CVE-2026-3746 - Vulnerability Analysis

Overview

SourceCodester Simple Responsive Tourism Website 1.0 contains a sql injection caused by manipulation of the "Username" argument in /tourism/classes/Login.php?f=login, letting remote attackers execute arbitrary SQL commands, exploit requires no special privileges.

Severity & Score

Impact

Remote attackers can execute arbitrary SQL commands, potentially leading to data disclosure or modification.

Mitigation

Update to the latest version or apply patches addressing SQL injection in Login component.

References

• https://www.sourcecodester.com/
• https://github.com/CH0ico/CVE_choco_7
• https://github.com/CH0ico/CVE_choco_7/blob/main/report.md
• https://vuldb.com/?ctiid.349724
• https://vuldb.com/?id.349724
• https://vuldb.com/?submit.767882

Related Resources

• Vulnerability Intelligence Dashboard
• Credential Scanner