CVE-2026-3723
Last modified
CVE-2026-3723 is a critical-severity vulnerability rated 9.8/10 on the CVSS scale. A security flaw has been discovered in code-projects Simple Flight Ticket Booking System 1.0. This affects an unknown function of the file /Admindelete.php. EPSS estimates a 0.37% chance of exploitation in the next 30 days.
Description
A security flaw has been discovered in code-projects Simple Flight Ticket Booking System 1.0. This affects an unknown function of the file /Admindelete.php. The manipulation of the argument flightno results in sql injection. The attack may be performed from remote. The exploit has been released to the public and may be used for attacks.
Metrics
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Carmelo | Simple Flight Ticket Booking System | 1.0 |
References
- https://code-projects.org/Product
- https://github.com/Owen-YuanW/CVE/issues/6Exploit, Issue Tracking, Third Party Advisory
- https://vuldb.com/?ctiid.349699Permissions Required, VDB Entry
- https://vuldb.com/?id.349699Third Party Advisory, VDB Entry
- https://vuldb.com/?submit.766311Third Party Advisory, VDB Entry
- https://vuldb.com/?submit.767272Third Party Advisory, VDB Entry
Timeline
- Published
- Last Modified
- Status
- Analyzed
Frequently Asked Questions
What is CVE-2026-3723?
How severe is CVE-2026-3723?
How do I fix CVE-2026-3723?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2026
- CVE-2026-37224FlexRIC v2.0.0 crashes when receiving a duplicate E2_SETUP_R…7.5
- CVE-2026-37225FlexRIC v2.0.0 crashes when the iApp receives an E42_RIC_SUB…7.5
- CVE-2026-37226FlexRIC v2.0.0 crashes when the iApp receives an E42_RIC_SUB…7.5
- CVE-2026-37227FlexRIC v2.0.0 contains reachable assert(0) calls in stub me…7.5
- CVE-2026-37228FlexRIC v2.0.0 contains a reachable assertion in e2ap_recv_s…7.5
- CVE-2026-37229FlexRIC v2.0.0 contains a reachable assertion in e2ap_create…7.5
- CVE-2026-37230FlexRIC v2.0.0 crashes when the near-RT RIC receives a RIC_I…7.5
- CVE-2026-37231FlexRIC v2.0.0 uses a uint16_t counter for xapp_id assignmen…7.5
- CVE-2026-37232An issue was discovered in OpenAirInterface5G 2.4.0 (nr-soft…8.6
- CVE-2026-37233FlexRIC v2.0.0 contains an authorization bypass in the iApp'…7.5
- CVE-2026-37234FlexRIC v2.0.0 allows a single SCTP connection to bind multi…8.2
- CVE-2026-37235FlexRIC v2.0.0 trusts the xapp_id field from E42 message pay…7.5
Are you affected by CVE-2026-3723?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST