CVE-2026-3708

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

A security flaw has been discovered in code-projects Simple Flight Ticket Booking System 1.0. The impacted element is an unknown function of the file /login.php. Performing a manipulation of the argument Username results in sql injection. The attack may be initiated remotely. The exploit has been released to the public and may be used for attacks.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-74 CWE-89

Affected software

Vendor	Product	Versions
code-projects	Simple Flight Ticket Booking System	1.0

References

https://code-projects.org/Product
https://github.com/Owen-YuanW/CVE/issues/2Exploit, Issue Tracking, Third Party Advisory
https://vuldb.com/?ctiid.349654Permissions Required, VDB Entry
https://vuldb.com/?id.349654Third Party Advisory, VDB Entry
https://vuldb.com/?submit.766138Third Party Advisory, VDB Entry
https://vuldb.com/?submit.767290Third Party Advisory, VDB Entry
https://vuldb.com/?submit.768181Third Party Advisory, VDB Entry

Timeline

Published: Mar 8, 2026
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2026

CVE-2026-37099.8A weakness has been identified in code-projects Simple Flight Ticket Booking System 1.0. This affects an unknown function of the file /regis CVE-2026-37107.2A security vulnerability has been detected in code-projects Simple Flight Ticket Booking System 1.0. This impacts an unknown function of the CVE-2026-371006.5An issue in the Bluetooth Low Energy (BLE) control interface of the Yamaha SR-B30A sound bar firmware 2.40 (Mobile App: Sound Bar Remote / v CVE-2026-371069.8An issue in DokuWiki 2025-05-14b "Librarian" 56.2 allows a remote attacker to create an account via the register function in inc/auth.php. N CVE-2026-371079.8An issue in HTMLy v.3.1.1 allows a remote attacker to escalate privileges via the get_feed function in the admin.php component CVE-2026-37117.2A vulnerability was detected in code-projects Simple Flight Ticket Booking System 1.0. Affected is an unknown function of the file /Adminupd CVE-2026-37127.3The PhastPress plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 3.10 This is due to t CVE-2026-37135.3A flaw has been found in pnggroup libpng up to 1.6.55. Affected by this vulnerability is the function do_pnm2png of the file contrib/pngminu CVE-2026-37144.7A vulnerability has been found in OpenCart 4.0.2.3. Affected by this issue is the function Save of the file admin/controller/design/template CVE-2026-371497.7GROCERY-STORE-MANAGEMENT-SYSTEM-USING-PHP-AND-MYSQL-PHPMYADMIN v1.0 was discovered to contain a SQL injection vulnerability in the scost par CVE-2026-37158.8A vulnerability was found in Wavlink WL-WN579X3-C 231124. This affects the function sub_40139C of the file /cgi-bin/firewall.cgi. Performing CVE-2026-371529.8TOTOLINK X5000R V9.1.0cu.2415_B20250515 was discovered to contain a hardcoded password for root access.