Vulnerability · Published Jan 21, 2026 · Assigned by VulnCheck
CVE-2021-47848Blitar Tourism 1.0 - Authentication Bypass SQLi
High 8.2
In plain English
A high-severity SQL injection in Aplikasi-Biro-Travel from satndy. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 33% of all known vulnerabilities).
Severity (CVSS 3.1)8.2High
Exploit odds (30 days)0.4%top 66.7% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack toolingNoneno public tooling known
Official description
Blitar Tourism 1.0 contains an authentication bypass vulnerability that allows attackers to bypass login by injecting SQL code through the username parameter. Attackers can manipulate the login request by sending a crafted username with SQL injection techniques to gain unauthorized administrative access.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| satndy | Aplikasi-Biro-Travel | 1.0 |
Weakness: CWE-89 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N
References
- ExploitDB-49759 exploit
- Aplikasi Biro Travel GitHub Repository product
- VulnCheck Advisory: Blitar Tourism 1.0 - Authentication Bypass SQLi third-party-advisory