CVE-2026-3746
Last modified
CVE-2026-3746 is a critical-severity vulnerability rated 9.8/10 on the CVSS scale. A vulnerability was determined in SourceCodester Simple Responsive Tourism Website 1.0. Affected by this vulnerability is an unknown functionality of the file /tourism/classes/Login.php?f=login of the component Login. EPSS estimates a 0.38% chance of exploitation in the next 30 days.
Description
A vulnerability was determined in SourceCodester Simple Responsive Tourism Website 1.0. Affected by this vulnerability is an unknown functionality of the file /tourism/classes/Login.php?f=login of the component Login. This manipulation of the argument Username causes sql injection. The attack may be initiated remotely. The exploit has been publicly disclosed and may be utilized.
Metrics
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Oretnom23 | Simple Responsive Tourism Website | 1.0 |
References
- https://github.com/CH0ico/CVE_choco_7Exploit, Mitigation, Third Party Advisory
- https://github.com/CH0ico/CVE_choco_7/blob/main/report.mdExploit, Mitigation, Third Party Advisory
- https://vuldb.com/?ctiid.349724Permissions Required, VDB Entry
- https://vuldb.com/?id.349724Third Party Advisory, VDB Entry
- https://vuldb.com/?submit.767882Third Party Advisory, VDB Entry
Timeline
- Published
- Last Modified
- Status
- Analyzed
Frequently Asked Questions
What is CVE-2026-3746?
How severe is CVE-2026-3746?
How do I fix CVE-2026-3746?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2026
- CVE-2026-37452Insecure Permissions vulnerability in MSI NBFoundation Servi…7.5
- CVE-2026-37453Insecure Permissions vulnerability in MSI NBFoundation Servi…7.5
- CVE-2026-37454Insecure Permissions vulnerability in MSI NBFoundation Servi…7.5
- CVE-2026-37457An off-by-one out-of-bounds write vulnerability in the bgp_f…7.5
- CVE-2026-37458Missing input validation in the MP_REACH_NLRI component of F…6.5
- CVE-2026-37459An integer underflow in FRRouting (FRR) stable/10.0 to stabl…7.5
- CVE-2026-37460Missing input validation in the rfapiRibBi2Ri() function (rf…7.5
- CVE-2026-37461An out-of-bounds read in the ParseIP6Extended function (/bgp…7.5
- CVE-2026-37462An integer underflow in the BGPUpdate.DecodeFromBytes functi…7.5
- CVE-2026-3747A vulnerability was identified in itsourcecode University Ma…9.8
- CVE-2026-37470An issue in ClipBucket v5 v.5.5.2 allows an attacker to exec…7.3
- CVE-2026-3748A security flaw has been discovered in Bytedesk up to 1.3.9.…8.8
Are you affected by CVE-2026-3746?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST