CVE-2026-3708 - Vulnerability Analysis

Overview

code-projects Simple Flight Ticket Booking System 1.0 contains a sql injection caused by manipulation of "Username" argument in /login.php, letting remote attackers execute arbitrary SQL commands, exploit requires crafted request.

Severity & Score

Impact

Remote attackers can execute arbitrary SQL commands, potentially leading to data theft or database compromise.

Mitigation

Update to the latest version.

References

• https://vuldb.com/?ctiid.349654
• https://vuldb.com/?id.349654
• https://vuldb.com/?submit.766138
• https://vuldb.com/?submit.767290
• https://vuldb.com/?submit.768181
• https://code-projects.org/
• https://github.com/Owen-YuanW/CVE/issues/2

Related Resources

• Vulnerability Intelligence Dashboard
• Credential Scanner