CVE-2026-3746
SourceCodester Simple Responsive Tourism Website Login Login.php sql injection
- State
- Published
- Severity
- 6.9 Medium
- Published
- Mar 8, 2026
- Updated
- Mar 11, 2026
- Reserved
- Mar 7, 2026
Description
A vulnerability was determined in SourceCodester Simple Responsive Tourism Website 1.0. Affected by this vulnerability is an unknown functionality of the file /tourism/classes/Login.php?f=login of the component Login. This manipulation of the argument Username causes sql injection. The attack may be initiated remotely. The exploit has been publicly disclosed and may be utilized.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 4.0 | 6.9 Medium | CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P | VulDB |
| 3.1 | 7.3 High | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R | VulDB |
| 3.0 | 7.3 High | CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R | VulDB |
| 2.0 | 7.5 High | AV:N/AC:L/Au:N/C:P/I:P/A:P/E:POC/RL:ND/RC:UR | VulDB |
Weaknesses
Affected Products
| Product | Versions |
|---|---|
Simple Responsive Tourism WebsiteSourceCodester |
|
References
- VDB-349724 | SourceCodester Simple Responsive Tourism Website Login Login.php sql injectionvdb-entrytechnical-description
- VDB-349724 | CTI Indicators (IOB, IOC, TTP, IOA)signaturepermissions-required
- Submit #767882 | sourcecodester.com Simple Responsive Tourism Website V1.0 SQL Injectionthird-party-advisory
- https://github.com/CH0ico/CVE_choco_7related
- https://github.com/CH0ico/CVE_choco_7/blob/main/report.mdexploit
- https://www.sourcecodester.com/product
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.