# CVE-2026-14764: code-projects Hotel and Tourism Reservation SQL injection in add_event.php

Source: https://junglewise.ai/threats/cve-2026-14764-code-projects-hotel-and-tourism-reservation-sql-injection-in-add  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-07-05. Updated: 2026-07-05  
License: CC BY 4.0 with a link back

CVE-2026-14764 · Severity: high · CVSS 7.3 · Published 2026-07-05

A security vulnerability exists in the Hotel and Tourism Reservation software, which is used to manage bookings and events for hospitality businesses. An attacker can exploit this flaw to gain unauthorized access to the underlying database without needing a username or password. This could lead to the theft of sensitive customer information, reservation data, or administrative credentials, potentially disrupting business operations.

Technologies: [Code-Projects Hotel and Tourism Reservation System](https://junglewise.ai/threats/technologies/hotel-and-tourism-reservation-system). Vendors: [Code-Projects](https://junglewise.ai/threats/vendors/code-projects).

## Quick answers

**Is CVE-2026-14764 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-14764 being exploited in the wild.

**How severe is CVE-2026-14764?** High severity, with a CVSS score of 7.3, published 5 July 2026.

**Which products and versions are affected?** code-projects Hotel and Tourism Reservation 1.0.

**Is there a fix for CVE-2026-14764?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-14764 attacked?** It is attacked over the network, in a web application.

**Am I affected by CVE-2026-14764?** Check whether you run Code-Projects Hotel and Tourism Reservation System. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A time-based blind SQL injection vulnerability exists in code-projects Hotel and Tourism Reservation 1.0 within the '/admin/add_event.php' file. The vulnerability is located in the 'fdetails' POST parameter of the Event Management Page component. Because the application fails to properly sanitize user input before including it in SQL queries, a remote, unauthenticated attacker can use specially crafted payloads (e.g., using XOR and SLEEP functions) to extract sensitive data from the database. A proof-of-concept exploit has been publicly disclosed, confirming that the vulnerability can be exploited to enumerate database contents. No official patch has been identified, but remediation involves using prepared statements with parameterized queries.

## Affected products

- code-projects Hotel and Tourism Reservation 1.0

## Timeline

- 2026-07-05: disclosed: Public disclosure of the exploit and vulnerability details.
- 2026-07-05: advisory

## References

- [https://code-projects.org/](https://code-projects.org/)
- [https://raw.githubusercontent.com/anubhavv106/Security-Advisories/refs/heads/main/Hotel-Tourism-Reservation-add_event.php_SQLi.md](https://raw.githubusercontent.com/anubhavv106/Security-Advisories/refs/heads/main/Hotel-Tourism-Reservation-add_event.php_SQLi.md)
- [https://vuldb.com/cve/CVE-2026-14764](https://vuldb.com/cve/CVE-2026-14764)
- [https://vuldb.com/submit/850582](https://vuldb.com/submit/850582)
- [https://vuldb.com/vuln/376353](https://vuldb.com/vuln/376353)
- [https://vuldb.com/vuln/376353/cti](https://vuldb.com/vuln/376353/cti)

## Related threats

- [code-projects Hotel and Tourism Reservation SQL injection in tour_reserves.php](https://junglewise.ai/threats/cve-2026-14763-code-projects-hotel-and-tourism-reservation-sql-injection-in-tour)
- [code-projects Hotel and Tourism Reservation SQL injection in rooms.php](https://junglewise.ai/threats/cve-2026-14762-code-projects-hotel-and-tourism-reservation-sql-injection-in)
- [code-projects Hotel and Tourism Reservation SQL injection in add_tour.php](https://junglewise.ai/threats/cve-2026-14756-code-projects-hotel-and-tourism-reservation-sql-injection-in-add)
- [code-projects Hotel and Tourism Reservation SQL injection in reservations.php](https://junglewise.ai/threats/cve-2026-14755-code-projects-hotel-and-tourism-reservation-sql-injection-in)
- [code-projects Hotel and Tourism Reservation SQL injection in add_room.php](https://junglewise.ai/threats/cve-2026-14754-code-projects-hotel-and-tourism-reservation-sql-injection-in-add)