CVE-2026-6492

MediumCVSS 5.3/10Last modified Aug 2, 2026

Description

A vulnerability was detected in arnobt78 Hotel Booking Management System up to f8922d0e0f6ac1cc761974c7616f44c2bbc04bea. The impacted element is an unknown function of the file /api/health/detailed of the component Health Check Endpoint. Performing a manipulation results in information disclosure. Remote exploitation of the attack is possible. The exploit is now public and may be used. This product follows a rolling release approach for continuous delivery, so version details for affected or updated releases are not provided. The patch is named d47ae0e27c700b64dc417f7f01b84a6b1b0b6bd3. To fix this issue, it is recommended to deploy a patch.

Metrics

CVSS 3.1 5.3/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Weakness enumeration

CWE-200 CWE-284

Affected software

No affected versions have been published.

Timeline

Published: Apr 17, 2026
Last modified: Aug 2, 2026
NVD status: Deferred

Related CVEs from 2026

CVE-2026-649207.8Heap-based buffer overflow in Microsoft Office Access allows an unauthorized attacker to execute code locally.CVE-2026-649218.8Missing authentication for critical function in Microsoft Office SharePoint allows an authorized attacker to elevate privileges over a netwo CVE-2026-649225.4Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Office SharePoint allows an authorized att CVE-2026-649276.4A flaw was found in the multicloud-operators-channel component. This vulnerability allows a user with specific permissions to manipulate how CVE-2026-64933.5A flaw has been found in lukevella rallly up to 4.7.4. This affects an unknown function of the file apps/web/src/app/[locale]/(auth)/reset-p CVE-2026-649344.3The Mira cloud API accepts the firmware version reported by the companion app as authoritative for a given device, without independently att CVE-2026-64945.3A flaw was found in the AAP MCP server. An unauthenticated remote attacker can exploit a log injection vulnerability by sending specially cr CVE-2026-649408.6Tegalog -Fumy Otegaru Memo Logger- provided by Nishishi Factory contains a vulnerability due to a permissive regular expression, which may a CVE-2026-649412.1URL Redirection to Untrusted Site ('Open Redirect') vulnerability in phoenixframework phoenix_live_view allows an attacker to send a victim'CVE-2026-649438.1Insertion of Sensitive Information into Log File vulnerability in Apache Answer. This issue affects Apache Answer: through 2.0.2. Full A CVE-2026-64944Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Apache Answer. This issue affects A CVE-2026-64945A vulnerability in Apache Answer. This issue affects Apache Answer: through 2.0.2. The question operation controller gates hide/show ope