Is CVE-2026-124581 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-124581 being exploited in the wild.

How severe is CVE-2026-124581?

High severity, with a CVSS score of 7.3, published 9 November 2026.

Which products and versions are affected?

Itsourcecode Airline Reservation System 1.0.

How is CVE-2026-124581 attacked?

It is attacked over the network, in a web application.

Am I affected by CVE-2026-124581?

Check whether you run Itsourcecode Airline Reservation System at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-124581: itsourcecode Airline Reservation System SQL injection in manage_flight

CVE-2026-124581 · Severity: high · CVSS 7.3 · Published 2026-11-09

The Airline Reservation System is a web application used to manage flight bookings. A SQL injection vulnerability in the flight management interface allows attackers to extract sensitive data from the database or manipulate flight records. The flaw requires valid admin credentials to exploit, but attackers with such access can bypass normal application controls to read or modify arbitrary database contents.

Technologies: Itsourcecode Airline Reservation System. Vendors: Itsourcecode.

Quick answers

Is CVE-2026-124581 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-124581 being exploited in the wild.
How severe is CVE-2026-124581?: High severity, with a CVSS score of 7.3, published 9 November 2026.
Which products and versions are affected?: Itsourcecode Airline Reservation System 1.0.
Is there a fix for CVE-2026-124581?: No fixed version is recorded yet. Use prepared statements and parameterized queries to separate SQL code from user input. Implement strict input validation to ensure the id parameter matches an expected numeric format, and minimize database account permissions to the least privileges required for normal operation. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-124581 attacked?: It is attacked over the network, in a web application.
Am I affected by CVE-2026-124581?: Check whether you run Itsourcecode Airline Reservation System at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Use prepared statements and parameterized queries to separate SQL code from user input. Implement strict input validation to ensure the id parameter matches an expected numeric format, and minimize database account permissions to the least privileges required for normal operation.

Technical details

A SQL injection vulnerability exists in the /admin/manage_flight.php file where the 'id' parameter is insufficiently sanitized before use in SQL queries. An authenticated admin attacker can inject malicious SQL code through the id parameter to execute arbitrary database commands. The vulnerability is exploitable remotely via HTTP GET requests and allows attackers to enumerate the database, extract sensitive data, or modify records.

Affected products

itsourcecode Airline Reservation System 1.0

Timeline

2026-10-16: disclosed
2026-11-09: advisory

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.