CVE-2026-3711 - Vulnerability Analysis

Overview

code-projects Simple Flight Ticket Booking System 1.0 contains a SQL injection caused by manipulation of flightno, airplaneid, departure, dtime, arrival, atime, ec, ep, bc, bp arguments in /Adminupdate.php, letting remote attackers execute arbitrary SQL commands, exploit requires no special privileges.

Severity & Score

Impact

Remote attackers can execute arbitrary SQL commands, potentially leading to data theft or modification.

Mitigation

Update to the latest version or apply patches to fix SQL injection in /Adminupdate.php.

References

• https://vuldb.com/?id.349657
• https://vuldb.com/?submit.766309
• https://vuldb.com/?submit.767264
• https://code-projects.org/
• https://github.com/Owen-YuanW/CVE/issues/5
• https://vuldb.com/?ctiid.349657

Related Resources

• Vulnerability Intelligence Dashboard
• Credential Scanner