Quick answers
- Is CVE-2026-86284 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-86284 being exploited in the wild.
- How severe is CVE-2026-86284?
- Medium severity, with a CVSS score of 5.3, published 7 September 2026.
- Which products and versions are affected?
- Jaychouchannel Tourism Management System up to commit 8122bf020d91199eddfff3ee02d1632a70a9a132.
- Is there a fix for CVE-2026-86284?
- A patch was published on 2026-09-07: Patch commit d44ec3aa0bd2a72c8800e3befb0a9a96a6491b86 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
- How is CVE-2026-86284 attacked?
- It is attacked over the network.
- Am I affected by CVE-2026-86284?
- Check whether you run Jaychouchannel Tourism Management System at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
Technical details
The vulnerability is a SQL injection or unsafe query parameter manipulation in the getOption function of CommonController.java (travel/src/main/java/com/controller/CommonController.java). An attacker can remotely manipulate the tableName and columnName parameters to extract arbitrary data from the database. The attack requires no authentication and can be launched over the network. The vulnerability has been publicly disclosed and a patch (commit d44ec3aa0bd2a72c8800e3befb0a9a96a6491b86) is available.
Affected products
- jaychouchannel Tourism Management System up to commit 8122bf020d91199eddfff3ee02d1632a70a9a132
Timeline
- 2026-09-07: disclosed
- 2026-09-07: patched: Patch commit d44ec3aa0bd2a72c8800e3befb0a9a96a6491b86