CVE-2022-2656

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

A vulnerability classified as critical has been found in SourceCodester Multi Language Hotel Management Software. Affected is an unknown function. The manipulation of the argument email leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-205596.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-89

Affected software

Vendor	Product	Versions
SourceCodester	Multi Language Hotel Management Software	n/a

References

https://github.com/gdianq/Sparkz-Hotel-Management-loginpage-Sqlinjection/blob/main/README.mdExploit, Third Party Advisory
https://vuldb.com/?id.205596Permissions Required, Third Party Advisory
https://github.com/gdianq/Sparkz-Hotel-Management-loginpage-Sqlinjection/blob/main/README.mdExploit, Third Party Advisory
https://vuldb.com/?id.205596Permissions Required, Third Party Advisory

Timeline

Published: Aug 4, 2022
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2022

CVE-2022-265629.8An issue in provider/libserver/ECKrbAuth.cpp of Kopano Core <= v11.0.2.51 contains an issue which allows attackers to authenticate even if t CVE-2022-265638.8An issue was discovered in Tildeslash Monit before 5.31.0, allows remote attackers to gain escilated privlidges due to improper PAM-authoriz CVE-2022-265646.1HotelDruid Hotel Management Software v3.0.3 contains a cross-site scripting (XSS) vulnerability via the prezzoperiodo4 parameter in creaprez CVE-2022-265654.8A cross-site scripting (XSS) vulnerability in Totaljs all versions before commit 95f54a5commit, allows attackers to execute arbitrary web sc CVE-2022-26574.3The Multivendor Marketplace Solution for WooCommerce WordPress plugin before 3.8.12 is lacking authorisation and CSRF in multiple AJAX actio CVE-2022-265727.5Xerox ColorQube 8580 was discovered to contain an access control issue which allows attackers to print, view the status, and obtain sensitiv CVE-2022-265736.1Maccms v10 was discovered to contain multiple reflected cross-site scripting (XSS) vulnerabilities in /admin.php/admin/art/data.html via the CVE-2022-265796.0PAX A930 device with PayDroid_7.1.1_Virgo_V04.3.26T1_20210419 can allow a root privileged attacker to install unsigned packages. The attacke CVE-2022-26584.8The WP Spell Check WordPress plugin before 9.13 does not escape ignored words, which could allow high privilege users such as admin to perfo CVE-2022-265806.8PAX A930 device with PayDroid_7.1.1_Virgo_V04.3.26T1_20210419 can allow the execution of specific command injections on selected binaries in CVE-2022-265816.8PAX A930 device with PayDroid_7.1.1_Virgo_V04.3.26T1_20210419 can allow an unauthorized attacker to perform privileged actions through the e CVE-2022-265827.8PAX A930 device with PayDroid_7.1.1_Virgo_V04.3.26T1_20210419 can allow an attacker to gain root access through command injection in systool