the component HTTP POST Request Handler. Performing a manipulation of the argument Name/Email results in sql injection. The attack can be initiated remotely. The exploit has been released to the public and may be used for attacks. Continious delivery with rolling releases is used by this product. Therefore, no version details of affected nor updated releases are available. The vendor was contacted early about this disclosure but did not respond in any way."}, {"lang": "es", "value": "Una falla de seguridad ha sido descubierta en tushar-2223 Hotel-Management-System hasta bb1f3b3666124b888f1e4bcf51b6fba9fbb01d15. Esto afecta una parte desconocida del archivo /home.PHP del componente HTTP POST Request Handler. Realizar una manipulaci\u00f3n del argumento Name/Email resulta en inyecci\u00f3n SQL. El ataque puede ser iniciado remotamente. El exploit ha sido publicado al p\u00fablico y puede ser usado para ataques. Entrega continua con lanzamientos continuos es utilizada por este producto. Por lo tanto, no hay detalles de versi\u00f3n de lanzamientos afectados ni actualizados disponibles. El proveedor fue contactado tempranamente sobre esta divulgaci\u00f3n pero no respondi\u00f3 de ninguna manera."}], "id": "CVE-2026-2553", "lastModified": "2026-06-17T10:31:18.230", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "MEDIUM", "cvssData": {"accessComplexity": "LOW", "accessVector": "NETWORK", "authentication": "SINGLE", "availabilityImpact": "PARTIAL", "baseScore": 6.5, "confidentialityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "vectorString": "AV:N/AC:L/Au:S/C:P/I:P/A:P", "version": "2.0"}, "exploitabilityScore": 8.0, "impactScore": 6.4, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "cna@vuldb.com", "type": "Secondary", "userInteractionRequired": false}], "cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 6.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 3.4, "source": "cna@vuldb.com", "type": "Secondary"}], "cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 2.1, "baseSeverity": "LOW", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "PROOF_OF_CONCEPT", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "LOW", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "LOW", "vulnConfidentialityImpact": "LOW", "vulnIntegrityImpact": "LOW", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "cna@vuldb.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-2553", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-02-17T16:37:13.604382Z", "version": "2.0.3"}}]}, "published": "2026-02-16T12:16:22.480", "references": [{"source": "cna@vuldb.com", "url": "https://github.com/Stolichnayer/SQLi-Hotel-Management-System"}, {"source": "cna@vuldb.com", "url": "https://github.com/Stolichnayer/SQLi-Hotel-Management-System?tab=readme-ov-file#%EF%B8%8F-steps-to-reproduce"}, {"source": "cna@vuldb.com", "url": "https://vuldb.com/?ctiid.346162"}, {"source": "cna@vuldb.com", "url": "https://vuldb.com/?id.346162"}, {"source": "cna@vuldb.com", "url": "https://vuldb.com/?submit.750080"}], "sourceIdentifier": "cna@vuldb.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-74"}, {"lang": "en", "value": "CWE-89"}], "source": "cna@vuldb.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "bb1f3b3666124b888f1e4bcf51b6fba9fbb01d15"}}], "product": "hotel-management-system", "vendor": "tushar-2223"}], "analysis": {"en": {"generated_at": "2026-04-17T19:06:15.247662+00:00", "value": {"mitigation_remediation": ["Sanitize and validate the Name and Email inputs to eliminate dangerous characters before using them in any SQL query.", "Refactor the database access in home.php to use parameterized queries or prepared statements rather than string concatenation.", "Apply any vendor\u2011provided patch or upgrade to a commit that fixes the issue; if none is available, restrict access to or disable the home.php endpoint until a fix is released."], "summary": {"action": "Mitigate", "impact": "Database compromise via unchecked input"}, "threat_synthesis": {"affected_systems": "The flaw affects the tushar-2223 Hotel-Management-System, specifically the home.php component. Because the product follows a continuous delivery model, no specific version numbers are listed; the vulnerability exists in all releases up to commit bb1f3b3666124b888f1e4bcf51b6fba9fbb01d15. Therefore any current installation prior to that commit is potentially vulnerable.", "description_and_impact": "The vulnerability is a classic SQL injection that occurs when an attacker crafts the Name or Email parameters in an HTTP POST request to the home.php handler. By injecting malicious SQL via these fields, an attacker can read, modify, or delete data in the application database. This flaw can lead to compromised confidentiality and integrity of the stored information and potentially allow privilege escalation if administrative data is exposed.", "risk_and_exploitability": "With a CVSS score of 5.3, the vulnerability is considered moderate. The EPSS score is below 1%, indicating a low probability of exploitation, and the issue is not listed in the CISA KEV catalog. However, the vulnerability can be triggered remotely via an HTTP POST request without additional prerequisites, and public exploit code has been released, making it a passive target for automated attacks. The risk is therefore moderate due to the severity, but the likelihood of exploitation remains low at present."}}}}, "created": "2026-02-17T08:49:50.096036+00:00", "updated": "2026-04-17T19:15:26.248108+00:00", "vendors": ["tushar-2223", "tushar-2223$PRODUCT$hotel-management-system"]}