Is CVE-2026-86282 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-86282 being exploited in the wild.

How severe is CVE-2026-86282?

High severity, with a CVSS score of 7.3, published 7 September 2026.

Which products and versions are affected?

Jaychouchannel Tourism Management System up to commit 8122bf020d91199eddfff3ee02d1632a70a9a132.

Is there a fix for CVE-2026-86282?

A patch was published on 2026-09-07: Fix released in commit d44ec3aa0bd2a72c8800e3befb0a9a96a6491b86 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-86282 attacked?

It is attacked over the network, in a web application.

Am I affected by CVE-2026-86282?

Check whether you run Jaychouchannel Tourism Management System at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-86282: jaychouchannel Tourism-Management-System SQL injection in CommonController

CVE-2026-86282 · Severity: high · CVSS 7.3 · Published 2026-09-07

Tourism-Management-System is an open-source tourism platform built with Spring Boot that manages bookings, reviews, and customer data. A SQL injection vulnerability in the Common Controller allows unauthenticated remote attackers to manipulate database queries by injecting malicious SQL through table and column parameters, potentially exposing or modifying sensitive tourism and customer data.

Technologies: Jaychouchannel Tourism Management System. Vendors: Jaychouchannel.

Quick answers

Is CVE-2026-86282 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-86282 being exploited in the wild.
How severe is CVE-2026-86282?: High severity, with a CVSS score of 7.3, published 7 September 2026.
Which products and versions are affected?: Jaychouchannel Tourism Management System up to commit 8122bf020d91199eddfff3ee02d1632a70a9a132.
Is there a fix for CVE-2026-86282?: A patch was published on 2026-09-07: Fix released in commit d44ec3aa0bd2a72c8800e3befb0a9a96a6491b86 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-86282 attacked?: It is attacked over the network, in a web application.
Am I affected by CVE-2026-86282?: Check whether you run Jaychouchannel Tourism Management System at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A SQL injection vulnerability exists in the CommonController component (CommonDao) within travel/src/main/java/com/controller/CommonController.java. The vulnerability arises from insufficient input validation on the table, column, xColumn, and yColumn parameters, which are concatenated directly into SQL queries without parameterization. An unauthenticated attacker can exploit this via network access by crafting malicious requests with specially crafted parameter values. Successful exploitation allows attackers to extract, modify, or delete database records. A patch has been released (commit d44ec3aa0bd2a72c8800e3befb0a9a96a6491b86) and should be applied immediately.

Affected products

jaychouchannel Tourism-Management-System up to commit 8122bf020d91199eddfff3ee02d1632a70a9a132

Timeline

2026-09-07: disclosed
2026-09-07: patched: Fix released in commit d44ec3aa0bd2a72c8800e3befb0a9a96a6491b86

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.