CVE-2026-117515
oretnom23 php-travel-agency-system traceapplication.php sql injection
oretnom23 php-travel-agency-systemRuntimes & languages
CVSS
6.9MediumExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)No scoreNo FIRST EPSS score in this snapshot yet
Fixed inNone listedNo source names a fixed version. Check the vendor advisory below
What fixes it
No source in this snapshot names a fixed version. The vendor advisories under References are the place to check.
Description
A security flaw has been discovered in oretnom23 php-travel-agency-system 4e28b8f84d72420373dd15c3ae32900beb7e0635. Impacted is an unknown function of the file traceapplication.php. The manipulation of the argument Search results in sql injection. It is possible to launch the attack remotely. The exploit has been released to the public and may be used for attacks. The project was informed of the problem early through an issue report but has not responded yet.
Text from CVE List
Affected versions 1
- php-travel-agency-systemaffected: 4e28b8f84d72420373dd15c3ae32900beb7e0635CVE List
References 6
- vuldb.com/cve/CVE-2026-117515Advisoryvia CVE List
- vuldb.com/submit/1024623Advisoryvia CVE List
- github.com/oretnom23/php-travel-agency-system/issues/9Exploitvia CVE List
- vuldb.com/vuln/427081Referencevia CVE List
- vuldb.com/vuln/427081/ctiReferencevia CVE List
- github.com/oretnom23/php-travel-agency-system/Referencevia CVE List