Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
5.5

SourceCodester Hotel Management System SQL Injection

CVE-2026-7506 · published 6 months ago
Summary

The SourceCodester Hotel Management System has a security flaw that allows hackers to inject malicious SQL code, potentially allowing them to access sensitive data. This could happen if an attacker manipulates data sent to the system's reservation check feature. The vulnerability can be exploited remotely, and since it's been publicly disclosed, attackers may try to use it. It's essential for the system administrators to update or patch the system to prevent any potential attacks.

Original advisory text
A vulnerability has been found in SourceCodester Hotel Management System 1.0. This impacts an unknown function of the file /index.php/reservation/check. Such manipulation of the argument room_type ...
A vulnerability has been found in SourceCodester Hotel Management System 1.0. This impacts an unknown function of the file /index.php/reservation/check. Such manipulation of the argument room_type leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used.
References
Fix within
Internet-facing 14 days
Internal 60 days
  • Not known to be exploited
  • Can be exploited automatically
  • Gives an attacker partial control
Severity
5.5 Medium
Exploitation
<1% chance of attack within 30 days
Type
CWE-74Injection
CWE-89SQL Injection
Timeline
Published30 Apr 2026
Updated4 Nov 2026
First seen1 May 2026
Sources
CVE-2026-7506 · NVD
Track software like this
Free during beta