CVE-2026-3746

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

A vulnerability was determined in SourceCodester Simple Responsive Tourism Website 1.0. Affected by this vulnerability is an unknown functionality of the file /tourism/classes/Login.php?f=login of the component Login. This manipulation of the argument Username causes sql injection. The attack may be initiated remotely. The exploit has been publicly disclosed and may be utilized.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-74 CWE-89

Affected software

Vendor	Product	Versions
SourceCodester	Simple Responsive Tourism Website	1.0

References

https://github.com/CH0ico/CVE_choco_7Exploit, Mitigation, Third Party Advisory
https://github.com/CH0ico/CVE_choco_7/blob/main/report.mdExploit, Mitigation, Third Party Advisory
https://vuldb.com/?ctiid.349724Permissions Required, VDB Entry
https://vuldb.com/?id.349724Third Party Advisory, VDB Entry
https://vuldb.com/?submit.767882Third Party Advisory, VDB Entry
https://www.sourcecodester.com/Product

Timeline

Published: Mar 8, 2026
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2026

CVE-2026-374607.5Missing input validation in the rfapiRibBi2Ri() function (rfapi_rib.c) of FRRouting (FRR) stable/10.0 to stable/10.6 allows attackers to cau CVE-2026-374617.5An out-of-bounds read in the ParseIP6Extended function (/bgp/bgp.go) of gobgp v4.3.0 allows attackers to cause a Denial of Service (DoS) via CVE-2026-374627.5An integer underflow in the BGPUpdate.DecodeFromBytes function (/bgp/bgp.go) of gobgp v4.3.0 allows attackers to cause a Denial of Service (CVE-2026-374686.1Cross Site Scripting vulnerability in BeeHome MyBeeHome before 2025-11-01 allows a remote attacker to execute arbitrary code via the Profile CVE-2026-37479.8A vulnerability was identified in itsourcecode University Management System 1.0. Affected by this issue is some unknown functionality of the CVE-2026-374707.3An issue in ClipBucket v5 v.5.5.2 allows an attacker to execute arbitrary code via the Authentication interface, login page endpoint and HTT CVE-2026-37488.8A security flaw has been discovered in Bytedesk up to 1.3.9. This affects the function uploadFile of the file source-code/src/main/java/com/CVE-2026-37498.8A weakness has been identified in Bytedesk up to 1.3.9. This vulnerability affects the function handleFileUpload of the file source-code/src CVE-2026-37507.2A security vulnerability has been detected in ContiNew Admin up to 4.2.0. This issue affects the function URI.create of the file continew-sy CVE-2026-375034.8Cross-Site Scripting (XSS) in V2Board thru 1.7.4. The custom_html field in theme configuration is rendered using Blade unescaped output in p CVE-2026-375047.5Sensitive server_token exposed via GET parameter in V2Board thru 1.7.4. In app/Http/Controllers/Server/UniProxyController.php, the server au CVE-2026-375054.9SQL Injection via ORDER BY clause in V2Board thru 1.7.4. In app/Http/Controllers/Admin/UserController.php, the sort parameter from user inpu