Vulnerability · Published Feb 16, 2026 · Assigned by VulDB
CVE-2026-2553tushar-2223 Hotel-Management-System HTTP POST Request home.php sql injection
Medium 6.3
In plain English
A medium-severity SQL injection in Hotel-Management-System from tushar-2223. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 13% of all known vulnerabilities).
Official description
A security flaw has been discovered in tushar-2223 Hotel-Management-System up to bb1f3b3666124b888f1e4bcf51b6fba9fbb01d15. This affects an unknown part of the file /home.php of the component HTTP POST Request Handler. Performing a manipulation of the argument Name/Email results in sql injection. The attack can be initiated remotely. The exploit has been released to the public and may be used for attacks. Continious delivery with rolling releases is used by this product. Therefore, no version details of affected nor updated releases are available. The vendor was contacted early about this disclosure but did not respond in any way.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| tushar-2223 | Hotel-Management-System | bb1f3b3666124b888f1e4bcf51b6fba9fbb01d15 |
Weakness: CWE-89, CWE-74 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R
References
- VDB-346162 | tushar-2223 Hotel-Management-System HTTP POST Request home.php sql injection vdb-entry, technical-description
- VDB-346162 | CTI Indicators (IOB, IOC, TTP, IOA) signature, permissions-required
- Submit #750080 | tushar-2223 Hotel Management System Up to commit (including) bb1f3b3666124b888f1e4bcf51b6fba9fbb01d15 SQL Injection third-party-advisory
- https://github.com/Stolichnayer/SQLi-Hotel-Management-System related
- https://github.com/Stolichnayer/SQLi-Hotel-Management-System?tab=readme-ov-file#%EF%B8%8F-steps-to-reproduce exploit