Is CVE-2026-117514 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-117514 being exploited in the wild.

How severe is CVE-2026-117514?

High severity, with a CVSS score of 7.3, published 27 October 2026.

Which products and versions are affected?

Oretnom23 Php-Travel-Agency-System commit 4e28b8f84d72420373dd15c3ae32900beb7e0635 and prior.

Is there a fix for CVE-2026-117514?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-117514 attacked?

It is attacked over the network, in a web application.

Am I affected by CVE-2026-117514?

Check whether you run Oretnom23 Php-Travel-Agency-System at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-117514: oretnom23 PHP Travel Agency System SQL injection in admin pages

CVE-2026-117514 · Severity: high · CVSS 7.3 · Published 2026-10-27

PHP Travel Agency System is a web application for managing travel bookings and customer records. Multiple admin pages are vulnerable to SQL injection through unsanitized GET/POST parameters, allowing unauthenticated attackers to read sensitive database records, modify customer data, and delete entire tables. This exposes confidential business information including customer details, payment records, and plaintext admin credentials.

Technologies: Oretnom23 Php-Travel-Agency-System. Vendors: Oretnom23.

Quick answers

Is CVE-2026-117514 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-117514 being exploited in the wild.
How severe is CVE-2026-117514?: High severity, with a CVSS score of 7.3, published 27 October 2026.
Which products and versions are affected?: Oretnom23 Php-Travel-Agency-System commit 4e28b8f84d72420373dd15c3ae32900beb7e0635 and prior.
Is there a fix for CVE-2026-117514?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-117514 attacked?: It is attacked over the network, in a web application.
Am I affected by CVE-2026-117514?: Check whether you run Oretnom23 Php-Travel-Agency-System at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The application concatenates unescaped user input from GET and POST parameters directly into SQL queries across 23+ admin pages without using prepared statements. An unauthenticated attacker can inject SQL via parameters like costomer_id, ticket_id, emp_id, salary_id, and page_id to execute arbitrary queries. The vulnerability enables data exfiltration via UNION-based injection, mass modification, and deletion of records.

Affected products

oretnom23 PHP Travel Agency System commit 4e28b8f84d72420373dd15c3ae32900beb7e0635 and prior

Timeline

2026-10-27: disclosed: CVE-2026-117514 published
2026-10-11: other: Security issue report filed on GitHub

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.