CVE-2026-10290
HIGHHotel and Tourism Reservation System 1.0 - SQL Injection via tour.php GET Parameter
Title source: llmExploitation Summary
EIP tracks 1 public exploit for CVE-2026-10290. PoCs published by Xmyronn.
AI-analyzed exploit summary This repository provides a detailed technical analysis of CVE-2026-10290, an unauthenticated SQL injection vulnerability in the Hotel and Tourism Reservation System 1.0. It includes vulnerable code snippets, steps to reproduce, and impact analysis, demonstrating a clear understanding of the vulnerability.
Description
A weakness has been identified in code-projects Hotel and Tourism Reservation System 1.0. The affected element is an unknown function of the file tour.php of the component GET Parameter Handler. Executing a manipulation of the argument tour can lead to sql injection. The attack can be launched remotely. The exploit has been made available to the public and could be used for attacks.
Exploits (1)
This repository provides a detailed technical analysis of CVE-2026-10290, an unauthenticated SQL injection vulnerability in the Hotel and Tourism Reservation System 1.0. It includes vulnerable code snippets, steps to reproduce, and impact analysis, demonstrating a clear understanding of the vulnerability.
References (6)
Scores
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L