Log in Start free

Vulnerability · Published Sep 13, 2026 · Assigned by VulDB

CVE-2026-90522jaychouchannel Tourism-Management-System Password Recovery UsersController.java resetPass password recovery

High 7.3

In plain English

A high-severity security flaw in Tourism-Management-System from jaychouchannel. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 43% of all known vulnerabilities).

Severity (CVSS 3.1)7.3High
Exploit odds (30 days)0.5%top 57.0% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack toolingNoneno public tooling known

Official description

A vulnerability was determined in jaychouchannel Tourism-Management-System up to d984d172dceca907f8b447efbdb06dc233f7938d. Impacted is the function resetPass of the file UsersController.java of the component Password Recovery. This manipulation causes weak password recovery. The attack can be initiated remotely. The exploit has been publicly disclosed and may be utilized. Continious delivery with rolling releases is used by this product. Therefore, no version details of affected nor updated releases are available. Patch name: 9cb6215ac871f99a90cde763cf003e95ff282283. It is recommended to apply a patch to fix this issue.

Affected products (as reported)

VendorProductVersions
jaychouchannel Tourism-Management-System d984d172dceca907f8b447efbdb06dc233f7938d

Weakness: CWE-640 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:O/RC:C

References